How are areas selected to be audited?
Audit and Management Services performs annual risk assessments, which begin with updating the audit universe, or list of auditable units in the population including IT systems. Members of management and external auditors are interviewed and numerous materials, including industry updates, news articles, financial activity and audited financial statements are reviewed. Based on these inputs, each auditable unit is scored, and the highest-scoring projects or units are selected for the audit work plan. The plan is monitored throughout the year and adjusted as necessary due to the changing risk environment.