Skip to main content

more options

Cornell Hotline

Frequently Asked Questions

What Is Internal Audit?

Just what do auditors do? How do they select their "auditee"? Many units don't give audits a second thought until they are selected for review. Here is some general information about the internal audit function at Cornell.

Who are internal auditors?

As defined by the Institute of Internal Auditors (IIA), "Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.

Internal Auditors' roles include monitoring, assessing, and analyzing organizational risk and controls; and reviewing and confirming information and compliance with policies, procedures, and laws. Working in partnership with management, internal auditors provide the board, the audit committee, and executive management assurance that risks are mitigated and that the organization's corporate governance is strong and effective. And, when there is room for improvement, internal auditors make recommendations for enhancing processes, policies, and procedures."

Back to Top

Why does Cornell have an internal audit function?

The University Audit Office exists by charter and by-law to assist University management and the Audit Committee of the Board of Trustees in effectively fulfilling their responsibilities. We are charged with examining and evaluating the policies, procedures, and systems which are in place to ensure: the reliability and integrity of information; compliance with policies, plans, laws, and regulations; the safeguarding of assets; and, the economical and efficient use of resources.

In simpler words, we're here to help.

Back to Top

Where does the audit function fit in the organization?

The University Auditor has a solid-line reporting relationship to Cornell's President and the Audit Committee of the Board of Trustees.

We're a small office with a big job.

Back to Top

What's the difference between external and internal auditors?

External auditors can be government auditors or independent public accounting firms that Cornell hires. Government auditors focus primarily on compliance with government regulations and award terms. Since both federal and state governments fund a significant portion of the university's activities, they want to make sure we use their money as they intended.

Independent public accounting firms review the university's annual financial statements to ensure the information presented accurately portrays Cornell's financial condition. Government agencies, Cornell's Board of Trustees, and bond rating agencies rely on the independent auditor's opinion of Cornell's financial statements.

Internal auditors sometimes look at the same data or perform some of the same steps as external auditors. If there is a problem, it's better to find it and fix it before external auditors review our practices.

Back to Top

What if an external auditor contacts you?

All external audits should be coordinated through the University Audit Office or Sponsored Program Services. If you or your unit is contacted by an external auditor, before sharing any information, direct them to contact the University Audit Office or Sponsored Program Services. We can sometime dissuade an audit or at least minimize the impact on an operation.

Remember, internal audit is on your side and can help you get through an external audit.

Back to Top

How are units selected for audit?

Every two years, the University Audit Office performs a comprehensive risk assessment. First, the university is broken down into audit risk areas, such as Sponsored Research, information systems or processes. Next, key stakeholders evaluate the likelihood of an adverse event and the impact or potential potential damage the adverse event would have to the university. The audit office then decides which areas to audit based on these risk rankings and the audit resources available.

Back to Top

What are internal auditors looking for?

Primarily compliance with university policies and sound internal controls. Cornell's policies are designed to help ensure we all comply with applicable laws and regulations and operate efficiently. By following these policies we help protect the university from unnecessary risks and help ensure sound business practices are consistent throughout the university. University policies can be found here: http://www.policy.cornell.edu. However, not all internal controls can be codified in policy. If we find control weaknesses, we regularly make recommendations to implement a control even though it may not be specifically required by policy.

Back to Top

What if something isn't handled correctly?

We will make recommendations for improvement. The recommendations are realistic because we want you to implement them. It is the responsibility of management to weigh possible additional costs of implementing our recommendations in terms of benefits to be derived and the relative risks involved.

Back to Top

Is the Audit Office part of the Division of Financial Affairs?

No, the Audit Office works independently of the Division of Financial Affairs. Our office has a solid-line reporting relationship to Cornell's President and the Audit Committee of the Board of Trustees.

Back to Top

Can a department request an audit?

Yes! We consider requests for audit work, although our ability to perform the audit might be affected by our staffing levels, or year end deadlines. Still, if you are concerned about an area in your department, we will try to make time for a limited examination of the area.

We're also available to do presentations and training for your department.

Back to Top

How long does an audit take?

We budget between 200 and 600 hours for a typical audit, depending on the size and complexity of the area. We normally have one auditor leading the audit, and auditors will sometimes have more than one audit in process at a time, so an audit could take from two months to six months to complete.

Back to Top

What if I don't have the time to deal with the auditors? What if it's a bad time for an audit because (choose one):
a) we're short-staffed
b) the finance director just quit
c) it's budget season
d) we're crawling with students!
e) we're trying to close out the year.

During the audit opening meeting, we will discuss the audit schedule and try to accommodate time constraints that you may have. Although 200 to 600 hours looks like a lot of time, much of our work is done behind the scenes. Many people operate under the erroneous belief that in doing an audit we will spend lots of time with you and take time away from your other obligations. We may need to meet key personnel on the audit two or three times for maybe an hour at a time over the audit period. We may spend equal amounts of time, and perhaps less, with others in the department, but we will not be monopolizing anyone's time in the department and much of our work such as audit planning and report writing, is done in our offices.

Back to Top

Who will receive my audit report?

We send copies of audit reports to the department administration, the President, the Vice President for Finance and CFO, the Controller, the external auditors (PricewaterhouseCoopers) and to others, depending on the type of audit. Reports on academic units are sent to the Provost. IT audit reports go to the Vice President for Information Technologies. Reports on irregularities are sent to University Counsel, and may be sent to either the Dean of Faculty, Vice President for Human Resources, or the Judicial Administrator depending on if they involve faculty, staff, or students.

Back to Top

Does the Board of Trustees see what is in the audit reports?

We prepare an annual report for the Trustees containing the most significant findings or systematic issues from our audits for the year.

Back to Top

Who audits the Audit Office?

Excellent question! Actually, we are audited every five years by other auditors under guidelines set forth by the Association of College and University Auditors. This "peer review" process draws upon the standards and guidelines set forth by the Institute of Internal Auditors in their International Standards for the Professional Practice of Internal Auditing. The peer reviewers typically include auditors from other universities, public accounting firms, or specialists in an audit area and they issue a report with findings and recommendations, just as we do when we audit university units.

Back to Top

If I call you with information about a possible irregularity, will my identity be kept a secret?

This is a hard question to answer without knowing whether or not the specific circumstance you are reporting will end up in legal action. As a general rule, we do not reveal our sources to the person being investigated. And we always try to corroborate any accusations with our own observation. If an irregularity is referred to the District Attorney for legal prosecution, and your testimony would be critical to the outcome of the case, it may become necessary to involve you in the irregularity. In addition, the Cornell Hotline provides for anonymous report of financial irregularities.

Back to Top