Tufts University

Frequently Asked Questions (FAQS) About Internal Auditing

What are Internal Controls and Who is Responsible for Them?

Internal control is defined as a process, designed to provide reasonable assurance regarding the achievement of objectives. Internal controls can be categorized as either accounting controls or administrative controls. Accounting controls are designed to safeguard University assets and ensure the accuracy of financial records. Administrative controls are designed to promote operational efficiency, effectiveness, and adherence to University policies and procedures. University management is responsible for designing and maintaining an adequate system of internal control. AMAS independently reviews and evaluates the adequacy of the system of internal controls and makes recommendations to management to improve these controls based on system testing and control analysis.

Who are internal auditors?

As defined by the Institute of Internal Auditors (IIA), "internal auditors are "business generalists" who specialize in efficiency and effectiveness for the good of the organization.

Their roles include monitoring, assessing, and analyzing organizational risk and controls; and reviewing and confirming information and compliance with policies, procedures, and laws. Working in partnership with management, internal auditors provide the board, the audit committee, and executive management assurance that risks are held at bay and that the organization’s corporate governance is strong and effective. And, when there are opportunities for improvement anywhere within the organization, internal auditors make recommendations for enhancing processes, policies, and procedures."

Why does Tufts have an internal audit function?

AMAS exists by charter and by-law to assist University management and the Audit Committee of the Board of Trustees to effectively fulfill their responsibilities. We are charged with reviewing the reliability and integrity of information; compliance with policies, plans, laws, and regulations; the safeguarding of assets; and, the economical and efficient use of resources.

What’s the difference between external and internal auditors?

External auditors can be government auditors or independent public accounting firms with which Tufts enters into a contract. Government auditors focus primarily on compliance with government regulations and sponsored program award terms.

Independent public accounting firms review the university’s annual financial statements to ensure the information presented accurately portrays Tufts’ financial condition.

What are internal auditors looking for?

Internal auditors are primarily concerned with compliance with policies and the proper deployment of internal controls. Tufts’ policies are designed to help ensure its employees comply with applicable laws and regulations and operate their areas of responsibility efficiently. By following these policies, we help protect the University from unnecessary risks and ensure sound business practices are consistent throughout the University.

Can a department/unit request an audit?

Yes. We take requests for audit work, although our ability to perform the audit may be affected by our staffing levels, annual audit plan, or year-end deadlines. Nevertheless, if you are concerned about an area in your department, we will try to schedule time for a review.

What does a typical internal audit include?

Common elements of an internal audit engagement include the following:

• Sending an introductory audit scope letter to the responsible individual(s) of the unit/department/area.
• Scheduling an entrance meeting to discuss audit objectives, timing, and intended report distribution.
• Evaluating internal control systems
• Testing to ensure proper operation of internal control systems
• Developing conclusions based on test results and other assessments
• Reviewing audit issues and draft audit reports with management and staff
• Preparing and distributing an audit report which generally include management's responses to the issues identified

• Following up to ensure all issues raised in audit reports have been addressed

Who will receive copies the audit report?

We send copies of audit reports to the individual responsible for the area under review and his or her direct supervisor, the VP for Finance, the Executive VP, Tufts’ external auditors and to others, depending on the type of audit. IT audit reports are also forwarded to the VP for Information Technologies.

Does the Board of Trustees see what is in the audit reports?

We prepare a summary report for the Trustee Audit Committee every six months, summarizing the most significant findings from our audits. Any significant issues would in turn be summarized for the full Board.