Page History

ROWAN UNIVERSITY POLICY

Title: Internal Audit
Subject: Governance
Policy No: IA: 2015:02
Applies: University-Wide
Issuing Authority: President
Responsible Officer:

...

General Counsel
Adopted: 1/27/15
Last Revision:

...

May 26, 2022 
Last Reviewed: March 14, 2024 

I.    PURPOSE

To outline the roles, authority and responsibilities of the Office of Internal Audit and those of the management whose schools, departments and divisions are audited.

...

Under the direction of the Audit Committee of the Board of Trustees, the President and the Chief of StaffGeneral Counsel, the Chief Internal Auditor shall ensure compliance with and implement this policy, which has been approved by the Audit Committee.

...

1. The University has an Internal Audit department to provide an independent and objective assurance service that will add value and improve operations through improved controls and efficiencies. Internal audit reviews are intended to assist the University in determining the adequacy and effectiveness of internal controls, adherence with applicable laws and regulations, and reliability of financial reporting. A well designed internal audit function will help the University accomplish its objectives by applying a systematic, disciplined approach to evaluate and assess the effectiveness of risk management, control and governance processes.

2. The Chief Internal Auditor and internal auditors must be independent in appearance as well as in fact. For this reason, they report directly to both the Chair of the Audit Committee of the Board of Trustees and to the University President and Chief Of StaffGeneral Counsel. These reporting relationships ensure the independence of the Internal Audit function and the adequate consideration of Internal Audit findings and recommendations

   1. Internal auditors will not be responsible for developing or implementing procedures, preparing records, or engaging in any activity which they would normally review and evaluate, since doing so could reasonably be construed as making them responsible for what they are auditing and thereby compromising their independence. In this regard, Internal Audit personnel are not to be used as accounting, finance or information systems staff. Internal Audit has neither direct responsibility for, nor authority over, the operations or activities that are reviewed.

   2. The auditors do not make operating decisions, and do not have the authority to direct activities, including implementation of corrective actions. These activities and tasks remain the responsibility of management.

   3. Internal Audit is authorized to obtain the necessary assistance of personnel of the University unit where they perform audits, as well as specialized services from inside or outside of the organization.

3. The scope of the Internal Audit activity is intended to determine whether the organization's activities of risk management, control, and governance, as represented by management, are adequate and functioning as designed. The internal audit activity, with strict accountability for confidentiality and safeguarding records and information, is authorized full, free, and unrestricted access to any and all of Rowan University records, physical properties, and personnel pertinent to carrying out any engagement. All employees are requested to assist the internal audit activity in fulfilling its roles and responsibilities. While the Internal Auditors have free and unrestricted access to senior management and the Board, they will attempt to resolve any issues related to a perceived limitation of scope through the Chief Of StaffGeneral Counsel.

   1. Internal auditors will exhibit the highest level of professional objectivity in gathering, evaluating, and communicating information about the activity or process being examined. Internal auditors will make a balanced assessment of all the relevant circumstances and not be unduly influenced by their own interests or by others in forming judgments.

   2. Management's Responsibility

      1. Notify Internal Audit when changes to applications and systems are being planned that may ultimately affect data that are used in financial reporting systems.

      2.  Provide sufficient staffing and other resources as needed, including specialized technical staffing, to support Internal Audit during an engagement.

      3. Provide a timely response to the auditor's findings and recommendations, including an achievable management action plan, within ten business days from the receipt of the draft audit report.

      4. Promptly assign department responsibility for ensuring the management action plan is implemented and appropriate follow-up action is completed.

      5. Respond promptly to Internal Audit's requests for status reports and updates, and attend meetings of the Audit Committee when the audit report is being considered.

...

ATTACHMENT 1
RESPONSIBILITIES OF THE CHIEF INTERNAL AUDITOR

1. Review, with the Chief Of StaffGeneral Counsel, the President and the Audit Committee, the Internal Audit Policy, the Annual Audit Plan, other activities, staffing and organizational structure of the internal audit function.
2. Provide assessments for the entity under review on the adequacy and effectiveness of processes for controlling its activities and managing its risks to ensure controls are effective and functioning as intended.
3. Inform and advise the audit committee and management of all audit findings with recommendations for appropriate corrective measures.
4. Provide the Audit Committee, Senior Management and auditees with an overall assessment of financial, operational, compliance and information technology controls necessary to minimize the risk of material loss and meet the University's functional objectives.
5. Conduct follow-up inquiries (informal) and reviews (formal) as appropriate to ensure satisfactory actions are taken by management to resolve significant audit findings.
6. Provide periodic updates to the Audit Committee on the status of engagements contained in the Annual Audit Plan, including any findings warranting the attention of the Audit Committee.
7. Coordinate Internal Audit activities with other control and monitoring functions (compliance, ethics, risk management, security, legal, and external audit firms) to best achieve the objectives of the internal audit function, as well as the objectives of the University. This includes, where appropriate, coordination with and assistance to the independent public accounting firms.
8. Lead or assist in the investigation of significant suspected fraudulent activities and notify executive management and the Audit Committee of the results
9. Maintain a professional audit staff with sufficient knowledge, skills, experience, training and professional certifications to meet the requirements of this charter. Periodically assess the overall effectiveness of department training program.
10. Keep the Audit Committee and senior leaders informed of emerging trends and successful best practices in internal auditing.

Communicate periodically with the Chief Of StaffGeneral Counsel, the President and the Audit Committee on the internal audit activity's purpose, authority, responsibility, and performance relative to planned audit activities. Reporting will also include significant risk exposures and control issues, including fraud risks, governance issues, and other matters needed or requested by senior management and the board. The frequency and content of reporting are determined in discussion with the Chief Of StaffGeneral Counsel, the President and the Audit Committee and depend on the importance of the information to be communicated and the urgency of the related actions to be taken by senior management or the board. 

...