Control risk refers to the quality of the internal control procedures developed and used by a department. Departments have little or no control over the inherent risk associated with their operations. However, they have total command over control risk. Areas having a low control risk rating have audits less frequently than those with high control risk ratings, all other things being equal. Once all areas are rated, the risk model compares the risk score of each area to determine audit frequency.
Audits can produce many benefits and the timing of an audit can be an important factor.
Consider the situation where you assume new or additional supervisory responsibilities. An audit can review administrative procedures to determine whether internal controls in your new area are adequate. An audit is also helpful in assessing system controls and changed office procedures for newly installed computer systems or procedures changed as a result of restructuring. A periodic review of your unit's administrative activity can benefit you. It will help you to be sure that your procedures adhere to university and state policies.