We use a risk model that includes several factors, such as the types of activities a department is responsible for, and rates each department or operating unit on campus. The risk model rates each area based on both inherent risk and control risk. Inherent risk refers to the type of functions a department performs. For example, those areas that handle large sums of money have a high inherent risk rating. Control risk refers to the quality of the internal control procedures developed and used by a department.
Departments have little or no control over the inherent risk associated with their operations.
However, they have total command over control risk. Areas having a low control risk rating have audits less frequently than those with high control risk ratings, all other things being equal. Once all areas are rated, the risk model compares the risk score of each area to determine audit frequency. Audits can produce many benefits and the timing of an audit can be an important factor. Consider the situation where you assume new or additional supervisory responsibilities.