As a part of this process, Internal Audit conducts 10 - 15 full scope audits and several limited scope reviews each fiscal year. We also perform audits of possible irregularities when necessary. Internal Audit conducts full scope audits on a 5 - 7 year cycle for most administrative departments. We use a risk model that includes several factors, such as the types of activities a department is responsible for, and rates each department or operating unit on campus. The risk model rates each area based on both inherent risk and control risk.
Inherent risk refers to the type of functions a department performs.
For example, those areas that handle large sums of money have a high inherent risk rating. Control risk refers to the quality of the internal control procedures developed and used by a department. Departments have little or no control over the inherent risk associated with their operations. However, they have total command over control risk. Areas having a low control risk rating have audits less frequently than those with high control risk ratings, all other things being equal.