Internal Audit

May is Internal Audit Awareness Month, a timely reminder of the important role internal audit and risk assessment play in helping institutions navigate growing complexity and uncertainty.

Higher education is operating with a tighter margin for error than it has in years financially, operationally, and reputationally. Enrollment swings, rising compliance expectations, and cyber risk are hitting at once. When risk assessment and internal audit are positioned well, they give leadership early visibility into what could disrupt the mission, and practical steps to reduce surprises.

The Expanding Risk Landscape

In higher education, the risk environment is uniquely complex, spanning academics, operations, finances, and reputation. In our work with colleges and universities, the pressure points most campuses are managing typically include:

• Cybersecurity & data privacy: Sensitive student, research, and financial data; evolving threats
• Regulatory compliance: Title IV, Clery, FERPA, grant requirements
• Financial sustainability: Enrollment volatility, tuition dependence, declining state support, endowment pressure
• Research integrity & funding oversight: Federal scrutiny; controls that stand up to review
• Operational complexity: Decentralization, inconsistent processes, control gaps

When the top risks aren’t clearly prioritized, campuses end up reacting after the fact. A structured risk assessment helps leaders focus early and stay ahead of issues before they become findings, headlines, or budget surprises.

Why the Margin for Error Is Shrinking (Public and Private)

Many institutions feel this, public and private alike. Whether the driver is enrollment volatility, pricing and discounting, endowment performance, or new compliance demands, the margin for surprises is shrinking.

For public institutions, uncertainty in state support can tighten that margin even further. When baseline funding is unpredictable, control breakdowns, delayed reporting, or weak oversight can turn into real budget surprises faster, and with fewer options to absorb them.

The Role of Risk Assessment

A good risk assessment gives leadership a clear, practical view of what could most disrupt the mission and how the institution is responding.

When it’s done well, the risk assessment:

• Surfaces the highest-impact risks (and separates what’s urgent from what’s just noise)
• Connects risk to strategy, so priorities reflect where the institution is going, not just where it’s been
• Calls out gaps in controls, ownership, and governance before they become findings
• Sets the direction for the audit plan and the work that will move the needle

In our experience, the best risk assessments include a broad mix of voices (academic leadership, finance, IT, compliance, and research administration). That’s how leadership gets a view of risk that matches how the campus actually runs, not just how the organizational chart says it runs.

Internal Audit as a Strategic Partner

Internal audit still gets pegged as a backward-looking function, where someone shows up after the fact and writes a report. That’s not how the strongest teams operate. Modern internal audit helps leadership get ahead of risk, strengthen operations, and build confidence in how things work day to day.

For example, instead of reviewing a process after a breakdown, leading teams are assessing new system implementations, research programs, or third-party relationships early, before risks materialize.

That can look like a quick pre-go-live review of an ERP or student information system change, a readiness check for a new research center, or due diligence around a key vendor before contracts are signed.

In practice, that shows up in a few ways:

• Independent assurance: pressure-testing whether controls are designed well and operating as intended
• Advisory support: helping process owners make improvements and think through emerging risks
• Risk alignment: making sure the audit plan tracks to today’s priorities, not last year’s cycle
• Governance support: equipping boards and audit committees with the visibility they need for effective oversight

When it’s positioned well, internal audit has a seat at the leadership table, engaged early to shape decisions, while still maintaining the independence and objectivity leaders rely on.

Common Gaps We See

Across higher ed, a few recurring issues tend to get in the way of a strong risk and audit function:

• Risk assessments that happen too infrequently (or become a one-and-done exercise)
• Audit plans driven by historical cycles instead of current risk priorities
• Compliance, risk management, and internal audit operating in silos
• Teams that are lean relative to the risk profile, especially in technical areas like IT security and research compliance
• Inconsistent documentation of processes and controls across departments

Closing these gaps doesn’t always require a major investment. Most of the time it starts with clearer ownership, better alignment, and more discipline around prioritization. For smaller audit teams, it can also mean rethinking the delivery model, such as co-sourcing or targeted specialists, so the highest-risk areas get real coverage.

Practical Steps to Strengthen Your Approach

If you want to strengthen your internal audit and risk assessment approach, these are practical moves that tend to pay off. If you do only a few things, start with the “Do now” list, then move to “Do next” as you build momentum.

Do now (next 30 to 60 days)

1. Confirm the current risk assessment is less than 12 months old; if not, refresh it.
2. Gather executive and board/audit committee input on what should rise to the top.
3. Map planned audits to top risks and identify gaps or low-value carryovers.
4. Identify 2–3 high-risk areas where analytics could add immediate value.
5. Assess where your team lacks depth (especially cybersecurity, grants management, and research compliance).
6. Clarify risk ownership and expectations for process owners (what “good controls” looks like).
7. Identify technical areas where coverage is needed but capacity is limited.

Do next (this year)

1. Set a cadence (at least annually) and trigger updates when the institution changes (new systems, new programs, major leadership shifts).
2. Build a repeatable leadership input process (interviews, surveys, workshops) to refresh priorities.
3. Reallocate limited resources to where coverage will matter most (highest impact, weakest controls, greatest change).
4. Build repeatable analytics to surface trends, anomalies, and control breakdowns faster than interviews alone.
5. Line up SMEs (internal or external) for targeted reviews, planning support, or technical testing.
6. Embed risk thinking into how departments operate (check-ins, metrics, onboarding), not a separate annual exercise.
7. Use co-sourcing to expand coverage in specialized areas without building permanent fixed costs.

Make Internal Audit Accessible Across Campuses

For decentralized institutions, internal audit is most effective when it’s visible, approachable, and easy to engage. A few moves that can help:

• Predictable touch points: Virtual office hours and periodic on-site days
• Campus liaisons: One point of contact per campus/area to coordinate and escalate
• Simple intake: One clear pathway (advisory request, concern, training) and response times
• Short learning sessions: 30-minute, role-based webinars on common pain points
• Plain-language tools: One-page checklists and “what good looks like” examples
• Feedback loop: Quick post-engagement input to improve timing, communication, and deliverables

If you’re not sure where to start, pilot two or three of these steps at one campus this quarter, then scale what works across the system.

The Bottom Line

Higher education can’t eliminate risk, but it can be managed far more intentionally. A thoughtful risk assessment paired with a well-positioned internal audit function gives leaders visibility, strengthens controls, and supports confident decision-making.

When resources are tight and expectations keep rising, that kind of clarity isn’t a nice to have. It’s what keeps surprises from becoming crises.

If you’re reassessing your approach, consider benchmarking your current audit plan against today’s risk profile, then selecting one “Do now” action to tackle in the next 30 to 60 days. Contact the Dean Dorton team to discuss how we can help support your internal audit and risk assessment efforts.