Driving Institutional Sustainability and Student Success through Internal Audit

The higher education industry continues to face an ever-changing and unprecedented spectrum of risks that can threaten an institution’s mission, fiscal sustainability, and student outcomes.

These risks, such as declining enrollment, rising costs, an evolving regulatory burden, and increasing expectations and needs for student well-being, require institutional leaders to reimagine business models and innovate to achieve resilience. Neglecting such challenges can not only negatively impact institutional fiscal position and reputation but also put student success at risk.

Internal audit can be a powerful tool to manage an institution’s path across a dynamic landscape. At its core, internal audit is an independent, objective assurance and consulting activity that aims to protect and enable the institution’s key strategic objectives and assets through improved risk management, internal control, and governance processes.

Historically, internal audit has focused primarily on addressing financial risks or serving as a policing function for the organization to ensure compliance with policies—and 20 years ago, internal audit did spend a lot of time looking at expense reports, petty cash, and basic access controls. Today, however, internal audit functions have drastically evolved to address the much broader, more strategic range of risks that can compromise the very existence of an institution.

Internal audit can:

• Identify high-priority risks to institutional and student success
• Provide transparency, insight, and objective assurance into these risks and the institution’s mitigation efforts
• Help the board better oversee risk and risk mitigation efforts to drive sustainability and success

In fact, some of today’s hottest risks happening across the industry should cause trustees to ask, “Where is internal audit?”

What can colleges and universities do to mitigate risks in higher education? We outline the critical role internal audit plays in the following institutional areas:

Academic integrity

Why it matters

Institutional reputation is largely built upon the quality and integrity of academic programs. In recent years, higher education has experienced increased rates of cheating and inappropriate awarding of course grades or degrees. The emergence of accessible artificial intelligence (AI) technology (e.g., ChatGPT) leaves institutions divided over how such advances impact academic integrity. Academic integrity issues create reputational harm for the institution and could negatively impact the institution’s standing with accrediting agencies, alumni, or donors and current and potential students. Leaders must consider the design and operation of policies, procedures, systems, and other controls that safeguard academic honesty at the institution.

What internal audit can do

An internal audit in this area can help provide insight into the following key questions for trustees:

• How has the institution defined its academic integrity approach, and are there formalized expectations, policies, and guidance for students and faculty?
• How pervasive are academic integrity issues on campus?
• Has the institution determined how to treat AI technologies and publicly share its position?
• What is the institution’s process for evaluating, adjudicating, and appealing academic integrity instances, and is that process fairly designed and executed?
• How does the institution educate and communicate academic integrity expectations and protocols to the campus community?
• Is the institution maximizing its use of technology to monitor for academic dishonesty?

Student health and well-being

Why it matters

Student health and well-being, especially mental health, is a top priority enterprise risk for almost every institution. A student facing challenges with their mental health has a significant hurdle to their successful completion of their education goals. Institution-wide, student well-being challenges can decrease retention, graduation, and other student success outcomes, which in turn impacts overall enrollment and fiscal metrics. Further, the holistic care culture today’s students expect can be difficult to implement, both culturally and financially. And perhaps most importantly, an insufficient response to supporting student wellness can result in tragic outcomes and reputational damage.

What internal audit can do

Internal audit can provide objective information to trustees in the following areas:

• High-risk areas in student wellness administration
• Sufficiency of policies and procedures
• Adequacy of assigned resources
• Level of awareness and usage of student wellness resources among different student groups
• Clarity of communications and coordination between groups that often share student-related risks (e.g., decision trees, hand-offs, behavioral intervention teams)
• Effectiveness of controls in place
• Areas to allocate future funds to better ensure overall student well-being (e.g., centralized systems to track and monitor efforts, additional headcount for critical areas such as counseling, opportunities to outsource elements of programming)

Cybersecurity risk management

Why it matters

As colleges and universities adopt more digital processes and technologies in response to the need to transform at an accelerated rate, campuses become more vulnerable to cyber risks—operational, financial, regulatory, and reputational—especially due to the highly distributed nature of information technology (IT) staff and systems. Now more than ever, higher education boards’ collaboration with internal and external stakeholders is essential to address common cybersecurity challenges in higher education settings, including managing compliance, making proactive investments in IT and cyber risk mitigation tools, and centralizing IT operations across departments, offices, and campuses.

What internal audit can do

Internal audit can provide transparency to trustees in how cybersecurity risks are managed at the institution through evaluating and assessing internal controls, monitoring, reporting, and effective governance in the following areas:

• Information security program maturity
• Multi-factor authentication
• IT inventories
• Incident response/security monitoring
• Vulnerability management
• Vendor management
• Network age, security, and funding

Inclusive excellence

Why it matters

Inclusive excellence, which allows for a range of unique perspectives and solutions to be heard and considered, has become one of the major drivers that impact a student’s choice of a college or university. Achieving inclusive excellence on campuses leads to more informed decision-making, increases creativity and innovation, and supports student belonging as well as academic and personal outcomes. Institutions with strong, thoughtful diversity, equity, and inclusion (DEI) programs can maximize enrollment and retention, fiscal outcomes, and academic quality.

What internal audit can do

An internal audit in this area can help provide insight into the following key questions for trustees:

• How has the institution set and communicated its DEI goals?
• Do externally facing goals align with internal actions?
• What progress has been made in the inclusive excellence space, and how can identified accelerators be leveraged in other areas across campus?
• What are the obstacles to achieving inclusive excellence goals?
• Has the institution dedicated sufficient resources (e.g., people, funding, tools) to achieve its stated goals?
• Does the institution have adequate measures in place to assess progress toward its goals?
• Is the institution on track to meet its goals according to the stated time frame or within a reasonable time frame?

Baker Tilly can help

Our higher education internal audit specialists can help college and university boards and cabinets conduct a risk assessment to evaluate the current condition of your institution’s risk health. We assist in identifying opportunities for improvement, delivering recommendations, and serving as a co-sourced or outsourced internal auditor.

Additional resources

Baker Tilly higher education internal audit resources

Internal audit: understanding co-sourcing and outsourcing models

Baker Tilly higher education solutions

Contact us

Ashley Deihr is a partner at Baker Tilly.