The higher education landscape continues to experience change at an accelerated rate. To remain relevant, competitive, and financially sustainable, leaders at Minnesota State Colleges and Universities (Minnesota State)—the nation’s third largest system of colleges and universities—recognized a need for the system to be more innovative and nimble in order to respond appropriately to evolving needs. While such an environment can create opportunities, it also generates risks that, left unchecked, could disrupt Minnesota State’s efforts to successfully accomplish its goals.
As Minnesota State embarked on a transformation journey, the Board of Trustees, system leadership, and the Office of Internal Auditing jointly identified an opportunity for the audit function to maximize its value and contributions. A few years ago, the Office of Internal Auditing started on a path to transform from an assurance function that was primarily reactive, backward looking, and focused on financial matters to one that balances assurance with proactive, forward-looking, strategic advisory services focused on matters of systemwide significance.
During the course of this transition, we reflected on the success factors that enable us to most effectively support Minnesota State going forward.
Internal audit can add greater value as an enabler of change in an age of disruption.
The Minnesota State system was created in 1995 to merge 37 of the state’s colleges and universities. At that time, the bulk of internal audit’s effort focused on assurance services related to compliance and financial activities, alongside investigations of issues as they arose. In recent years, however, there has been a growing recognition that to address the emerging dynamics and new realities in higher education, large-scale investment and change will be required—all of which are accompanied by risk.
As the idea of expanding internal audit’s role emerged, it became apparent that the Office of Internal Auditing housed untapped skill sets that would be particularly valuable as Minnesota State began its transformation journey. We saw the opportunity for internal audit to focus more on matters of strategic importance. This took shape across three categories:
1. Enabling a strategic focus: A more strategic focus for internal audit is aligned with the system’s overall objectives. Most visibly, this is reinforced by an ongoing board-driven initiative called “Reimagining Minnesota State” that is intended to understand the impact of the disruptive forces currently facing U.S. higher education and how Minnesota State can best respond. Ultimately, this strategic process points to an ambitious view of the future—one that could completely transform the higher education experience for Minnesotans.
Strategic initiatives—everything from student success and narrowing the achievement gap to capital investments and cyber-security—play into the purpose, delivery and relevance of higher education and how well Minnesota State is set up to provide it. Internal audit is engaged with the highest levels of support. As Chancellor Devinder Malhotra puts it, “It is my charge to ensure that internal audit is integral to conceptualizing our strategic positioning.”
2. Offering advisory services: The scope of change in higher education mandates a structure designed to respond to evolving needs, both for the system as a whole and its many moving parts. Minnesota State designed a process to accommodate such a structure. Internal audit is an integral component.
For example, internal audit performs periodic project risk reviews around our upcoming enterprise resource planning (ERP) system implementation to evaluate how well project teams are managing risks and help anticipate issues that may arise. Results are reported to the board and ERP Steering Committee, ensuring that a wide range of stakeholders is kept up to date and is afforded the opportunity to weigh in.
Another example is a consultative ERM structure that can be used to connect with entities across the system, allowing internal audit to develop an overarching risk profile that is shared with the board and used to inform decision making and annual work plans.
3. Introducing a risk framework: The ability to identify, manage, and mitigate risk is inherently necessary for an internal audit function to perform its duties. As responsible stewards of tuition dollars, it makes sense to engage the people in the system who are trained to manage risk in efforts of systemwide significance.
As internal audit becomes part of the Minnesota State culture, stakeholders are becoming more focused on asking difficult questions: for any given project, what are the threats, how willing are we to take them on and how can we mitigate them? Equally important, what is the worst-case scenario? The task for internal audit is to offer insight and support our partners as they explore risks.
Vice Chancellor for Academic and Student Affairs Ron Ander-son describes this shift. “The discussion isn’t foreign, we just never framed it as a risk. We were talking about enrollment, retention, changing demographics. We’re very much attuned to those things in our world, but we didn’t view them from the lens of risk and how we mitigate and manage that. Now we are much more comfortable with the language and framework.”
These components have allowed internal audit to be seen as a strategic partner that is now sought after for its services.
The work we sought to undertake was bigger than a single office.
When initial discussions of internal audit’s role came about, they were met with wholehearted agreement by our office. Interest in engaging in strategic initiatives was high, but the capacity to do so was not. An agile, highly specialized team was required to address the needs of a system as large and complex as Minnesota State. It quickly became clear that we would never be able to bring all of the expertise we needed in-house, particularly given that subject matter experts would not always be needed on a continual basis.
We needed experts who could provide unique insight into our strategic under-takings. We needed a partner that could provide a line of sight to best practices and trends across higher education, exposure to other environments, and access to expertise as needed. Outsourcing was ruled out as it failed to offer the benefits of engaging internal audit as a strategic partner. Instead, a co-sourcing solution was conceptualized.
A co-sourcing solution—where internal audit works in partnership with an outside partner toward a shared goal—could augment internal audit with competencies that could not realistically be hired. The office opted, through attrition, to reduce the internal team from 10 auditors to 4 and reallocate that budget to a co-sourced partner. With an experienced internal audit partner, the team could bring the benefits of an internal audit shared service across the system, but without the infrastructure required to build such a service in-house.
“The co-sourcing model is critical,” says Chancellor Malhotra. “As we expanded the role, scope, and complexity of the audit function, and asked them to be a partner in strategic formulation and positioning of the organization, we didn’t have the resources to build the capacity to deliver on what was being asked of internal audit. And we also recognized that perhaps it wouldn’t make sense to build the capacity in-house because it would be more expensive and require a longer runway to be fully functioning.”
After an RFP and selection process, the accounting and advisory firm of Baker Tilly was selected based on the firm’s experience in higher education as well as its agility. We partner with a core team, and when an expert on cybersecurity, change management, project governance, compliance, etc. is needed, the firm provides it.
Internal Audit at Minnesota State Embraces Change
Internal audit at Minnesota State is focused on strategic alignment and collaboration geared toward a more forward-thinking, strategic approach to audit. We strive to do that through our involvement in a variety of initiatives, including:
Shared services: Internal audit works on a major shared services initiative called HR-TSM (Human Resources Transactional Service Model). This includes moving HR transactional work from each college and university to one of four shared service centers for greater processing effectiveness and risk mitigation.
The HR-TSM project is emblematic of the benefits of bringing internal audit into a project early on. During the planning phases, it became clear that more rigor was required to ensure its success. Internal audit helped to identify several key priority issues, including the need for a more structured governance framework. This led to solutions to better solve policy issues, track transaction processing in a more cohesive way, address technology challenges and ensure consistency between campuses. With 37 schools and 375,000 students across Minnesota, this kind of efficiency is essential.
Enterprise resource planning (ERP): In recent years, the team has worked on NextGen, an estimated $150-million, multiyear journey to replace the existing ERP system (a decades-old, home-grown system) that is used for virtually all aspects of student, financial, and human resource management.
Internal audit has partnered with Ramon Padilla, vice chancellor and chief information officer, and other leaders across the system, to identify and address risks associated with NextGen. Internal audit has been involved in virtually every step, including make-up of project teams, data migration plans, succession plans, etc. By consistently interfacing with the project’s steering committee, internal audit is helping Minnesota State avoid risks and common pitfalls associated with large software transformation.
Enrollment forecasting: Our work on enrollment forecasting with the vice chancellor for academic and student affairs is a critical component of resource allocation. It helps to predict how many students will enroll and in which schools and programs. As part of internal audit’s advisory and consultative involvement, the team identified areas of strength, opportunities for improvement based on industry leading practices and potential tools to deploy across colleges and universities.
A Vision for the Future
Minnesota State’s ambition lies in radically transforming higher education in terms of its purpose, delivery and relevance, to serve its ultimate mission: supporting student success. The long-term opportunity goes beyond any single project. We know that our institutions must adapt to the changing realities people face. Stu-dent success, guided pathways, and narrowing the achievement gap are things we think about every day. We are a true system—not just in name but also in function. Minnesota State is, above all else, a service provider to the people of Minnesota. The Office of Internal Audit is proud to be a part of that.
Michael Vekich, CPA, is chair of the Board of Trustees and chair of the Audit Committee for Minnesota State Colleges and Universities.
Eric Wion, CPA, CISA, CISSP, is the executive director of internal auditing for Minnesota State Colleges and Universities.
Key Success Factors
- Leadership views audit as a strategic priority. The highest levels of the Minnesota State system work to ensure that audit has a seat at the table. Internal audit sits in on the chancellor’s cabinet meetings and the monthly Leadership Council.
- Audit is collaborative. Interrelated risks are a reality in higher education (e.g., financial stability is directly linked to student success, which ultimately impacts workforce outcomes). Different stakeholders need opportunities to connect.
- A deep bench is essential. A strategic internal audit function requires a wide range of expertise, including cybersecurity, academic, shared services, and more. Whether it is in-house, cosourced, or a shared services model, work plans should account for specialized expertise.
- Risk should be embraced—not feared. Risk is not something academic institutions are always comfortable with. Even so, it is a cultural expectation that can be established across organizations over time. At Minnesota State, identifying risks and exploring ways to mitigate them have become standard operating procedure.
Tips for Boards on the Internal Audit Function
Developing a Dashboard to Monitoring Institutional Performance Related to the Internal Audit Function
Minnesota State currently has several different ways we monitor performance and risk, including an enterprise risk management process (ERM) process that monitors risk on a continuous basis. The ERM process is in place at the system office level, and we are in the process of developing an ERM toolkit and piloting it at a couple of institutions with a goal of building ERM processes at both the system level and each of our 37 colleges and universities that more easily and clearly aligns and informs one another. Related to dashboards, we have an informal set in place currently, but are in the early stages of moving towards a more formal process focused on our visioning process, Reimagining Minnesota State. However, COVID-19 has taken us to a new level related to risk assessment and performance management. For instance, COVID-19 has changed our risk tolerance some in the short term, so our dashboards may change some as a result. What has not changed, however, is that we will continue to look at risk, reprioritize risk as needed, and focus on moving forward.
How Boards Can Successfully Review Academic Programs
The realities facing most higher education institutions make academic program planning and review a critical process that cannot be put off. Financial sustainability has been a real risk due to continued enrollment and funding declines for some time but the risk has increased significantly as a result of COVID-19. Furthermore, many states like ours are facing serious workforce shortages, even considering the recent unemployment rate, and our institutions are the pipeline to providing students with the needed knowledge and skills. Finally, COVID-19 is forcing everyone to examine programs and modes of instructions. Questions on how students are going to respond and the decisions they will make both in the shorter and long term. For instance, will student’s favor one type of institution (i.e., university or two-year college), or instructional method (i.e., online or in-person)?
We are considering an advisory project in our upcoming fiscal year 2021 internal audit plan that would focus on a review of academic program planning and management at our individual colleges and universities. –Michael Vekich