Universities and nonprofits exist to pursue a mission with other people’s money under conditions those people attached: a federal agency’s research grant with its allowable cost rules, a student’s tuition paid with federal aid under Title IV, a donor’s gift restricted to a scholarship, a foundation’s program grant with reporting requirements, a state’s appropriation with accountability strings. Internal audit in both sectors is the assurance that the conditions were kept, and the function’s work is shaped by that: compliance programs that corporate auditors never meet (financial aid, research, campus safety, charitable solicitation), governance by volunteer trustees, decentralized organizations in which deans and program directors run budgets like small businesses, and a public and regulatory audience that treats a failure of stewardship as a betrayal rather than an error.
This guide explains how the function works at colleges, universities and nonprofit organizations: why mission-driven audit is different, the regulatory frame for higher education and for nonprofits, the shared operational risks, auxiliaries and athletics, the shape of a university’s audit universe, governance and the audit committee, careers and pay, the failures that recur, and a worked example from Westmere University, the private research university used in the education examples on this site. The internal audit in government guide covers the public-sector environment that public universities share, and the Yellow Book vs IIA Standards guide the standards many public institutions’ auditors follow.
In this guide
- Why mission-driven internal audit is different
- The regulatory frame for higher education
- Research compliance and the Uniform Guidance
- Financial aid, Clery, Title IX and student data
- The regulatory frame for nonprofits
- Shared operational risks
- Auxiliaries, athletics and the enterprises inside the institution
- The shape of a university’s audit universe
- Trustees, the audit committee and the function’s position
- What goes to the audit committee
- Careers and pay in higher education and nonprofit internal audit
- Failures that recur
- A worked example: Westmere University’s FY26 audit year
- Questions about internal audit in higher education and nonprofits
- Related guides
Why mission-driven internal audit is different
Five features shape the function. Restricted money: a large share of revenue arrives with conditions (federal and state grants, restricted gifts and endowments, student aid), so that spending is a compliance act and the accounting distinguishes net assets with and without donor restrictions (ASC 958 for private institutions and nonprofits; GASB for public universities). Decentralization and academic culture: deans, department chairs, principal investigators and program directors control budgets and staff with considerable autonomy, faculty governance shares authority with administration, and controls that work in a corporation (a purchasing department, a travel policy) are negotiated with people who regard them as bureaucracy. Volunteer governance: trustees and directors serve without pay, meet a few times a year, often lack financial expertise, and may be the institution’s largest donors, which shapes the audit committee relationship. Reputation as the asset: enrollment, donations, grants and accreditation all depend on standing that a scandal (admissions, athletics, research misconduct, a data breach, a misused gift) damages directly. Thin administration: institutions spend on mission and under-invest in administrative systems and staff, so segregation of duties is weak at the department level and the systems are old. The function that fits knows the compliance regimes, works with the compliance, research administration and advancement offices as second-line partners, uses analytics across decentralized transactions, and writes for trustees who read as citizens rather than as executives.
The regulatory frame for higher education
| Regime | What it requires | Consequence of failure | Internal audit’s angle |
|---|---|---|---|
| Uniform Guidance (2 CFR 200) and agency terms (NIH, NSF, DOE, DOD and others) | Allowable, allocable, reasonable costs; effort reporting or equivalent; cost transfers; subrecipient monitoring; procurement standards; equipment ($10,000 threshold since 2024); indirect cost rate agreements; reporting and closeout; the Single Audit for institutions expending $1 million or more in federal awards | Disallowances and repayment; False Claims Act exposure for knowing overcharges; loss of expanded authorities | Research compliance program; sampled charges; effort certifications; cost transfers; subrecipients |
| Research integrity and security: PHS financial conflict of interest rules; research misconduct policies; export controls (EAR, ITAR, deemed exports); research security programs under the CHIPS and Science Act and NSPM-33 (disclosure of foreign support, training, cybersecurity, travel) | Disclosure and management of investigator conflicts and foreign affiliations; misconduct inquiry and investigation processes; export control compliance for controlled research and foreign nationals | Grant termination; debarment; criminal exposure in export and undisclosed-support cases | Conflict disclosure completeness; research security program implementation; export control determinations |
| Section 117 of the Higher Education Act (foreign gifts and contracts) | Reporting of foreign gifts and contracts of $250,000 or more per source per year to the Department of Education; expanded scrutiny and proposals to lower thresholds in recent years | Enforcement actions and reputational damage; several institutions have faced investigations | Completeness of foreign source identification across advancement, research and procurement |
| Title IV of the Higher Education Act (federal student aid) | Institutional eligibility and program participation agreements; verification; disbursement rules; return of Title IV funds on withdrawal; satisfactory academic progress; cohort default rates; consumer information; the Department’s financial responsibility composite score; program integrity rules | Fines; liabilities; loss of Title IV eligibility, which closes most institutions | Financial aid compliance audit; return of funds calculations; eligibility documentation |
| Clery Act | Campus crime statistics and the annual security report (by 1 October); timely warnings and emergency notifications; campus security authorities; fire safety reporting for residential institutions | Fines per violation (inflation-adjusted, now exceeding $69,000 each); program reviews | Crime log and statistics accuracy; CSA training and reporting; geography determinations |
| Title IX | Non-discrimination on the basis of sex, with grievance procedures for sexual harassment; the 2024 regulations were vacated in January 2025 and the 2020 regulations apply | Office for Civil Rights investigations; litigation; funding conditions | Policy currency against the applicable regulations; case handling timeliness; training |
| FERPA; GLBA Safeguards Rule; HIPAA (student health and academic medical centers); state privacy laws | Student record privacy; an information security program meeting the FTC’s Safeguards Rule (higher education institutions are financial institutions for this purpose; amended rule effective June 2023, with breach notification from 2024); health information protections | Department of Education and FTC enforcement; breach costs | Information security program against the Safeguards Rule’s elements; access to student records; HIPAA where applicable |
| Accreditation (regional and programmatic accreditors) and state authorization | Standards covering governance, finances, integrity, assessment, resources; periodic self-studies and visits; state authorization for distance education | Sanctions; loss of accreditation ends Title IV eligibility | Evidence behind the self-study; financial indicators |
| Tax: Form 990 and Schedules; unrelated business income; intermediate sanctions on excess compensation; the endowment excise tax (from tax years beginning after 31 December 2025, tiered at 1.4, 4 and 8 percent of net investment income by endowment per student for institutions with at least 3,000 tuition-paying students, under the 2025 federal tax legislation) | Accurate reporting; reasonable compensation; UBIT on commercial activities; endowment tax computation and the student count behind it | Penalties; excise taxes; reputational damage from 990 disclosures | 990 accuracy; compensation process; UBIT identification; endowment tax inputs |
| NCAA and conference rules (Division I) | Eligibility, recruiting, benefits and, since the House settlement approved in June 2025, direct revenue sharing with athletes under an annual cap (about $20.5 million per school in the first year) with third-party NIL deals reviewed through the College Sports Commission | Sanctions; vacated results; litigation | Athletics compliance program; revenue sharing administration; NIL deal review; camps and ticketing controls |
| Employment and immigration | Wage and hour (including student employees and postdocs), visa sponsorship for international students and scholars (SEVIS, H-1B), minors on campus | Enforcement; loss of sponsorship ability | Payroll compliance; visa program controls; youth protection |
Research compliance and the Uniform Guidance
Sponsored research is the largest compliance exposure at a research university because the rules are detailed, the spending is decentralized to principal investigators, and the enforcement includes the False Claims Act. The Uniform Guidance’s cost principles require that charges to federal awards be allowable (not in the prohibited list), allocable (benefiting the award in proportion to the charge), reasonable, consistently treated and documented; personnel costs, the largest category, must be supported by records that reasonably reflect the work performed (the effort reporting or payroll certification systems); cost transfers moving charges between awards must be timely, explained and approved, because late transfers onto awards about to expire are the classic abuse; equipment must be tracked and inventoried; subrecipients must be assessed, monitored and audited; procurement must follow the standards; and indirect costs are recovered at a negotiated rate (with the 15 percent de minimis available to those without one) whose base and composition are themselves audited. Research security has become the second front: the PHS financial conflict of interest rules and institutional policies require investigators to disclose outside financial interests and foreign affiliations and the institution to manage them, the NSPM-33 and CHIPS Act research security requirements oblige institutions receiving significant federal research funding to run programs covering foreign travel, cybersecurity, training and disclosure, export controls govern controlled technology and the participation of foreign nationals, and Section 117 requires reporting of foreign gifts and contracts above $250,000. Internal audit’s research program tests the research administration office’s controls (proposal and award setup, budget monitoring, effort certification, cost transfer approval, subrecipient monitoring, closeout), samples charges across awards and departments against the cost principles, tests effort certifications against appointment records and other commitments, analyzes cost transfers by timing and destination, tests equipment inventories, and audits the conflict of interest and research security programs’ completeness against the investigator population. The government guide covers the same rules from the grantor’s side and the healthcare guide the clinical research and academic medical center overlap.
| Research compliance area | Test | Finding that recurs |
|---|---|---|
| Direct cost allowability and allocability | Sample of charges across awards and departments against the cost principles and award terms; attention to administrative salaries, supplies and travel charged direct | Administrative and clerical salaries charged directly without the required justification; general-purpose equipment charged to awards |
| Effort and payroll certification | Certifications against appointment letters, other commitments (teaching, clinical, other awards) and the 100 percent rule; timeliness | Faculty committed above 100 percent across awards; certifications signed months late by administrators |
| Cost transfers | Analytics on transfers by days after the original charge, by destination award and by proximity to award end; sample of justifications | Transfers onto awards in their final 90 days with “to correct error” as the justification |
| Subrecipient monitoring | Risk assessments, agreements with required terms, invoice review, audit report follow-up for a sample of subrecipients | Foreign subrecipients unmonitored; audit findings unaddressed |
| Equipment | Physical verification of federally funded equipment against the inventory; disposition records | Equipment untraceable after a faculty departure |
| Indirect cost rate | Base computation; space survey accuracy; excluded costs | Space classified as research when used for instruction |
| Conflicts of interest and foreign affiliations | Disclosure completeness against the investigator population and public sources; management plans; Section 117 reporting completeness against advancement and procurement records | Undisclosed foreign appointments and funding; foreign gifts recorded in advancement and never reported |
| Export controls | Determinations for controlled research and technology; foreign national access; shipments | Controlled equipment shipped abroad without licenses; no technology control plans |
| Closeout | Final financial reports reconciled to the ledger; unspent balances returned | Reports filed late; residual balances retained |
Financial aid, Clery, Title IX and student data
Title IV financial aid is the regime whose loss closes an institution, and its rules are mechanical and testable: student eligibility (enrollment status, satisfactory academic progress, verification of application data), award calculation within cost of attendance and need, disbursement timing and the rules on credit balances, the return of Title IV funds calculation when a student withdraws (the single most error-prone process, with its 45-day return deadline), the handling of unofficial withdrawals, reporting to the Department’s systems, consumer information disclosures, and the institution’s own financial responsibility score. The audit samples awards and withdrawals, recomputes returns, tests disbursement timing and reconciliations between the financial aid system, the student accounts system and the Department’s funds, and reviews the compliance monitoring the financial aid office performs. The Clery Act requires campus crime statistics compiled from campus security authorities (a broad class including residence life staff and coaches), the annual security report published by 1 October, a daily crime log, timely warnings and emergency notification procedures, and fire safety reporting for residential campuses; the audit tests the completeness of the statistics against police, student conduct and Title IX records, the identification and training of campus security authorities, and the geography determinations. Title IX grievance procedures must match the regulations in force (the 2020 rules, after the 2024 rules were vacated in January 2025), and the audit tests policy currency, case handling against the required steps and timelines, and training. Student data under FERPA (directory information, consent, access by officials with legitimate educational interest), the GLBA Safeguards Rule (an information security program with a qualified individual, risk assessment, access controls, encryption, multifactor authentication, monitoring, training, service provider oversight, incident response and board reporting) and HIPAA where student health or a medical center is involved, gives the data privacy and cybersecurity guides their higher education application, and the ransomware attacks on universities in recent years make the recovery capability in the cyber resilience guide a standing concern.
The regulatory frame for nonprofits
Charitable nonprofits outside higher education (human services, arts, health-related, environmental, international development, foundations) share the restricted-money and volunteer-governance features and carry a frame of their own. Tax exemption under section 501(c)(3) requires operation for exempt purposes, no private inurement and no substantial lobbying, with the annual Form 990 (a public document that donors, journalists and watchdog sites read) disclosing finances, governance practices, compensation of officers and key employees, related-party transactions and program accomplishments; the intermediate sanctions rules impose excise taxes on excess benefit transactions with insiders, which makes the compensation-setting process (independent approval, comparability data, contemporaneous documentation) a standing audit subject; and unrelated business income is taxed. State charitable solicitation laws require registration in most states before soliciting their residents (online fundraising triggers them), annual filings and, for some, audited financial statements above revenue thresholds; professional fundraiser and commercial co-venture arrangements have their own rules. Donor restrictions are legal obligations: gifts restricted by purpose or time are tracked as net assets with donor restrictions under ASC 958, released as the restriction is met, and endowment spending follows the Uniform Prudent Management of Institutional Funds Act and the gift instrument; misuse of restricted gifts is the nonprofit scandal that ends careers. Government grants bring the Uniform Guidance and the Single Audit to any nonprofit expending $1 million or more of federal awards, and state and local contracts bring their own terms. Fundraising itself (gift acceptance policies, gift valuation for non-cash gifts, donor acknowledgments with the required tax language, pledge recording and collectibility, planned giving, special events accounting, joint cost allocation between program and fundraising) is the process most particular to the sector. Smaller nonprofits add the risk of thin staffing: a bookkeeper who does everything, a board that reviews nothing, and the embezzlement cases that fill the sector’s news. The fraud risk assessment guide applies with the sector’s schemes (fictitious vendors, payroll to ghost employees, diverted donations, personal expenses) named.
Shared operational risks
Beneath the compliance regimes, universities and nonprofits run the processes every organization runs, with sector twists. Procurement is decentralized to departments with purchasing cards as the common instrument (the purchasing cards guide’s findings, personal and split purchases, apply with force), with public institutions under state procurement law and private ones under policy, and with the Uniform Guidance’s standards for grant-funded buys. Payroll covers faculty with academic-year appointments and summer salary from grants, adjuncts and graduate assistants, student employees under work-study rules, postdocs, and union agreements, with the payroll audit guide’s tests and the effort reporting overlay. Construction and facilities are a permanent capital program (residence halls, laboratories, athletic facilities, deferred maintenance) that the capital projects guide covers, funded by gifts, debt and appropriations with their own restrictions. Cybersecurity and privacy combine the GLBA Safeguards Rule, FERPA, HIPAA, research data protections and a user population (students, faculty, visitors) that corporate security models do not fit. Conflicts of interest run from trustees (whose businesses may transact with the institution) through administrators to investigators. Cash handling occurs at bursar windows, box offices, dining halls, parking, camps and events. Information systems are old (student information systems, grants systems, advancement databases) and often being replaced in multi-year programs whose assurance the function should provide at stage gates. The procure-to-pay, cash management and IAM guides give the general programs.
Auxiliaries, athletics and the enterprises inside the institution
A university contains businesses: housing and dining (often outsourced under contracts with commissions and capital commitments), bookstores, parking, conference services, a health center, a performing arts center, summer camps and youth programs (with the protection-of-minors policies and background checks they require), real estate and endowment investments (with the treasury guide’s controls and the investment committee’s governance), technology transfer and startups (conflicts and revenue sharing), and intercollegiate athletics. Athletics is the auxiliary with the most risk per dollar: NCAA and conference compliance, the post-House-settlement revenue sharing to athletes under the cap (budgeting, contracts, payment administration and reporting, with the College Sports Commission reviewing third-party NIL deals above a threshold), name, image and likeness collectives and their relationship to the institution, ticketing and donor seating programs, camps and clinics run by coaches, travel and recruiting expenses, booster involvement, Title IX equity in participation and resources, athlete medical care and concussion protocols, and the financial deficits most programs run that the institution subsidizes. Internal audit’s athletics work tests the compliance program’s monitoring, the revenue sharing administration against the cap and contracts, ticketing and camp cash controls, recruiting and travel expenses, booster and collective governance, and the equity reporting, and it coordinates with the external NCAA agreed-upon procedures engagement that Division I institutions undergo. The order-to-cash guide covers the ticketing and auxiliary revenue processes and the third-party risk management guide the outsourced dining, housing and bookstore contracts.
The shape of a university’s audit universe
| Domain | Representative entities (Westmere University, 86 in total) | Typical rating and cycle |
|---|---|---|
| Research and sponsored programs (12) | Pre-award and award setup; direct cost allowability (sampled by school); effort certification; cost transfers; subrecipient monitoring; equipment; indirect cost rate and space survey; closeout; financial conflicts of interest; research security program (NSPM-33, CHIPS); export controls; Section 117 foreign gift and contract reporting; research misconduct process | Cost transfers, effort, conflicts, research security and Section 117 High (annual) |
| Students and enrollment (10) | Title IV eligibility and awarding; disbursement and return of Title IV funds; verification; satisfactory academic progress; student accounts and collections; tuition discounting and institutional aid; admissions integrity; registrar and FERPA; international student visa program (SEVIS); enrollment reporting | Return of funds, disbursement and admissions integrity High |
| Campus safety and conduct (6) | Clery Act compliance; Title IX process; campus police and evidence; protection of minors (camps and programs); student conduct records; emergency management | Clery, Title IX and minors High |
| Advancement and endowment (8) | Gift acceptance and recording; donor restrictions and releases; pledge collectibility; endowment spending (UPMIFA) and unitization; investment governance and alternative investment valuation; planned giving; foundation relationships; donor data privacy; fundraising events | Restrictions, endowment spending and gift recording High |
| Athletics (6) | NCAA and conference compliance program; revenue sharing administration and cap; NIL and collectives; ticketing and donor seating; camps and clinics; recruiting and team travel | Revenue sharing, ticketing and camps High |
| Auxiliaries and operations (10) | Housing and dining contracts; bookstore; parking; health center (HIPAA); conference services; facilities and deferred maintenance; capital projects (three active); real estate; sustainability; transportation | Capital projects and health center High |
| Technology and data (10) | GLBA Safeguards information security program; identity and access (students, faculty, affiliates); student information system replacement program; research data protection; data privacy program; backup and recovery; cybersecurity incident response; cloud and SaaS sprawl across departments; AI use in teaching and administration; records management | Safeguards program, access, the SIS program and recovery High |
| Finance, people and governance (24) | Financial close and audit; budget and decentralized unit finances; procurement and purchasing cards; payroll (faculty, staff, students, adjuncts); benefits and retirement plans; treasury and debt covenants; tax (990, UBIT, endowment tax inputs, international); accreditation evidence; board and committee governance; conflicts of interest (trustees and administrators); executive compensation process; ERM; third-party risk; insurance and claims; legal; human resources and Title VII; ethics hotline; the internal audit function; and others | Purchasing cards, payroll, compensation process and conflicts High |
Trustees, the audit committee and the function’s position
Boards of trustees and nonprofit directors are volunteers, often chosen for philanthropy, standing or representation rather than for financial oversight skills, meeting quarterly or less, and the audit committee is where the function’s independence lives. The arrangement that works: a committee with at least one member who has audit or finance experience (public institutions sometimes add public members), a charter that gives it the Global Internal Audit Standards’ functional responsibilities (approve the charter and plan, appoint and evaluate the chief audit executive, receive results, meet privately), a chief audit executive who reports functionally to it and administratively to the president or a senior vice president rather than to the chief financial officer whose functions the office audits, and a plan that covers the compliance regimes the institution’s reputation depends on as well as the finances. Public universities add state law: the state auditor or legislative audit office may have jurisdiction, the Yellow Book may be required, and the internal audit function may be shared across a system of campuses with a system-level chief audit executive. The audit committee charter and internal audit charter guides give the documents, the independence and objectivity guide the reasoning, and the Yellow Book guide the public institution’s standards.
What goes to the audit committee
Beyond the standard reporting, a university’s or nonprofit’s audit committee receives the compliance picture across the regimes that could end the institution (Title IV, research, Clery, Title IX, tax exemption) with the status of any agency reviews, the research compliance results with repayment exposure, the Single Audit findings and their corrective actions, the restricted gift and endowment stewardship results, the athletics compliance and revenue sharing status, the information security program’s status under the Safeguards Rule (which requires reporting to the board), the capital program’s assurance, the conflicts of interest and compensation processes, and the hotline. Trustees respond to risk framed in mission and reputation terms, and the function’s reporting should translate: a cost transfer finding is a research sponsor’s trust; a Clery finding is student safety and a fine. The audit committee annual agenda and board risk reporting guides give the calendar and the risk pack, and the presenting to the audit committee guide the meeting.
Careers and pay in higher education and nonprofit internal audit
University functions hire accountants and IT auditors and add research administrators who know the Uniform Guidance, financial aid professionals, compliance specialists and data analysts; the CIA, CPA, CISA and CFE are the credentials, the Association of College and University Auditors is the sector’s professional body, and the Certified Research Administrator and financial aid credentials signal domain depth. Pay sits below the corporate market (the salary guide‘s ranges apply with a 10 to 20 percent discount at most institutions, less at large research universities), with benefits (tuition remission, retirement contributions, time off) and the campus environment as the offset; nonprofit functions outside higher education exist mostly at large organizations and pay similarly. Career paths run into research administration, compliance, finance and the controller’s office, student affairs operations, and the chief compliance and privacy roles universities have created, and the function’s exposure to every corner of the institution makes it a recognized route into administrative leadership. The is internal audit a good career guide’s argument applies, with the sector’s purpose as the pitch.
Failures that recur
| Failure | How it shows | What the function should do |
|---|---|---|
| Research audited only by the Single Audit | Repeat findings; a False Claims Act settlement over effort reporting | Annual research compliance program with cost transfer and effort analytics |
| Foreign support unreported | Section 117 investigation; investigator with undisclosed foreign appointments | Cross-system completeness testing of foreign sources and disclosures |
| Return of Title IV funds wrong | Program review liabilities; late returns | Recompute a sample every year |
| Clery statistics incomplete | Fines after a program review finds unreported incidents | Reconcile statistics to all source records; train campus security authorities |
| Restricted gifts spent on operations | Donor litigation; attorney general inquiry | Release testing against gift instruments |
| Athletics as a separate country | Camps, tickets and travel uncontrolled; revenue sharing administered by coaches’ staff | Athletics in the universe as High; coordinate with compliance and the NCAA procedures |
| Decentralized cards and cash | Departmental embezzlement found years later | Purchasing card and cash handling analytics and rotations |
| Safeguards Rule unmet | No qualified individual; no board report; a ransomware event | Information security program audit against the rule’s elements |
| Trustee conflicts undisclosed | A trustee’s company wins contracts | Annual disclosure reconciliation to vendor payments |
| Compensation without process | 990 disclosure draws scrutiny; intermediate sanctions exposure | Audit the rebuttable presumption procedure |
A worked example: Westmere University’s FY26 audit year
Westmere University is the private research university used in the education examples on this site: about 14,000 students (9,000 undergraduate, 5,000 graduate and professional), a $1.1 billion operating budget, a $3.4 billion endowment (about $243,000 per student, below the endowment excise tax’s first tier), $180 million of annual sponsored research led by federal awards, Division I athletics participating in revenue sharing, no medical center, 4,800 employees and an eight-person internal audit office whose chief audit executive reports to the board’s audit committee and administratively to the president. The FY26 plan covered 19 of the 86 universe entities in about 11,800 hours, with 700 hours co-sourced (a Safeguards Rule assessment and research security expertise), and it coordinated with the research compliance office’s monitoring and the athletics compliance office’s program, relying on each after testing samples of their work.
| Engagement (hours) | What it found | Outcome |
|---|---|---|
| Cost transfers and effort certification (900) | Analytics on 4,100 cost transfers: 612 moved charges onto awards within 90 days of their end dates, 180 of them more than 120 days after the original charge; a sample of 60 late transfers found 22 with justifications that did not explain the error; effort certifications for three faculty showed commitments totaling 115 to 130 percent across awards and teaching | High; the 22 transfers reviewed with research compliance and $310,000 of charges removed from awards voluntarily; cost transfer policy tightened with a 90-day limit and a dean’s approval beyond it; effort commitment monitoring built into the pre-award system |
| Research security and Section 117 (520, 200 co-sourced) | The research security program required by federal funding conditions was documented and training completion was 88 percent; reconciliation of advancement’s gift records, research agreements and procurement found four foreign-source arrangements totaling $1.9 million that met the Section 117 reporting threshold and had not been reported; two investigators had foreign appointments visible in public sources and absent from their disclosures | High; late reports filed with the Department of Education with counsel; the two investigators’ disclosures corrected and managed; a cross-office foreign source review made semiannual |
| Return of Title IV funds (380) | Recomputation of 50 withdrawal calculations: 46 correct; 4 understated returns by a total of $11,000 because the last date of attendance used was the official withdrawal date rather than the documented last academic activity; one return made after the 45-day deadline | Medium; corrected and returned; procedure fixed; the finding disclosed in the financial aid office’s own compliance report |
| Clery Act compliance (340) | Annual security report published on time; reconciliation of the crime statistics to campus police, student conduct and Title IX records identified 11 incidents (dating violence and stalking reported to Title IX) omitted from the statistics; 38 percent of campus security authorities had not completed training | High; statistics corrected and the report republished; CSA training enforced through supervisors |
| Athletics revenue sharing and camps (460) | First-year revenue sharing administered under the cap with contracts and payments reconciled; third-party NIL deals above the review threshold submitted as required; summer camps run by two coaching staffs collected $640,000 with registration and payment through a personal payment application, deposits lagging by weeks and no reconciliation to registrations | High for camps; a university payment platform mandated; prior-year camp revenues reconciled; one assistant coach’s handling referred to human resources (no theft substantiated; practice corrected) |
| Donor restrictions and endowment releases (420) | Sample of 80 restricted funds: releases matched the gift instruments in 76; 4 scholarship funds had been released to general financial aid without matching recipients to the donors’ criteria (a specific school, a geographic preference); endowment spending at the policy rate; unitization accurate | Medium; the four funds’ releases reversed and re-awarded; the advancement and financial aid systems linked for criteria matching |
| GLBA Safeguards Rule information security program (600, 500 co-sourced) | Qualified individual designated; written risk assessment current; multifactor authentication complete for employees and 94 percent for students; encryption of laptops confirmed for central IT devices but not for 1,100 departmentally purchased devices; service provider oversight documented for 31 of 74 providers with student financial data; the annual board report delivered | Medium; departmental devices enrolled in management; provider oversight extended |
| Purchasing cards across schools (520) | 2,300 cards, $31 million; analytics flagged 318 split transactions, 44 cards with personal-category purchases and three department administrators approving their own transactions; one humanities department’s administrator had charged $27,000 of personal expenses over two years | High; the administrator terminated and referred to law enforcement; approval hierarchy fixed; analytics made quarterly |
| Executive compensation process (200) | Compensation for the president and six officers set by the compensation committee with an independent consultant’s comparability data and contemporaneous minutes, satisfying the rebuttable presumption; two deans’ supplemental payments approved by the provost alone | Low; deans’ supplements brought into the committee’s process |
| Student information system replacement (program assurance, 400 across two gates) | Data migration reconciliation at the first gate: 2.4 percent of student records with mismatched enrollment status; the program’s testing had used a sample of 50 | Medium at gate one; full-population reconciliation before cutover |
| Trustee and officer conflicts of interest (240) | Annual disclosures complete for all 38 trustees; reconciliation to vendor payments found one trustee’s firm paid $84,000 for consulting without the disclosed interest having been recused at the approval | Medium; recusal process tightened; the arrangement reviewed by the governance committee |
The chief audit executive’s annual report framed the year for the trustees in stewardship terms: four findings (cost transfers, Section 117, Clery, restricted gifts) concerned promises made to sponsors, the government and donors, and each had been corrected before an outside party found it. The committee’s response was to fund a research compliance analyst in the office and to ask that the cross-office foreign source review and the Clery reconciliation become standing annual engagements. The government guide covers the grantor’s side of the research rules, the purchasing cards guide the method the card analytics used, and the data privacy and cybersecurity guides the Safeguards Rule assessment’s foundation.
Questions about internal audit in higher education and nonprofits
What does internal audit do at a university?
It audits research compliance (cost transfers, effort, subrecipients, conflicts, research security, foreign gift reporting), financial aid and Title IV, Clery Act and Title IX processes, donor restrictions and endowment spending, athletics compliance and revenue sharing, auxiliaries, information security under the Safeguards Rule, decentralized procurement and payroll, capital projects and governance, reporting to the trustees’ audit committee.
What is the biggest compliance risk at a research university?
Sponsored research under the Uniform Guidance and agency terms: unallowable charges, late cost transfers onto expiring awards, effort commitments above 100 percent, unmonitored subrecipients, and undisclosed foreign support and gifts (research security and Section 117), with False Claims Act exposure and grant termination as the consequences.
What is the Clery Act and how is it audited?
A federal law requiring colleges to compile campus crime statistics from campus security authorities, publish an annual security report by 1 October, keep a daily crime log, issue timely warnings and report fire safety for residential campuses, with fines per violation. The audit reconciles the statistics to police, conduct and Title IX records and tests the identification and training of campus security authorities.
How does the endowment excise tax work after 2025?
Under the 2025 federal tax legislation, for tax years beginning after 31 December 2025, private institutions with at least 3,000 tuition-paying students pay an excise tax on net investment income tiered by endowment per student: 1.4 percent from $500,000 to $750,000, 4 percent from $750,000 to $2 million and 8 percent above $2 million. The student count and the investment income computation are audit subjects.
What should a nonprofit’s internal audit cover?
Donor restrictions and their release, gift recording and acknowledgment, charitable solicitation registration, Form 990 accuracy and the executive compensation process, government grant compliance under the Uniform Guidance, unrelated business income, conflicts of interest, cash and payroll controls in thinly staffed finance functions, and program outcome reporting.
How is athletics audited after the House settlement?
Division I institutions now share revenue with athletes under an annual cap (about $20.5 million in the first year), so the audit tests the budgeting, contracts, payments and reporting of revenue sharing against the cap and the rules, the review of third-party NIL deals, the governance of collectives, and the traditional risks: ticketing, camps, recruiting and travel expenses, and Title IX equity.
Related guides
- Internal audit in government — the public-sector environment and the grantor’s side of the research rules.
- Yellow Book vs IIA Standards — the standards public institutions’ auditors follow.
- Internal audit in healthcare — academic medical centers and clinical research.
- How to audit capital projects and construction — the campus capital program.
- How to audit purchasing cards — decentralized spending.
- How to audit payroll — faculty, staff, students and adjuncts.
- How to audit procure-to-pay — the purchasing process.
- How to audit cash management — bursar windows, box offices and camps.
- How to audit treasury — endowment and investment controls.
- Data privacy audit — FERPA, GLBA and research data.
- Auditing cybersecurity programs — the Safeguards Rule’s foundation.
- Auditing cyber resilience — ransomware recovery.
- Third-party risk management program — outsourced dining, housing and systems.
- Fraud risk assessment — the sector’s schemes named.
- The audit committee charter — the trustees’ committee.
- The internal audit charter — the function’s mandate.
- Independence and objectivity — the reporting line to the trustees.
Leave a Reply