Exhibit 1: Internal audit plan – focus on the organisation’s key risks Risk identified in the risk register Ranking Internal audit reviews over a three-year period 1. Failure of the new finance system High Finance system implementation 2. Reliance on small number of High IT specialised staff 3. Cyber security issues High IT 4. Ineffective project Medium Contract management assessment procedures 5. Non-performance of contracts Medium Contract management/departmental reviews 6. Poor procurement of projects Medium Estates 7. Failure to protect Medium Intellectual property management intellectual property 8. Statutory non-compliance (H&S) Medium Health and safety 9. Non-prevention of Medium Health and safety foreseeable accidents 10. Failure to adequately manage Medium Human resources occupational stress 11. Failure to attract and retain high- quality Medium Human resources staff 12. Non-financial control failure Medium Key financial systems/department reviews 13. Fraud, theft and misuse of assets Medium Key financial systems/department reviews 14. Breach of financial memorandum Medium Key financial systems – treasury management 15. Reputation unclear or fragmented Medium Strategic planning Medium Strategic planning/department reviews 16. Ineffective faculty business planning 17. Failure to consider future Medium Strategic planning strategies 18. Claw back of project funding Low* Contract management/departmental reviews 19. Unsatisfactory procurement procedures Low* Key financial systems – purchasing * Although categorised as a ‘low’ risk, this will be covered within a review of higher risks.
Exhibit 1: Internal audit plan – focus on the organisation’s key risks Risk identified in the risk register Ranking Internal audit reviews over a three-year period 1. Failure of the new finance system High Finance system implementation 2. Reliance on small number of specialised staff High IT 3. Cyber security issues High IT 4. Ineffective project assessment procedures Medium Contract management 5. Non-performance of contracts Medium Contract management/departmental reviews 6. Poor procurement of projects Medium Estates 7. Failure to protect intellectual property Medium Intellectual property management 8. Statutory non-compliance (H&S) Medium Health and safety 9. Non-prevention of foreseeable accidents Medium Health and safety 10. Failure to adequately manage occupational stress Medium Human resources 11. Failure to attract and retain high- quality staff Medium Human resources 12. Non-financial control failure Medium Key financial systems/department reviews 13. Fraud, theft and misuse of assets Medium Key financial systems/department reviews 14. Breach of financial memorandum Medium Key financial systems – treasury management 15. Reputation unclear or fragmented Medium Strategic planning 16. Ineffective faculty business planning Medium Strategic planning/department reviews 17. Failure to consider future strategies Medium Strategic planning 18. Claw back of project funding Low* Contract management/departmental reviews 19. Unsatisfactory procurement procedures Low* Key financial systems – purchasing * Although categorised as a ‘low’ risk, this will be covered within a review of higher risks.
13-specimen-internal-audit-plan.docx