University of Rochester

Office of University Audit

Internal Controls

Frequently Asked Questions

Please select from the list below:

What is the mission of University Audit? Sponsored Programs dissallowed costs
External and internal auditors? What is Unrelated Business Income?
When should I call University Audit? What are "in-kind" items?
Confidentiality of services What are good cash receipts controls?
What are internal controls? Inventorying fixed assets
What else do you do at University Audit? Petty Cash purchases
How do you decide what to audit? Send us your question!
   

What is the mission of University Audit?

To provide audit and advisory services to the University community by assessing risks, analyzing controls, and ensuring that business practices are effective, efficient, and compliant with University and regulatory policies.

back to top

What is the difference between external auditors and internal auditors?

External auditors work for public accounting firms and are primarily focused on financial reporting. Internal auditors are a management resource used to help identify risks and recommend ways to transfer, eliminate, or mitigate those risks. There are five types of risk an entity faces: strategic, operational, financial, compliance, and reputational. Some risks may be unavoidable. We recommend ways to manage an acceptable amount of risk. We do this by identifying and recommending best practices and internal control process improvements through our portfolio of services.

back to top

When should I call University Audit for assistance?

Contact us if you have questions or need of clarification regarding the information on our Web site or you would like to explore one of our advisory services that appeals to you (for example, an operational review to validate your processes and procedures).

back to top

How confidential will your services or information be if I request your assistance?

According to professional standards, internal auditors are expected not to disclose confidential information received, unless required to by legal or professional obligation. Therefore, confidentiality cannot be guaranteed but rather is determined based on the specific facts and circumstances.

back to top

What are internal controls?

Internal controls are operating practices used to help ensure the achievement of an objective. Internal controls help assure that departments operate according to plan; they are tools used every day by managers, from the unit levels to the President of the University. The internal control structure of the University includes such things as written policies and procedures, organizational design, and physical barriers. Simply put, internal controls are good business practices.

back to top

What else do you do at audit?

We perform: operational reviews of departments or units; reviews of departments for incoming Chairs or at managements request; faculty practice reviews; financial reviews; reviews of Information Systems areas controls; contract compliance reviews; fraud investigations and more.

back to top

How do you decide what areas will be audited?

The Director of University Audit prepares an annual plan which is reviewed and approved by the Audit Committee of the Board of Trustees. The plan is primarily developed based on the assessment of various risk factors such as: significant financial investment or impact, required regulatory or legal compliance, complex transactions or environment, new technology or processes and prior audit experience. Management requests, external audit support and standard annual audits are also included. Additionally, there are always projects we undertake that were unanticipated when the annual plan was developed.

back to top

What types of costs are disallowed for programs sponsored with federal grants?

Alcoholic beverages, bad debts, fines and penalties, lobbying, entertainment are examples of disallowed expenses. 

back to top

What is unrelated business income?

Unrelated business income (UBI) is income derived from business activities unrelated to an organization's tax-exempt purpose. To not be considered UBI the activity should not be regularly carried on or meet the criteria for certain exemptions as detailed in the Internal Revenue Code. For example, passive income (dividends, interest income, gain from sale of property) is exempt. UBI in excess of $1,000 is taxable. 

back to top

What are "in kind" items and how should they be recorded?

In kind items are often delineated in grants and need to be monitored and valued since there can be a direct impact on the allowability of the amount of funds received pursuant to the particular grant. In kind items can take many forms, including, but not limited to, equipment, professional services, printing, and advertising and promotional services. These items should be recorded at fair value at the date of donation. For non-capital items, there should be a simultaneous recording of income and expense.

back to top

What are good cash receipts controls?

See our detailed cash receipts controls page here.

back to top

How often should my department update its asset inventory with the University's Finance office?

Departments should update their asset inventory with the University's Finance department annually or whenever they purchase or dispose of capital equipment with a unit cost greater than or equal to $1,000.

back to top

What type of expenditures are considered appropriate for purchase with petty cash funds?

A departmental petty cash fund is defined as money advanced to an office, department or University unit for use in defraying miscellaneous, small, approved University expenditures. The establishment of petty cash funds is suggested only where it will result in saving time or paperwork. See the University Finance petty cash policy.

back to top