How are units selected for audit?
Every two years, the University Audit Office helps determine where Cornell risks failing in its mission due to internal procedural deficiencies. First, the university is broken down into areas of institutional concern, such as Sponsored Research, and auditable activities such as units, departments, cost centers, subsidiaries, information systems or processes. Next, relevant risk factors such as control environment, reputation/legal impact, and operations impact are weighted. Institutional concerns and auditable activities are then scored using these factors and the audit office decides which areas to audit based on these risk rankings and the audit resources available.
