A recent embezzlement scandal in the University Counseling Center has left many questioning how that department's budgets and expenditures are monitored. For CSU and CSU-Pueblo, the answer is the Internal Auditing Department (IAD).
Richard Tusa , the department's vice chancellor and director, said the objective of IAD is to provide independent analyses of operations and internal control. They give appraisals, recommendations, counsel and information, based on the audits they conduct.
"They're like the internal police or support group. They're consultants before the external auditors check us out," said Margarita Lenk , a business professor who works with the Internal Auditing Department for projects for her students. "They're on our side."
Established in 1967, IAD can audit "anything and everything," including departments, colleges, programs, activities and transactions. Tusa, a former president of the Association of College and University Auditors, has been director since 1985.
"Over 90 percent of embezzlement is not found by internal auditors, but found by whistleblowers," Lenk said. "The embezzlement is not a weakness in the auditors. It just takes someone to call them out."
Tusa said Internal Auditing has no authority over the practices they analyze.
"We have neither the responsibility nor the authority over activities we've reviewed," he said. "We follow professional standards set by the institute of Internal Auditors."
The Internal Auditing staff consists of Tusa, two other full time auditors and either a student intern or student hourly. They currently have two positions open.
"I would equate the office with the campus police. There are thousands of people, and very few officers," Lenk said. "There are 60 to 70 departments, and only five auditors."
Functionally, Tusa said, the department reports directly to the chair of the Board of Governor's Audit Committee, which includes Jeff Shumaker, Diane Evans and Ed Hazelton. Administratively, they report to the chancellor of the CSU system.
"The board of directors has great confidence in them (the internal auditors)." Evans said. "We work closely with them to monitor activities and what they do."
Because they are unable to audit every system each year, when deciding on the yearly audit plan, the department takes into consideration many factors, including a "risk assessment."
"We have limited resources to apply to various areas," Tusa said.
The department looks at the "hot topics" when deciding whom to audit, including important issues, quality of internal control, the stability of the organization and systems, and any new systems recently put in place.
"I contact senior management and ask, 'What keeps you awake at night?'" Tusa said. "I want them to think about areas that are challenging where they might want to propose an audit."
After the year's audit plan is compiled and approved, audit plans are assigned and divided based on the auditor's skill.
According to the Web site, fieldwork is then started. This usually includes an evaluation of the system's internal control and an evaluation of sample transactions traced through the operation's process. Throughout the "fieldwork," policies and manuals are reviewed, and personnel are interviewed and kept informed of the auditor's current findings.
"We're not here to say 'gotcha.' We're not here to embarrass anybody," Tusa said.
Fieldwork is followed by a preliminary exit meeting, the drafting of the audit report and an exit conference. From there, the management of the audiles are given a chance to respond, a final audit report is filed and distributed to Penley, and the audit board, among others. A follow up audit is then implemented six months later, and another report is then filed.
According to the charter for the Internal Auditing Department, several hundred hours of the budget are set aside for "special projects," or items of concern or question brought up during the year. The embezzlement at the counseling center was one of these.
The counseling center's last audit was done in 1992, Tusa said, because they're not a big operation. After the concerns with cash handling were raised, the CSU Police Department investigated and then requested an audit.
The auditing process may seem completely thorough, but Tusa said it's only relevant to the period of time when it was conducted.
"From the day we're done with the review, we give no insurance going forward," he said. "We're not 100 percent. There is no absolute control system."
Despite the lack of full proof system to stop embezzlement, Lenk feels CSU's internal auditors are doing their job.
"I've always been impressed. I've worked intimately with the internal auditing department, and they're of the highest quality," Lenk said.