Question: Put together risk assessment? Risk assessment and control evaution. The sample is attached below:

IU Internal Audit Audit Name Organizational Objective/Process Goal: Key Controls Adequacy of Control Design DO NOT Fill This Column in Process Level Risks Risk that checks are not being endorsed properly upon receipt. Monitoring/Testing Plan Potential Testing ideas: 1 1. Interview cash handling employees concerning the process for endorsing checks. 3. Verify that the department's endorsement stamps location and propriety. Potential Testing ideas: 2. Determine who processes revenue for the department and follow up with appropriate people to ensure that University required training has been received. 2. 3 Risk that the persons processing revenue have not taken the required training program provided by Treasury prior to processing revenue. Risk that unapproved vendor software for processing Credit Cards is being used or the software is being used in an unapproved manner. Risk that checks are improperly stored Potential Testing ideas: 1. Obtain a list from Treasury of approved CC software for the department and compare the list to actual software in use. 4 Potential Testing ideas: 1. Interview employees on storage and destruction of checks. 2. Verify locations of where money is stored and spot check these locations for age of checks. 3. Verify who has access to safes (or locations where cash/checks are stored and determine if the person has a business reason for that access. Potential Testing ideas: 1. Interview employees on deposit procedures. 2. Select a sample of CR deposits and verify that they comply with IU policy. 6 Failure without det 8 Risk that cash/checks are not timely deposited or recorded. to record cash receipts or delaying the recording of cash receipts allows cash receipts to be misappropriated detection. Risk that revenue received is not being reconciled (cash/check/CC). Not reconciling revenue can lead misappropriated or lost funds. Risk that department is not claiming of CC payments in FIS is not occurring timely Potential Testing ideas: 1. Interviews with key employees on reconciliation procedures. 2. Ask to see a selected number of monthly reconciliations for each key revenue area ands review for proper procedures. 3. Review the IUIE detail transactions to determine that Dls are occurring daily for CC transactions (that they dept is not holding them and completing them weekly or monthly); 4. Obtain the merchant agreement and determine what the requirements are and verify the requirement to actual actions being performed Potential Testing Ideas: 1. Review all documentation during testing for sensitive data. 2. Interview with key employees on sensitive data procedures. 9 Risk that Credit Card numbers or other sensitive data is being stored on spreadsheets or other invoices/documents. 10 Risk that proper segregation of duties is Potential Testing Ideas: 1. Discussions with key employees on job Page 2 of 3 not in place for revenue activities. duties. 2. Verify routing logs and/or key job responsibilities of each employee to ensure that segregation exists