Risk Assessment Questionnaire (Page 4 of 6) in pdf

Training

Please indicate the status of training in your department?

_____ 1. Training is provided at least annually to all applicable employees, and there are

discussions with employees to confirm that training is adequate.

_____ 2. Some training is being provided to applicable employees; however, additional

training is needed.

_____ 3. Very little training is being provided, and the adequacy of the training is not

effective.

Date of Last Audit

When was the last time that your department was reviewed by either internal audit or external

auditors (KPMG) as part of the financial audit or A-133 audit?

_____ 1. Reviewed by either internal or external auditor within the last 2 years.

_____ 2. Last review by internal or external auditors was conducted within 3 to 5 years

ago.

_____ 3. Last review by internal or external auditors was completed over 5 years ago.

Controls and Prior Exceptions

If your department had either an internal audit or was part of the external audit, what kind of

findings or exceptions were there?

_____ 1. Only minor exceptions were noted in the department’s activities and they have

been addressed.

_____ 2. Some minor to moderate exceptions have occurred causing some control

concerns.

_____ 3. Significant exceptions have been revealed during past audits/

Degree of Dependence

Describe the number of University organization units supported by the department:

_____ 1. The department/area does not serve other organizational units, or at most one

other organization unit. Department is mostly self-contained.

_____ 2. Department serves limited informational needs of several dependent

organizations within the University.

_____ 3. Department meets full and very complex informational needs of numerous

dependent organizations within the University.

Impact of Inaccurate Data

What would be the relative effect of inaccurate data to the department’s capability to provide

internal or external service?

_____ 1. Incorrect or inaccurate information generated by the department would have

little or no impact on the operations of the University.

_____ 2. Incorrect or inaccurate information generated by the department has a moderate

impact on the operations of the University.

_____ 3. Incorrect or inaccurate information generated by the department activity has a

serious impact on the operations of the University.

Risk Assessment Questionnaire Page 4