External Audit Activity Policy

The University at Buffalo (UB, university) may need to contract with an external audit firm and/or may be the subject of an external audit. The Director of Internal Audit is the designated point of contact and must be fully apprised of any situations involving non-UB auditors.

When a UB department contracts with an external audit firm, the Director of Internal Audit must be included in the Request for Proposal (RFP) and selection process. This will ensure that audit firms contracted by the university are appropriately vetted, the scope of the work is clearly defined, and unnecessary overlap and redundancies are prevented.

When a state or federal agency initiates an audit, university employees are expected to fully cooperate with and assist external auditors, agents, and investigators. The Director of Internal Audit will support UB employees during external audit activity to facilitate the audit, monitor progress, and report results. As warranted, Internal Audit will help with understanding the objectives and scope of the audit, assist the auditors in achieving legitimate objectives with the least impact on university operations, and assure the appropriateness of university audit responses.

The university will provide external auditors with access to all records that are relevant to their work on a timely basis, except those deemed by the university to be legally privileged or protected.

The university is subject to external audits resulting from the diverse and complex nature of its business. These audits are often conducted at various levels within the institution and campus related organizations.

Because external audits differ greatly, it is important to understand the auditor’s process, scope, and objectives of the particular audit project, and possible impact of the audit results. Establishing Internal Audit as the designated point of contact will facilitate the external audit process.

This policy applies to:

• Any examination, audit, investigation, consultation, or review performed by an agency, company, consultant, or other organization or individual outside of the university for the purpose of assessing operational or financial effectiveness, legal or regulatory compliance, information technology and cybersecurity matters, and conformance with contractual obligations
• External audit activity initiated by external agencies, and audits and consulting services contracted by UB
• All campus related organizations (e.g., State, Research Foundation (RF), University at Buffalo Foundation, Campus Dining and Shops, clinical practice plans, student organizations, and other related entities)

This policy does not apply to requests for information related to complaints or freedom of information law (FOIL) received by or forwarded to the university. It also excludes academic and accreditation reviews as well as specialized inspections such as building, fire, safety, and food service.

External Audit Activity

Independent and objective appraisal, performed by a non-UB entity. These can include, but are not limited to audits, program reviews, examinations, consulting engagements, site visits, desk audits, fraud and irregularity investigations, and field testing. External audit activity may be mandatory or voluntary.

External Auditor

Any non-UB auditor, agent, consultant, or investigator. External auditors may represent state or federal agencies, certified public accounting firms, legal firms, or grant sponsors, including State University of New York internal auditors and RF internal auditors.

• Monitor all external audit activity and provide periodic reports to the Vice President for Finance and Administration (VPFA).
• Review and advise on the selection of external audit firms.
• Review and approve, as appropriate, requests for a waiver of the ten year external auditor rotation requirement for specialized audits.
• Track and report the implementation status of audit recommendations to the VPFA.
• Participate, or designate an Internal Audit participant, in entrance and exit conferences as warranted, depending on the scope and impact of the proposed audit activity.
• Identify, as needed, the appropriate university administrator as liaison to assist external auditors in the performance of their duties.
• Review and advise on all official university responses to findings contained in audit reports prior to submission to the external agency.

• Notify the Director of Internal Audit immediately when contacted by an external agency regarding an audit.
• Contact the Director of Internal Audit prior to submitting an RFP for external audit services to determine whether the audit is necessary and/or can be performed in-house.
• Ensure that Internal Audit is a member of the selection committee when contracting with an external audit firm.
• Invite the Director of Internal Audit to attend entrance and exit meetings with the external auditor.
• Ensure that the engagement partner is rotated every five years and the external audit firm is rotated every ten years.
  • The ten year rotation may be waived for specialized audits. Provide a written justification for the waiver to Internal Audit and Procurement for approval.
  • The ten year rotation is subject to limitations in accordance with New York State regulations and may be limited to separate five-year term contracts.
• Ensure the Director of Internal Audit receives a copy of all management letters and final audit reports.
• Ensure all new and renegotiated contracts explicitly stipulate the requirements included within this policy. 

• Notify the Director of Internal Audit immediately when contacted by an external agency regarding an audit.
• Invite the Director of Internal Audit to attend entrance and exit meetings with the external auditor.
• Provide support to the external auditors, including scheduling entrance and exit conferences, coordinating requests for specific information or interviews with employees, and arranging workspace.
• Ensure that the responsible departments and employees cooperate with the external auditors.
• Prepare draft responses and forward to the Director of Internal Audit for review prior to submittal to the external auditor.
• Provide the Director of Internal Audit with a copy of all management letters and final audit reports received from the external agency.
  • Inform the Director of Internal Audit if a final report is not expected.
• Implement appropriate corrective measures based on the findings identified in the external audit report.

• Ensure that contracts with campus related organizations stipulate the requirements of this policy.
• Provide advice and guidance to university departments during the RFP process to select an external auditor.
• Review and approve, as appropriate, requests for a waiver of the ten year external auditor rotation requirement for specialized audits.

• Be cooperative and professional when dealing with the auditors.
• Assist the auditors with specific requests and answer only the questions asked by the auditors. If you are unsure about how certain information may relate to the specific audit, consult with the responsible department head for a decision on providing that information.