In June, the University of Utah welcomed Hollie Andrus as the institution’s new chief audit executive. It’s no secret that the concept of auditing can bring up anxiety for people. As an internal auditing office, however, Andrus and her team do more than identify problems. The auditors provide consulting services, support the implementation of new federal and state policies and highlight the areas where the university is succeeding. 

In this Q&A, Andrus provides more information about the work she and her team do and the specific ways campus community members can use their services. 

For more information about Andrus and her career, read this Humans of the U piece. 

In addition to compliance, what is the purpose of the auditor’s office?

The internal audit office at the U uses the International Internal Auditor Standards. These standards allow for internal auditors to not only report on issues an organization may face but to also highlight what is working. In my previous job, the reports I made only included problems and recommendations.

As an internal audit office, we will often take a risk-based approach. In this process, we’ll conduct an assessment that is sort of a heat map of concerns and risks at the university. This could be related to a computer system, a new department, a department with a lot of turnover, financial concerns, P-card (purchasing card) concerns, etc. We also can look at non-financial risks and concerns. This could be analyzing workplace climate or culture or general turnover and retention issues.

Right now, we’re getting ready to do an audit of the university’s onboarding system for new employees. This is not financial in any way, shape or form, but it’s an important part of the university, and it is really someone’s first interaction with the U on a professional level.

I’m always trying to help the university be better, whether that’s financial or non-financial concerns that have been shared with us.

How does the auditor help the university comply with federal and state law?

Our internal audit department is created by state law, and the Utah System of Higher Education Board of Regents has developed policies for us to follow. One of those policies is that every five years we have to audit campus auxiliaries, such as the Campus Store, the Union Building, on-campus housing, Red Butte Garden, etc. This is to ensure compliance is being met.

And then, we are always learning about new compliance regulations. For instance, there is new federal guidance coming about cyber security. Our job is to then work with campus entities to make sure the U is following the rules. We can then audit efforts and report on how things are going to ensure we are compliant.

What is an audit report and what does it contain?

In the body of an internal audit report, the most important section is the executive summary. That’s going to tell a reader what we looked at in creating this report—that’s called our scope. It can include things that might be going well, challenges that are being faced, and recommendations for improvement. The actual body of the report will go into more detail of what exactly we analyzed, as well as specific details about our recommendations.  

When it comes to ethics and compliance, how are employees encouraged to use the auditor’s office?

There are really two avenues that come to mind for an employee. I love to do outreach and education. I like to be on that prevention side of an audit and not just the write-you-up-because-you-did-something-wrong part of an audit. So right now, I am reaching out to groups across campus and asking if there are things that we can provide education on. We can come out to staff meetings if asked. We can present to department council meetings. Every department and college does things a little differently, but we would love to come out and help people prevent issues from happening.

The second avenue for really anybody at the university is our anonymous hotline. There’s access to it at audit.utah.edu. It provides a route to anonymously report an ethics violation or what a person believes might be fraud or something that they think just isn’t quite right.

How can departments proactively use the auditor’s office?

In addition to audits, our office can do consulting projects. A few weeks ago, I met with someone who really wanted to better understand the process and the flow of recording information in a system that is not Peoplesoft. They asked if we could come in and help document the flow of information and potentially make recommendations on how it could be improved. That isn’t an audit, but that is a consulting project our office can help with. Many times people hire outside consultants for tasks like this, but our office is here to help as well.

Are there any changes that you’d like to make?

One thing that I was trying to work on in my previous job and something that I want to bring here is improving the tools the university has to analyze electronic information. The U has massive amounts of electronic information. While it’s not impossible for an auditor to find the needles in the haystack, it’s challenging. There are a number of different auditing tools and data analysis tools available that really can help drive improvement. It’s important to me that we work on improving the data visualization resources we are using. I really want to leverage technology so we can do our jobs better. Anything my office does to improve our function and our capabilities will not only help the auditors improve but help the university improve as well.

What do you wish people knew about your job?

We’re not scary. That’s probably the number one thing. We are not scary. We’re here to help the university in any way we can as we follow our audit standards. And we would love to help any department or any group on campus feel better about how their processes and operations are going.