Advisory engagements under the Standards are client‑directed, collaborative, non‑assurance activities that help strengthen governance, risk management, and controls without Internal Audit assuming management responsibility. They typically involve counsel, advice, facilitation, and training.

 

Policy or Procedure Review (Pre‑Implementation)

Internal Audit reviews draft policies, procedures, or workflows before management implements them, offering insights on control design, risk coverage, and alignment with governance expectations.

  • Example: Reviewing a new procurement workflow to ensure segregation of duties and conflict‑of‑interest controls are embedded.
  • Value: Helps management strengthen controls early without IA owning the process.

Risk Advisory Workshops

Facilitating structured discussions with management to identify emerging risks, evaluate risk responses, or refine risk registers.

  •  Example: Leading a workshop on third‑party risk management to help departments map vendor risks and mitigation strategies.
  • Value: Builds risk awareness and supports governance maturity.

Control Design Consultation

Providing advice on designing or enhancing controls for new systems, processes, or technologies.

  • Example: Advising IT and Finance on control considerations during ERP module rollout (access controls, audit trails, data validation).
  • Value: Ensures controls are embedded from the start while IA maintains objectivity.

Facilitation of Process Mapping or Improvement Sessions

Helping departments map current processes, identify bottlenecks, and highlight control gaps.

  • Example: Facilitating a process‑mapping session for student financial aid workflows to identify compliance risks and inefficiencies.
  • Value: Enhances operational effectiveness and supports continuous improvement.

Training and Awareness Sessions

Delivering training on governance, risk management, internal controls, fraud awareness, or ethics.

  • Example: Conducting training on internal control fundamentals for new department heads.
  • Value: Strengthens organizational capability and supports a culture of accountability.

Advisory Input on Strategic Initiatives

Providing insight on risk and control implications of major institutional initiatives.

  • Example: Advising leadership on risk considerations for a new satellite campus or academic program launch.
  • Value: Helps leadership make informed decisions aligned with governance expectations.

Data Governance or Privacy Advisory

Offering guidance on data governance, privacy controls, or cybersecurity risk management.

  • Example: Reviewing draft data‑classification guidelines and advising on control expectations.
  • Value: Supports compliance with regulatory and institutional requirements.

Assurance‑to‑Advisory Follow‑Up

Using insights from assurance engagements to provide targeted advisory support.

  • Example: After an audit identifies recurring issues in grant management, IA facilitates a session to help management redesign monitoring controls.
  • Value: Demonstrates value beyond assurance and supports sustainable remediation.

  Please contact us if you would like to discuss advisory opportunities in your department.