Studying this technical article and answering the related questions can count towards your verifiable CPD if you are following the unit route to CPD and the content is relevant to your learning and development needs. One hour of learning equates to one unit of CPD. We'd suggest that you use this as a guide when allocating yourself CPD units. 

The higher education sector continues to be challenged by changes in the funding regime. Last November’s comprehensive spending review (CSR) exercise will result in further reductions in funding in a number of key areas and the way the money is shared out will be subject to change. Institutions will need to react to ensure that they are at the front of the queue to get their hands on the cash. Some have already done so, but further work is needed. 

So where does this leave internal audit? Can it play a part in helping institutions to succeed (and maybe even survive) in the ever changing environment within which they operate? Does internal audit need to adapt to address these challenges? The answer must be ‘yes’. 

There is a need to adopt a ‘zero based’ approach to audit planning, based on a thorough understanding of the corporate strategy and the more significant risks facing achievement of corporate objectives. Audit plans should focus on what really matters to the institution and avoid the tendency to recycle old, low risk audits. 

Take payroll for example, always an auditor favourite, but rarely a high risk. So why do auditors insist that this has to be audited regularly, and even annually? It makes far more sense to focus internal audit efforts on areas where most assurance value can be delivered. A more strategically focused audit plan might therefore include audits such as those set out below: 

Achieving more for less

Value for money (VFM) has been part of the narrative between institutions and HEFCE, the sector funder and regulator. As VFM becomes ever more a strategic imperative for institutions, internal auditors need to innovate and move more into an advisory capacity, working alongside institutions as they develop robust VFM and performance improvement strategies. The ability to compare and contrast alternative approaches across a cohort of institutions enhances the value from audit.

Reorganisation and restructuring 

Institutions are changing their shape and what and how they deliver to students. Whether this is through merger, internal departmental combinations, or cutting or replacing courses, these changes can have a significant disruptive effect on operations, and can increase risk. Auditors need to be actively engaged during the lifetime of these projects, rather than at the end (or even avoiding the change altogether), to ensure they are well managed and that risk mitigation strategies are in place. Further, to challenge whether the organisational change is delivering the benefits expected. 

Marketing and business development

In an increasingly competitive market, institutions will look to maintain and increase student numbers and revenues from other sources of income. Audit needs to be equipped to review marketing strategies and processes to ensure they are aligned with the requirements of the institution and they are effective in growing the top line. This may mean specialist training is provided for audit staff to enhance their capability in this area. 


Institutions have for a long time been engaged in the international arena, seeking to grow student numbers, and fee income, from overseas, as well as forming partnerships with local universities and colleges. That strategy continues, although many now have to develop new target markets because of the effects of government policy, for example increased immigration controls, on recruitment.  Investing in new markets can be a high risk strategy and some institutions lack the governance and management control experience in these areas. Surely an area for internal audit to focus on?

The above is by no means an exhaustive list and there are many other areas worthy of consideration by auditors. The starting point is, of course, the institutional risk register. This must drive audit planning, to ensure audit effort is appropriately targeted on key areas of risk. This should be supplemented by active and regular engagement with senior executives to sense check what is in the risk register, and to identify changes to the risk profile, and emerging risks. 

Overall, changing auditor focus is necessary to ensure the service remains highly relevant. Maintaining the status quo isn’t an option.

Alan Lees – managing director, KCG

Alan Lees BA FCA

Alan is managing director of Kingston City Group (KCG), a higher education consortium, providing internal audit and risk advisory services to 15 universities and HE colleges in London and the South East. Prior to joining KCG in May 2015 Alan had a successful career in the accounting profession, most notably at Robson Rhodes where he set up Risk Assurance Services and then, following merger, with Grant Thornton where he led internal audit and risk management services for the central government and not for profit sectors. He has worked with some of the most complex organisations in these sectors including HM Treasury, the Department of Health and the Oxbridge universities. He also has significant experience of working with industry regulators, including the GMC and HEFCE.