Expert Internal Audits

We have vast expertise in delivering internal audits specific to the sector's requirements.

• Audit plans meet the specific requirements of institutions to focus on the highest-risk areas and deliver value for money.
• Our internal audits provide the governing body of a Higher Education institution with an objective evaluation and opinion on the overall adequacy and effectiveness of the operational delivery of an institution.
• We focus on various areas, including governance, risk management and control processes.

We aim to add value and improvements to how an organisation is operating; we want our institutions to accomplish their objectives with a systematic, disciplined approach delivering profound, long-lasting effects.

Our unique structure allows us to absorb institutional cultures and working practices, learning the strengths and weaknesses in depth.

We also provide a wide range of expert internal management consultancy to provide support and advice during organisational change and rationalisation periods.

KCG has five key stages to deliver a tailored internal audit programme:

1. Develop a thorough understanding of your institution and its objectives, through discussion and a review of relevant documentation
2. Assess your institution’s current approach to risk management and decide whether it will support the development of a strategic risk-based internal audit plan
3. Identify and assess the key risks that could have a significant impact on your institution or department reaching its objectives
4. Develop the internal audit plan and obtain agreement from you that the plan is focused in the right areas before approval by the audit committee
5. Have regular re-appraisal of your potential risks that affect the scope and direction of the internal audit plan

Our audit plans are tailored for your needs and timetabled in agreement with you.

Risk Management

Good risk management provides a structured way of describing your aims, working out what might affect them, how likely that is to happen, deciding what to put in place to address those situations and then putting them in place.

The most common misconception about risk management is that its purpose is to avoid risk. In fact, its purpose is to make success more likely. KCG has extensive experience of working with institutions to implement and improve their risk management processes.

The key areas where we help your institution are:

Design of a risk management system
We will design a system tailored specifically for you, recognising your unique characteristics that is both proportionate and pragmatic.

Risk identification and assessment 
Our workshop approach to identifying risk and assessing likely impacts ensures that there is a shared, cross-business view of risks, their significance and potential impact.

Risk maturity assessment
This identifies the extent to which risk management is embedded in your institution and whether remedial steps are required to improve risk activities.

Risk implementation improvement plan
Assessing your existing risk management arrangements and support implementation of improvements to make them fit for purpose. We focus generally on leadership, people and processes.

Project assurance

Good management is the key to success for any project; if done successfully, it will contribute significantly to the success of individual projects. Without it, you could see delays, extra costs mounting up and significant disruption to daily business.

KCG’s independent assurance using sound project management techniques, methods and disciplines to make sure your projects stay on track.

Project management reviews

We will provide assurance on the following project objectives:

• Ensure the project has effective governance and overall management arrangements, such as a steering committee, project manager and key staff with defined responsibilities.
• There is a detailed, dynamic project plan monitored throughout, with lessons from previous projects taken on board.
• Key objectives are clearly defined and linked between these and the institution’s overall strategy.
• Demonstrable senior management ownership, support and leadership for the project.
• The project engages with users and stakeholders throughout each stage.
• User approval is sought at milestone stages.
• There is adequate training and documentation in place.

The assurance might range from an initial overview assessment of the project, all the way through to a full-blown project assurance audit, which would interact with the project at key phases, providing real-time commentary and opinions on a range of key areas.

IT assurance and advisory

Technology is changing all the time and for Higher Education institutions, which means lots of changes in the IT and information environment. 

KCG understands that each of our members will have unique structures, needs and priorities when it comes to IT. KCG’s key IT audit services are tailored to each individual institution and include:

• IT Governance and risk management
• IT operations
• Cyber security
• Project management
• Network and telecommunications
• Resilience and disaster recovery planning
• Benchmarking against IT best practice frameworks

Data analytics 

Do you have reams of institutional data that you know could offer valuable insights, but you don’t know how to unlock that potential? KCG has the skills and tools to analyse that data and unlock some of that value. Our advanced data analytic system is designed to accept a wide range of data sets and can provide a range of reporting suited for your needs. 

The key steps to delivering data analytics are: 

Planning  
All data analytics work is led by a senior member of KCG, who agrees the scope, objectives and timing for the work, and the logistics involved in extracting and securing the data to be interrogated.

Systems understanding 
We gain an understanding of systems and controls in place, and agree with you the most appropriate time period to review.

Data extraction 
We will request data to be extracted from key information systems and supplied to us in an appropriate format.

Data processing
Our auditors conduct a variety of routines using our advanced data analytic system IDEA.

Audit processes
Our auditors use the output from the data analytics work to help focus audit effort and to provide the basis for detailed audit procedures to be performed. 

Reporting 
We report confidentially to our assigned audit sponsors and provide key executive conclusions along with detailed findings and results.

We develop and use data analytics plans tailored to the needs of each institution and have experience in carrying out a wide range of tests. 

Benchmarking

We do this as an integral part of every audit, using the knowledge we have gained across our client base to advise on sector best practice. We conduct a sector theme audit each year designed to advise individual institutions and then produce an anonymised benchmarking report on hot topics. Recent sector themed audits have included Covid 19 – Lessons Learned, Environmental Sustainability and this year we are conducting a review of Harassment and Sexual Misconduct.

Regulatory Compliance

Our audit plans cover areas including the following:

• The Office for Students ongoing conditions of registration
• UKVI – overseas student sponsorship
• Competition and Markets Authority
• Universities UK Accommodation Code of Practice

Estates Management

Our audit plans cover areas including the following:

• Estates strategy
• Environmental sustainability
• Planned preventative maintenance and reactive maintenance

Student Recruitment

Our audit plans cover areas including the following:

• Marketing strategy and website
• Size and shape analysis
• Analysis of course portfolio
• Cost of acquisition
• International recruitment – analysis of market demand by region and course
• Use of agents

Data Quality

Reliable data is essential for informing decision making as well as being required by the Higher Education Statistics Agency (HESA) in a series of annual returns. We perform data quality audits for our institutions to determine whether they have satisfactory processes in place for the management and reporting of data. Our audits cover the processes and governance arrangements for preparing data returns as well as how institutions use data. This year we are focussing our data audits at a number of institutions on the preparations which are in place for Data Futures.