Identify Kentucky State University's Audit Universe. All audit units (e.g., programs, processes) for Kentucky State University were identified. These units constitute the audit universe for Kentucky State University. The identification was achieved using a variety of sources, including organizational charts, institutional knowledge, financial system data, enterprise policies and procedures, budgetary documents and input from key stakeholders.

There were a total of 167 auditable units identified.

Stratify Audit Universe. Kentucky State University's audit universe was stratified to identify the units that pertain to the Office of Internal Audit and those that should be covered by other auditors (e.g., external, state, federal). The Office of Internal Audit's core service for each pertinent audit unit was determined.

The OIA's audit universe consists of 157 audit units.

Risk Assessment. The risk assessment approach is based on the COSO - Enterprise Risk Management framework. Eight different risk factors were used to evaluate each audit unit in the Office of Internal Audit's universe. The factors included items such as prior audit results, complexity of operations, and relevance to strategic objectives. The units were ranked as high, medium, or low risk.

There were a total of 76 audit units ranked as high risk.

Identification of Major Risks. Kentucky State University's major risks, from an internal audit perspective, were identified. The identification of these risks helps ensure resources are allocated to the most critical areas and processes.

The major risks identified are in Table 1 on the following page.