The results of our initial risk assessment required judgment and interpretation of our observations to date. Some of the factors we considered in developing this initial risk assessment included, but were not limited to:

Expertise and experience of key faculty and staff;

Turnover or openings in key positions;

The pervasiveness and materiality of the area or component to the University;

Areas more susceptible to risk based on our experience with similar institutions;

■ Comments and observations from faculty and staff concerning the efficacy of internal controls and areas for improvement;

Discussion with the University's external auditors;

Past audit findings and adjustments;

■ Any matters of interest arising from our inspection of recent audit reports;

If applicable, any findings from cognizant or regulatory agencies;

The maturity, scalability, and robustness of information systems;

The level of oversight by senior management and those charged with governance;

The quality of existing policies and procedures;

The economic environment of the University; and

■ Components or areas more susceptible to fraud.

2