===== PAGE 1 ===== Kentucky State University

## 2012 -2013 Initial Risk Assessment and ## Internal Audit Plan # Presented by: TRONCONI SEGARRA ASSOCIATES Certified Public Accountants Business Consultants SOLUTIONS BEYOND THE OBVIOUS ===== PAGE 2 ===== # Kentucky State University Table of Contents 2012-2013 Initial Risk Assessment and Internal Audit Plan Page Transmittal Letter Initial Risk Assessment Overview ..... 1-3 Risk Management Tolerance Model ..... 4 Internal Audit Plan Timeline ..... 5 Proposed Rotation Plan for Significant Cycles ..... 6-7 Notification of Fraud or Suspected Fraud ..... 8 ===== PAGE 3 ===== # TRONCONISEGARRA ASSOCIATES Certified Public Accountants Business Consultants To the Audit Committee of Kentucky State University We are pleased to present our initial risk assessment and internal audit plan for Kentucky State University (the “University”). The purpose of our engagement is to assist you in the development of a risk assessment of University operations, to perform various internal audit services, and provide recommendations to strengthen controls and reduce the identified risks. This report was developed from inquiry of University faculty and staff, observations, inspection of various policies and procedures, and assessment of the University’s financial reports and findings from its external auditors. The University's risks are an action or event which may adversely affect its ability to successfully achieve its objectives. The Risk Assessment section of the report analyzes the significant risk findings that were identified during this initial phase of our engagement. As we continue our work, perform testing to determine the efficacy of internal controls, and submit reports on our findings, our initial risk assessment may change. For purposes of this report, internal control is a process affected by the Board of Regents (the “Board”), department heads and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the reliability of financial reporting and safeguarding of assets. As noted, the purpose of our engagement was to assist you in improving the internal controls and reducing the risks that face the University. However, it is ultimately your responsibility to assess the adequacy of your risk management system. In performing our engagement, we relied on the accuracy and reliability of information provided by University personnel. We have not audited, examined, or reviewed the information, and express no assurance thereon. The accompanying comments are intended solely for the information and use of the Audit Committee, Board of Regents, department heads, and others within the University and should not be used for any other purpose. We appreciate the opportunity to serve you and thank the individuals in the University for their cooperation. We have already discussed many of these comments with various University personnel, and we will be pleased to discuss them in further detail at your convenience. Through our ongoing involvement with you as a client and our knowledge of your processes, we would be pleased to perform any additional studies of these matters, or to assist you in implementing the recommendations.

July 27, 2012 ===== PAGE 4 ===== Initial Risk Assessment ===== PAGE 5 ===== # Kentucky State University Initial Risk Assessment ## Overview The University's risks are the risks that an action or event will adversely affect its ability to successfully achieve its objectives. During our engagement we became aware of various sources of risk that impact the University. We evaluated these risks by using two distinct assessments of impact and likelihood. A simple rating scale has been developed for this purpose. The rating scale ranges from minor to significant impact, and low to high likelihood, using a 3-point scale. Impact refers to the extent of the consequences or implications if the risk does occur. To assess impact, we have determined how much of an impact the risk has if it does occur: A minor impact suggests that the risk would not have important implications on the University. A moderate impact suggests that the risk could have implications for the University's ability to succeed. A significant impact suggests that the risk would have important implications on the University. Likelihood refers to the probability that the risk may occur given the current context of the University. To assess likelihood, we have determined how likely it is that the risk will occur in the future, given what is currently done to manage said risk: A low likelihood suggests that the risk is unlikely to occur, given its nature and current risk management practices in place. A medium likelihood of occurrence suggests that the risk has a moderate probability of occurrence. A high likelihood of occurrence suggests that the risk is likely to occur, despite the current risk management practices in place. The Risk Management Tolerance Model and the Risk Assessment Matrix that follows summarizes these risks and assesses their impact and likelihood. ===== PAGE 6 ===== # Kentucky State University Initial Risk Assessment (continued) The results of our initial risk assessment required judgment and interpretation of our observations to date. Some of the factors we considered in developing this initial risk assessment included, but were not limited to: Expertise and experience of key faculty and staff; Turnover or openings in key positions; The pervasiveness and materiality of the area or component to the University; Areas more susceptible to risk based on our experience with similar institutions; ■ Comments and observations from faculty and staff concerning the efficacy of internal controls and areas for improvement; Discussion with the University's external auditors; Past audit findings and adjustments; ■ Any matters of interest arising from our inspection of recent audit reports; If applicable, any findings from cognizant or regulatory agencies; The maturity, scalability, and robustness of information systems; The level of oversight by senior management and those charged with governance; The quality of existing policies and procedures; The economic environment of the University; and ■ Components or areas more susceptible to fraud. ===== PAGE 7 ===== # Kentucky State University Initial Risk Assessment (continued) We have developed the risk assessment around the following significant transaction cycles as a means by which the associated risks can be easily understood and managed: General Control Environment (GC) Student Financial Aid (SFA) Land and Other Grants (G) Capital Assets (CA) Information Technology (IT) Purchasing, Accounts Payable, and Disbursements (PA) Payroll and Personnel (PP) Financial Reporting (FR) Travel & Entertainment (T&E) Auxiliary Enterprises (AE) Investments (I) Debt (D) Accounts Receivable and Collections (AR) ===== PAGE 8 =====

Kentucky State University Initial Risk Assessment (continued)

Risk Management Tolerance Model

Likelihood We have not yet rated the areas surrounding Auxiliary Enterprises, Investments, Debt, and Accounts Receivable and Collections. ===== PAGE 9 ===== Internal Audit Plan ===== PAGE 10 ===== # Kentucky State University Internal Audit Plan ## Timeline We anticipate the following activities and timeline to accomplish our internal audit plan, which may be amended from time to time (if need be) to address any emerging high-risk issues identified:

Internal Audit Activity	Proposed Timing
Initial Risk Assessment and Proposed Audit Plan	May – June
Documentation and testing of key internal controls	May–October
Drafting report of observations and recommendations	September–November
Follow-up on status of any findings from external audit	November–January
Fixed assets observations	October – May
Written and verbal reports to management and Audit Committee	Ongoing and each Board meeting

===== PAGE 11 ===== # Kentucky State University Internal Audit Plan (continued) ## Proposed Rotation Plan for Significant Cycles The combination of our initial risk assessment and discussions with management resulted in our proposed internal audit plan. We have developed a rotation plan with the objective of touching most areas within a three-year period:

Transaction Cycle/Area	Fiscal 2012-2013	Fiscal 2013-2014	Fiscal 2014-2015
General Control Environment (GC)		X
Student Financial Aid (SFA)	X	X	X
Land and Other Grants (G)	X	X	X
Capital Assets (CA)	X
Information Technology (IT)	X
Purchasing, Accounts Payable, and Disbursements (PA)		X
Payroll and Personnel (PP)	X		X
Financial Reporting (FR)	X
Travel & Entertainment (T&E)	X	X	X
Auxiliary Enterprises (AE)		X

===== PAGE 12 ===== # Kentucky State University Internal Audit Plan (continued)

Transaction Cycle/Area	Fiscal 2012-2013	Fiscal 2013-2014	Fiscal 2014-2015
Investments (I)		X
Debt (D)			X
Accounts Receivable and Collections (AR)			X

For each cycle selected for a given year, we will gain an understanding of the design and operating effectiveness of key internal controls through observation, inquiry, walkthroughs, and testing a sample of transactions/attributes. The area of Student Financial Aid can further be broken down into the areas of Institution Eligibility and Participation, Reporting, Student Eligibility, Disbursements, Return of Title IV funds, GAP's and Cash Management, and Administrative Capability. These areas will be factored in our rotation plans, and the number of areas to be covered impacts the need to address Student Financial Aid every year. ===== PAGE 13 ===== # Kentucky State University Internal Audit Plan (continued) ## Notification of Fraud or Suspected Fraud In connection with the planning and the performance of our internal audit services, should we become aware of any fraud or illegal acts (or suspect fraud or illegal acts) we will inform the University's Audit Committee. The University's Audit Committee, Board of Regents and management are responsible informing us of its views about the risk of fraud within the University and its knowledge of any fraud or illegal acts (or suspected fraud or illegal acts) affecting the University. The University will provide us with any communications received from employees, analysts, regulators, or others containing any allegations of fraud or suspected fraud within the University.