Project Description
University of Virginia Automates Academic Audits with Onspring
An Internal Audit Case Study
OVERVIEW
In 1819, Thomas Jefferson founded the University of Virginia in Charlottesville and inaugurated a bold experiment – a public university designed to advance human knowledge, educate leaders, and cultivate an informed citizenry. Today, UVA is one of the most prestigious public research universities in the world. While it has a rich history, UVA also looks to the future by preparing students to thrive in an ever-changing world and finding new ways to operate more efficiently. When the school decided to enhance its audit and assurance process, it turned to Onspring.
Challenge
Creating Apps for the Audit Universe
When Malika Ouenza joined UVA’s Office of Audit & Compliance as audit analytics program manager, the department was already using the Onspring governance, risk, and compliance (GRC) suite but had yet to realize its full potential. The main reason that UVA’s auditing team wasn’t fully utilizing Onspring is that they were still relying on manual processes.
“I talked with my team and tried to get them to use Onspring more to get away from the old-fashioned tools like Excel, Word, and PowerPoint. We had so many tools and places to go and grab information.”
When UVA decided they needed a more detailed view of the entire auditing process from beginning to end, it was the catalyst to start utilizing more of Onspring’s potential.
“My boss wanted to see where we stood with each audit, which were progressing and complete, how many we’d done, and so on,” Ouenza said. “I built an application for that in Onspring to manage those audit engagements. That evolved to me creating apps for our audit universe, including corrective action and mitigation plans. The good thing with Onspring is that every time there’s something new happening, there’s innovation and the software gets better and better, so there’s always an opportunity to do more.”
Solution
Automating Academic Audits
To help her colleagues progress from their old ways of doing things, Ouenza decided to compare and contrast how long it took to perform key auditing tasks in Onspring versus UVA’s other systems.
“I started with meeting with the team, seeing what they did in other tools, and how long it took them to accomplish a task,” she said. “When I went into Onspring it took an hour, compared to more than half a day. I went back and said, ‘Look at what you can do,’ and made my team excited about the potential of Onspring. We implemented that feature, and I started offering them more and more solutions until they were hooked on Onspring
The latest version of the Onspring GRC suite offered improved integration with Microsoft 365, enabling UVA staff to still perform certain tasks in a familiar environment and then easily upload this information into auditing workflows.
“My favorite feature in Onspring is the additional integration with Microsoft Office,” Ouenza said. “Now we have one central location. All the auditors can access the same file, make changes without having to email them, and we can track those. Then we issue the final report. It makes audits very easy to manage.”
Managing Annual Plans and Audit Engagements
Now, UVA uses Onspring to oversee its entire auditing process. From the moment an annual plan is created, this allows leadership to monitor the team’s progress. “At the beginning of the year, when the audit plan gets approved, I upload it in Onspring,” Ouenza said. “If my boss asks how many audits we have, I could show how many we have in progress and those we have left before the end of the year. It’s a great tracking mechanism that lets us see where we are.”
When the audit plan has been signed off on, UVA’s auditors begin working on each individual audit engagement. “The next step is when we start planning for each audit,” Ouenza said. “We enter into Onspring the planning date, all the notes and attachments, and then move on to the field work. That’s where Onspring is good, so we put all the information in it.”
Once they’ve completed data analysis in third-party tools, UVA’s auditors upload summaries and other attachments into Onspring and prepare for the last step in their process.
“The beautiful thing about Onspring is the generation of the final reports,” Ouenza said. “Every time we finish an audit we have to send a report. We have templates in Onspring that allow us to change wording for one school or another. It has enabled us to be more visual, so when we send out a report, it’s not boring. A client can see the most important information and numbers.”
Results
Focusing on Field Work, Not Data Entry
“Onspring saves us time, which we can use to do more analysis rather than checking information in Excel sheets,” Ouenza said. “It allows us to focus on doing field work and writing the right things in reports, instead of worrying about which tool to use for managing so many projects.”
Back when UVA’s auditing team was using a combination of manual processes and other tools, certain to-do items could slip through the cracks and there was a burden on the staff to remember every single step of the process. Automated updates and notifications in Onspring have fixed this issue.
Ouenza said, “In Onspring, they receive an email with a template that says, ‘This is the project you are working on’ with its status and any information that’s missing. A weekly summary report reminds them of all the things they have to do. Users find this helpful because they don’t have to worry about forgetting anything.”
Streamline Your Audit Process
Gaining Auditing Performance Insights
It used to be difficult for UVA staff to gain insight into auditing performance. Onspring’s graphical reporting provides a real-time overview for certain users and a more detailed perspective for others.
“Onspring is very easy to customize,” Ouenza said. “If you’re meeting with somebody and want to say, ‘We’re doing great,’ you can tell that story by giving them an Onspring dashboard that shows numbers and metrics. I built different dashboards for my boss, managers, our external consultants, and auditors. Once you know a user’s needs, you can deliver something they’re happy with.”
While attending Connect, Onspring’s annual user conference, Ouenza discovered several new use cases for Onspring.
“I’m going to build a risk register app, make sure that we enter all the risks, and try to connect other departments to Onspring,” she said. “We’ll also try to use it for risk management with the finance department.”
Looking ahead, Ouenza will continue finding new ways for UVA to utilize and manage audits. She also sees potential for extending it to policy management and compliance functions. “We currently use only Onspring in the audit department,” she said. “I can’t wait to meet with the compliance team and say, ‘Look what you can do.’ It will give them a central place for policies and compliance.”
Explore more insights
Principles of the COSO Framework
Learn the COSO framework's principles for internal controls that drive operational success, reduce risks and strengthen compliance.
Automating Your Internal Audit Checklist: 7 Tips You Need To Know
Discover how automation elevates the well-designed internal audit checklist into a strategic tool for spotting vulnerabilities, ensuring compliance and delivering big insights.
GRC Management for Retail Data Sheet
Learn how GRC for retail can help with your biggest threats and challenges, including privacy for your customers and security of your financial data.
