Internal Audit Structure and Risk Management: Evidence From Public US Universities

ABSTRACT In the context of the 2019 US college admissions scandal, I investigate whether internal audit functions (IAFs) in public US universities design risk‐based audit plans. Specifically, I test the association between internal audit structure (i.e., centralized, decentralized and hybrid) and internal auditors' reactions to emerging admissions risk. The statistical results suggest that the IAFs of public US universities responded to admissions risk after the scandal. However, the responses vary among IAFs with different structures. Centralized IAFs emerged as early reactors to admissions risk, whereas decentralized IAFs promptly reacted to admissions risk post‐scandal. Hybrid IAFs demonstrated a tendency to address admissions risk both pre‐ and post‐scandal. This study leverages hand‐collected internal audit plans and reports to examine risk‐based audit plans in higher education. The findings provide empirical evidence that IAFs in higher education engage in risk‐based audit planning.