Board of Regents Policy CSCU Policy Regarding Internal and External Audit Information Requests

The purpose of this policy is to establish uniform systemwide response expectations to requests for information made by authorized internal and external audit organizations.

Prompt cooperation with audit activities is fundamental to the Connecticut State Colleges and Universities (CSCU) System's commitment to accountability, transparency, and stewardship of public resources.

College or University. Any of the institutions within CSCU, including Central Connecticut State University, Charter Oak State College, Connecticut State Community College, Eastern Connecticut State University, Southern Connecticut State University, and Western Connecticut State University. 

CSCU. The Connecticut State Colleges and Universities, which includes the CSCU system office, and any and all specific Colleges or Universities within the CSCU. For purposes of this policy, the term “CSCU” could mean the CSCU system or any College or University interchangeably. 

System and Institutional Leadership. A group of CSCU employees with significant leadership responsibilities to include, but not limited to, the Chancellor, system office executives, presidents, vice presidents, provosts, deans, directors, department heads, supervisors, and managers.

All CSCU personnel shall cooperate fully, promptly, and in good faith with requests for information, records, documentation, electronic data, explanations, interviews, or other materials submitted by:

• The CSCU Director of Internal Audit, including Internal Audit staff;
• External audit firms retained by the Board of Regents or CSCU; and
• The Connecticut Auditors of Public Accounts (APA).

It is the expectation that employees fully respond to all audit requests within the timeframe provided by the auditor making the request, which is generally seven (7) business days. If circumstances reasonably prevent compliance within the required timeframe, the responsible employee or office shall notify the requesting audit organization before the response deadline. Any extension beyond the initial response timeframe must be approved in advance through mutual agreement between the requesting audit organization and the responsible employee or office, with another date certain specified for compliance. 

Employees shall work cooperatively to provide requested information, and provide timely access to records, systems, facilities, or personnel.

1. Responsibilities of All Employees
   
   All CSCU employees are responsible for:
   1. Providing complete, accurate, and timely responses to authorized audit requests;
   2. Producing records, documentation, electronic information, and other materials maintained in the normal course of business, except where disclosure is prohibited by law;
   3. Preserving records relevant to ongoing audit activities in accordance with applicable records retention requirements;
   4. Promptly communicating any circumstance affecting the employee's ability to meet the required response timeline; and
   5. Cooperating fully and professionally throughout the audit process.

2. Responsibilities System and Institutional Leadership
   
   System and Institutional Leadership has an affirmative responsibility to facilitate authorized audit activities.

   Accordingly, System and Institutional Leadership shall:

   1. Ensure audit requests receive appropriate institutional priority;
   2. Allocate sufficient personnel and resources necessary to enable timely responses;
   3. Direct employees under their supervision to cooperate fully with authorized auditors;
   4. Provide audit staff with safe, furnished, and operational workspace that provides privacy for conversations, throughout the course of any audit. This requires access to wireless internet, parking, and read-only access to all applicable automated information systems, if germane to the audit assignment. Internal Audit shall have complete access to all automated information systems, as outlined in the internal audit charter.
   5. Monitor the status of outstanding audit requests to ensure compliance with established deadlines;
   6. Where practicable, remove administrative or operational barriers that could delay audit activities;
   7. Ensure that responsive records are preserved and made available in accordance with applicable law and policy;
   8. Promptly elevate issues affecting timely compliance when necessary; and
   9. Foster an organizational culture that promotes transparency, accountability, and independent audit oversight.

   Failure of supervisory personnel to fulfill these responsibilities may constitute a failure to discharge assigned managerial duties, subject to applicable Board policy, collective bargaining agreements, and state personnel regulations.

3. Fulfillment of Audit Requests
   
   Fulfillment of authorized audit requests is a required administrative responsibility of every CSCU employee and manager.

   1. Internal Audits
      
      During an internal audit, when requested information has not been provided within the established timeframe for response and no approved extension has been granted or request for extension has been made and is pending, the Director of Internal Audit shall issue a reminder to comply with the information request. 

      Such reminder shall be directed to the employee responsible for the response, and the employee's immediate supervisor. If there is no satisfactory response after five (5) business days, the notice shall be sent to the appropriate institutional Vice President/President or System Office executive. If there is still no satisfactory response or timeline agreed upon after four weeks, the notice shall be sent to the Chancellor or their designee, and the Board of Regents Audit Committee. 
      
      The Director of Internal Audit is responsible for tracking non-responsiveness to ensure that individuals, departments, and institutions are accountable for their administrative responsibilities related to audit requests. Institutional leaders are accountable not only for their own responses to audit requests but also for ensuring that employees under their direction comply with the requirements of this policy.
      
      Repeated failure by an employee or member of institutional leadership to comply with an audit request may result in appropriate administrative action consistent with Board policy, applicable collective bargaining agreements, Connecticut law, and due process requirements.

   2. External Audit
      
      Should any external audit firms retained by the Board of Regents or CSCU or the Connecticut Auditors of Public Accounts (APA) need assistance in obtaining response to a request, they may engage the Director of Internal Audit to escalate the non-responsiveness consistent with the escalation protocols related to internal audit requests above.
4. Duty to Support Audits
   
   The effectiveness of the CSCU internal and external audit functions depends upon timely and complete access to personnel, records, systems, facilities, and information. 
   
   Every employee and every level of management shares responsibility for ensuring that authorized auditors are able to perform their work independently, objectively, efficiently, and without unnecessary delay. Audits of CSCU activities are an essential component of CSCU's governance, risk management, and internal control framework.

5. Authority

   This policy is issued pursuant to the authority vested in the Board of Regents for Higher Education to oversee the Connecticut State Colleges and Universities System, ensure compliance with all Board policies, safeguard public resources, and promote effective governance and accountability throughout the System. 

   This policy further supports CSCU's obligation to cooperate with audits conducted pursuant to applicable provisions of the Connecticut General Statutes, including audits performed by the Connecticut Auditors of Public Accounts, independent external auditors retained by the Board of Regents or CSCU, and the Office of Internal Audit operating under the authority of the Board of Regents Audit Committee and the CSCU Director of Internal Audit. The Office of Internal Audit functions as an independent assurance activity serving the Board of Regents Audit Committee. 

   Nothing in this policy supersedes federal or state law, collective bargaining agreements, or applicable legal privileges or confidentiality requirements. Employees shall continue to safeguard confidential, protected, and personally identifiable information while providing authorized auditors access as permitted by law.

   Enforcement

   This policy is enforced under the Code of Conduct for Regents, Employees, and Volunteers. Failure to adhere to the obligations in the policy may result in discipline up to and including termination, consistent with all CSCU policies and any relevant Collective Bargaining Agreement.