​Every "Where Was Internal Audit" Moment Presents an Opportunity

In the wake of this shocking breech of admissions processes and controls, there is a growing chorus of voices saying that, based on the risks that are obviously present, it's time to include the admissions process at colleges and universities in internal audit plans. The profession should eagerly accept the invitation to step up and show the value of independent assurance. Indeed, we should see every "where was internal audit" moment as an opportunity. 

Let's examine what lessons we can take from the recent scandal and how internal audit could have made a difference. But first, allow me to offer some important background.

Federal prosecutors have indicted more than 50 people — including high-profile celebrities — over a scheme to get applicants who lacked the qualifications accepted to highly competitive colleges. Authorities say the elaborate deception included bribes to coaches, cheating on college entrance examinations, and million-dollar "guarantees" of admission. 

The fallout has been rapid and significant. Several coaches have been fired, admissions have been rescinded for some students, and the U.S. Department of Education has opened an investigation into the eight colleges named in the federal investigation, including Yale, Stanford, the University of Southern California, and Georgetown.

So what can we learn from the scandal?

Managing admission to any group can be risky. Practices that involve weighing qualifications for inclusion must have controls and processes, and historically the desire to be admitted has led to people trying to get around those controls and processes. Indeed, there is an expression in English that describes this practice. "Gaming the system" is manipulating the rules and procedures to achieve a desired outcome. The admissions scandal is a perfect example of gaming the system. In a process that involves some level of subjectivity, manipulation can take on many forms, including bribery, fraud, and corruption.

There are risks associated with relying on outside testing organizations. In the current scandal, several parents are accused of paying to have others take standardized college tests for their children or to have test answers provided to them. 

Most colleges and universities in the United States rely on standardized test scores as part of their admissions criteria. The two most prominent are the Scholastic Aptitude Test (SAT) and the American College Test (ACT). Both measure high school graduates' ability to do college-level work, and about 4 million students take these tests annually. Both tests are run by independent, nonprofit companies.

From a control perspective, internal audit would likely question the reliance on a third party for entrance examinations without some level of oversight. Colleges and universities are not involved in the test creation, administration, or scoring, yet they rely heavily on the test scores in the admissions process.

Formal exceptions to the rules create opportunities for abuse. Formal exceptions to admissions processes have been created to allow for members of any number of groups, including minorities and athletes, to gain access to higher education. The latter has created an entire subculture of risk associated with college sports.

In the current admissions scandal, authorities say college coaches were bribed to get candidates admitted. One high-profile example involves a celebrity couple allegedly paying $500,000 to have their daughters designated as recruits for the University of Southern California crew team, even though neither daughter had ever participated in the sport. 

Internal audit can provide assurance on the effectiveness of controls and processes for any formal exception to the admissions process, including how applicants are designated as team recruits and verifying those who actually play the sport.

Informal exceptions send mixed messages. The scandal reflects the extreme lengths to which some parents will go to ensure their children are accepted to elite universities and colleges. This effort to "get in through a side door" clearly crosses legal lines when bribery and fraud are employed. 

However, there have long been two informal "back doors" to the admissions process. One involves special consideration for the children of donors to colleges and universities. These instances, known as "developmental cases," are an understood but generally unspoken part of most university admissions processes. Similarly, "legacy preference" or "legacy admission" is a widespread practice where admissions preference is given to applicants who have a familial relationship to alumni of the college or university.

Providing assurance over such practices would be awkward and contentious for internal audit in that the exceptions are not entirely based on objective criteria about the strengths or weaknesses of an applicant. But they do effectively support college and university endowments.

It is unclear whether the current admissions scandal will lead to substantive changes in admissions processes driven by a genuine desire for transparency and accountability. What is clear is that such transparency and accountability would require significant changes in admissions practices — some dating back centuries.

As always, I look forward to your comments.