The committee's 2026–27 work plan moves the institutional risk profile review from October to February. The delay gives the administration time to set up new compliance and enterprise risk management governance structures. The university hopes to introduce a new chief compliance officer at the December meeting, which will also include a closed session on information security and data management.
The chief auditor said the office has 14 auditors against a full complement of 16 and had planned to recruit for open positions this fall. That hiring is now paused until there is more clarity on potential budget reductions in FY2028 and FY2029, which would come on top of existing structural deficits. Over the past year the office had two retirements, three departures and five extended medical or parental leaves. The office is handling more investigations and special reviews than usual, and its progress on the audit plan is at the low end of expectations.
Two audits have high-risk items open for more than two years. The Bell Museum has not completed an evaluation and appraisal of its art collection, which the auditor described mainly as an insurance risk; the work was delayed by facility issues and difficulty finding a contractor. HIPAA governance and oversight has four open items on policies, oversight structure and privacy assessments. Those are expected to be finished after a new chief compliance officer and chief privacy officer are hired. Overall, 31% of outstanding high-risk items were fixed this period and 24% are past due.
The export controls and Buy America audit found the university managing the risk well. Recommendations include formalizing standards and monitoring, especially international travel registration. The chief auditor cautioned that the review did not cover research security. Expanding federal research requirements will need more university attention, particularly for restricted research.
Auditors found the Medical School Duluth campus is managing many of its risks. More work is needed on sponsored awards, payroll, IT management, physical security, and timely fixes to lab safety inspection findings. The chief auditor said some issues likely stem from the school's budget deficit and recent governance changes.
The audit of CTSI's IT systems found several high-risk control and management issues. Those systems handle sensitive health and research data for clinical trials. The most pressing problem is the lack of formal governance and agreed responsibilities between CTSI's internal IT groups and the central IT units they work with. The auditor said staff showed a commitment to data integrity and security.
The committee was informed that the university engaged the outside firm KPMG to perform a HIPAA security assessment. The assessment is part of a broader risk management effort. Such engagements must be reported to the committee under board policy.
