The University of Minnesota Audit and Compliance Committee on its October 2025 agenda received an internal audit update from Chief Auditor Galswyck that highlighted a low remediation rate for outstanding high-risk audit items and staff absences that could delay parts of the FY26 audit plan.

Galswyck told the committee that remediation in the most recent follow-up period was "only 15% of open items being remediated." He said over half of the currently open items are first-time follow-ups and less than 25% of open items are past management's originally planned implementation date; nonetheless he cautioned sustained attention is needed to avoid an ongoing trend. The chief auditor identified three audits with items open more than two years: University Health Safety and Risk Management (centralizing safety training), Dentistry (accounts receivable issues) and the Bell Museum (inventory completion and valuation).

Galswyck also reported that a cluster of employee leaves ' including Minnesota Paid Family and Medical Leave absences, an extended medical leave, and a military deployment ' could reduce internal audit capacity and "could result in up to five of our tier 2 audits from the FY26 audit plan not being initiated in FY26." He said the precise duration and impacts remain unknown and that the committee would receive updates at the February internal audit meeting about any deferred or canceled audits.

The update summarized audit activity over the prior four months: the office completed nine audits during the period and provided other advisory and transition reviews. Of the completed audits, four were rated "good," one "adequate," and two "needs improvement." Notable completed audits rated good included purchasing (supplier onboarding and payments), the SSBCI Venture Capital program, and the Institutional Animal Care and Use Committee. The adequate rating was for UMD International Services; the audits rated "needs improvement" included Biostatistics (operational compliance and IT controls) and the Employee Threat Assessment component of the university-wide threat assessment work. Galswyck said the largest concern in Biostatistics was that its independent IT function did not meet university requirements for managing sensitive research-related data.

On threat assessment, Galswyck said student-focused care teams and the Twin Cities behavioral consultation team are "doing a good job managing risks," but employee-focused threat assessment processes need improved oversight and governance. Management has begun implementing a new university-wide threat assessment program (started in July) to address shortcomings, he said, but full standardization may take years.

The office also tracks remediation plans that reference the university's PEAK schedule; Galswyck noted one new PEAK-related item in the period concerning background check coverage for athletics employees. The committee heard that the external auditor sign-off and report issuance for the annual financial statements was scheduled for Oct. 29; members were invited to submit follow-up questions to allow iterative review prior to that date.

Committee discussion noted some positive context: a chair observed that the proportion of items past management's planned remediation date was among the lowest in three years, indicating some progress even as the overall remediation rate was modest.

Galswyck said the audit office will continue to report follow-up results and any changes to the FY26 plan to the committee at future meetings.