| October | ICO & ICC plan current year assessment activity |
| October | Disseminate Internal Control brochure to all employees// VA training |
| November | IC Committee meets to identify areas to assess ICO identifies areas to audit External auditors selected & engaged |
| November | Send out VA’s to selected areas |
| December | VA due back to ICO External audit fieldwork performed |
| January | ICO & ICC review and evaluate VA assessment results Risk Assessment begins with Operations |
| February | IC audits due ICO & ICC review, evaluate & make recommendations to IC Committee Action plan, if any, as a result of audit is prepared and implemented Risk Assessment continues with Legal Liability |
| March | SUNY IC Annual Certification Report & SUNY IC Status Report due Risk Assessment continues with Financial Control |
| April | Risk Assessment concludes with Health & Safety |
| May | External audit fieldwork for the Alumni Association, Foundation and College |
| June | |
| August | External audit completion for Alumni Association, Foundation and College |
IC = Internal Control
ICO = Internal Control Officer
ICC = Internal Control Coordinator
VA = Vulnerability Assessment