How Internal Audit Strengthens Endowment Oversight in Higher Education and Healthcare

Published: Aug 7, 2026
By: Cody Loup; Amber Hebert
Share

Your institution may hold hundreds, even thousands, of individual endowed funds, each carrying its own donor restrictions, spending rules, and reporting obligations. If a donor, a board member, or a regulator asked today, could you show that every dollar has been invested and spent the way the gift agreement requires?

Endowments have grown in both size and complexity, and nowhere is that clearer than in higher education and healthcare. Colleges, universities, health systems, and their supporting foundations manage large investment pools built from gifts that often must last in perpetuity. That combination of permanence, donor intent, and investment risk creates exposure a traditional financial statement audit was never designed to examine in depth. A risk-based internal audit brings the process review and testing these institutions need. Below is where endowment risk concentrates and how internal audit helps.

Key Takeaways

Endowments concentrate several hard-to-see risks at once: donor restriction compliance, spending policy accuracy, and oversight of complex, often illiquid investments.
Higher education and healthcare institutions carry this risk at scale, frequently tracking thousands of restricted funds across decentralized development, finance, and investment teams.
Internal audit gives boards and management independent assurance that endowment funds are governed, invested, spent, and reported in line with donor intent and regulatory requirements.
Many recurring findings trace back to a fragmented, manual gift-to-spend process rather than a single broken control, so the most durable fixes pair audit testing with process and governance redesign.

Why Endowment Oversight Deserves Attention Now

Expectations around endowments have moved from general principles to documented proof. Most states have adopted the Uniform Prudent Management of Institutional Funds Act (UPMIFA), which sets standards for prudent investment, prudent spending, and honoring donor restrictions. Financial reporting adds another layer: under FASB not-for-profit reporting standards, institutions must classify net assets by donor restriction and disclose funds that have fallen below the value of the original gift, often called underwater endowments.

At the same time, endowment portfolios have grown more complex. Allocations to private equity, hedge funds, real assets, and other alternative investments raise valuation, liquidity, and fee-transparency questions that an annual financial statement audit rarely tests in detail. Donors and boards increasingly want confirmation that restrictions are honored and that spending follows an approved, defensible policy. When those questions arrive, institutions without documented processes and supporting evidence face a difficult, deadline-driven scramble.

Where Endowment Risk Concentrates in Higher Education and Healthcare

Endowment risk exists in any organization that holds restricted investment funds, but two sectors carry it at a scale that makes internal audit particularly valuable.

Higher Education

Colleges and universities often manage thousands of individual endowed funds, including scholarships, endowed chairs, program funds, and research support. Each fund is tied to a specific gift agreement. Responsibility is usually spread across advancement or development, the controller's office, and an investment office or outsourced chief investment officer (OCIO). That decentralization makes it easy for a restriction recorded when a gift is received to drift out of view years later, especially when funds are pooled for investment and spending is allocated by units. The result is a real risk that scholarship or program funds are spent on purposes the donor never approved.

Healthcare

Health systems, hospital foundations, and academic medical centers hold restricted funds for research, capital projects, charity care, and specific service lines. Academic medical centers combine both worlds, layering university-style endowment structures on top of hospital operations and their own regulatory pressures. Restricted gifts must be tracked against the clinical or research purpose the donor designated and released to operations only as the associated costs are incurred. Weak coordination among the foundation, the health system finance function, and grant or program managers can leave restricted funds misclassified or spent outside their intended purpose.

How Internal Audit Adds Value

Internal audit brings an independent, risk-based review of the controls that surround the endowment. That review spans the full lifecycle, from the moment a gift is accepted through the way spending is calculated and reported. The table below outlines where gaps commonly appear, along with what an internal audit examines in each area.

Endowment risk area	What role internal audit plays
Donor intent and restriction compliance	Traces a sample of funds from the original gift agreement through to how they are recorded, invested, and spent, confirming restrictions are captured accurately and honored over each fund's life.
Spending policy and appropriation	Recalculates the spending appropriation, confirms it follows the board-approved policy, and reviews how underwater funds are handled where UPMIFA and donor expectations intersect.
Investment governance and manager oversight	Reviews adherence to the investment policy statement, monitoring of investment managers or the OCIO, valuation of illiquid and alternative holdings, and the transparency of fees.
Gift administration and fund setup	Tests how new endowment agreements are reviewed, approved, and established in the accounting records, so a fund's purpose and restriction are set correctly from day one.
Net asset classification and reporting	Confirms funds are classified correctly by donor restriction, that releases from restriction are supported, and that disclosures, including underwater endowments, are complete and accurate.
Reconciliations and fund accounting	Tests reconciliations among the custodian, the general ledger, and the endowment subledger, and reviews how pooled returns and spending are allocated across individual funds.
Investment compensation and committee authority	Confirms that incentive compensation for the investment team is calculated per an approved plan, independently recalculated and reviewed, and that any board or committee involvement in pay decisions stays within its authorized mandate rather than extending into administrative decisions.
Valuation of illiquid and alternative holdings	Reviews how private equity, hedge fund, and other illiquid values are rolled forward from audited year-end figures to interim reporting dates, whether a consistent methodology is applied across managers, and whether fair-value adjustments are supported by identifiable transactions rather than general market drift.

Observations from the Field

Recurring patterns emerge across all engagements, no matter the type. The observations below reflect where these risks often surface in practice:

A restriction is only as strong as the record that carries it. When gift terms live in a development officer's files rather than the accounting system, the finance team cannot reliably report or defend how funds were used.
Small errors in the spending calculation compound across hundreds of funds and multiple years. Independent recalculation is one of the faster ways to surface a systemic issue before donors or auditors do.
A clean year-end balance can hide a fund that ran negative mid-year and was quietly covered by borrowing from another fund. That intra-year deficit is invisible on annual statements, yet the reallocation itself can breach a donor restriction. Testing balances across the year, not just at close, is where this surfaces.
Most misclassified funds were misclassified from day one, not years later. When a gift's restriction is recorded incorrectly at setup, every downstream report inherits the error, which is why reviewing fund origination often yields more than testing spending after the fact.

Building Endowment Coverage Into Your Audit Plan

Endowment risk rarely justifies a standalone review every year, but it deserves a defined place in a multi-year, risk-based internal audit plan. A practical approach starts with a risk assessment across the gift-to-spend lifecycle, prioritizes the areas with the weakest controls or the largest financial exposure, and rotates coverage so that donor compliance, spending, investment oversight, and reporting each receive attention over time. Institutions that co-source or fully outsource the internal audit function can bring in this depth without building the capability in-house.

When Testing Isn't Enough: The Process Behind the Findings

Individual audit findings are often symptoms of the same underlying condition: a gift-to-spend lifecycle that is fragmented across systems and teams, and still runs on manual effort. When the handoffs between development, finance, and the investment office are undocumented, and roles and decision rights are unclear, the same weaknesses reappear regardless of how many times they are tested and remediated. Misclassified funds, distributions that outrun donor purpose, and governance that drifts beyond its mandate tend to share this common root.

This is why the most durable improvements pair internal audit with a current-state assessment and process redesign. An assessment maps the end-to-end process as it actually operates, identifies where controls and accountability break down, and clarifies the roles, decision rights, and standardized procedures that keep restrictions intact from gift acceptance through reporting. Audit tells an institution where it stands today; process and governance redesign help keep the same findings from returning next year.

How EisnerAmper Helps

EisnerAmper works with colleges, universities, health systems, and their foundations to design and perform risk-based internal audits across the endowment lifecycle. Our Internal Audit and Risk Advisory teams help institutions confirm that donor restrictions are honored, spending follows approved policy, investment oversight is documented, and financial reporting holds up to scrutiny from boards, donors, and regulators.

Whether you need a one-time review, a co-sourced arrangement, or a fully outsourced internal audit function, we tailor the scope to your risk profile. And when findings point to a deeper process issue, our teams can extend the work into a current-state assessment and process redesign, so you can both identify the gaps and close them at the source. Fill out the form below to connect with us to discuss strengthening oversight of your endowment.