Robert - you mention a key item - making sure all documents are available upon request. Failure to produce documents not only leads to findings but, also give cause for concern on the overall operations of the campus. Demonstrating the ability to provide info promptly gives auditors a sense that the campus is organized and operating smoothly. With regard to your question on internal vs external, there are varying points of view but, if the appropriate structure is in place, an internal audit team can certainly be successful. There are various charter document samples on the web that outline some points to consider in structuring an internal audit department. I will try to review a few and post a couple to this forum for consideration.