Indiana University Internal Audit
|
|
|
- Lewis Richards
- 8 years ago
- Views:
Transcription
1 Indiana University Internal Audit Top Ten Audit Issues March 6, 2013 Christine Swafford, CPA, CIA, CISA Director, Indiana University Internal Audit
2 2 Objectives Discuss the process of identifying audit issues. Learn the elements of audit issues. Provide awareness of Top 10 Audit Issues and examples of each with policy/law references.
3 3 Top 10 Audit Issues - Key Points in Identification Identified top 10 audit issues over past 3 years Issues and risk can change over time Risks are unique to each unit Use of Risk Assessment and Control Evaluation (RACE) Matrix to document risks Collaboration between Internal Audit and the fiscal officer/management is the key to addressing issues and implementing action plans
4 4
5 5 Elements of Audit Issues/Findings Current Condition - What is the problem? Why is this an issue? Criteria - What is the expected condition based on policy, law, best practice? Cause - Why is there a difference between current condition and criteria? What is the ROOT cause? Effect - What is the risk? What can happen if issues are not corrected? Action Plan - What can be done to fix the root cause of a problem? What can be done to improve processes?
6 6 Example of Audit Finding Elements Current Condition: Unit employees are not receiving the appropriate revenue training as required by IU policy FIN-TRE-VI-120 Processing Revenue. Sixteen of 25 (64%) employees reviewed did not have the appropriate revenue processing training and nine out of 19 (47%) employees reviewed did not have the appropriate Security Awareness Education (SAE) training.
7 7 Example of Audit Finding Elements Criteria - Policy FIN-TRE-VI-120 states, Ensure all full time employees involved in revenue processing or with access to university banking/payment card systems have attended a face to face Treasury revenue processing training session and part time and student hourly employees have either attended the Treasury delivered face to face training or taken the revenue processing tutorial available on the Office of the Treasurer website prior to performing any revenue processing transactions. Additionally, the policy states, Attend ongoing training sessions delivered by Treasury; annual training is required for those involved with processing credit and debit card transactions.
8 8 Cause Example of Audit Finding Elements We often times will not include the cause for the finding if it could reflect poorly on the audit client or appear as an excuse to the Board of Trustees. Cause usually comes down to willful disregard for policies/procedures or lack of knowledge of policies/procedures. We will ask a lot of questions in order to determine the ROOT cause of the issue to ensure the action plan will fix the problem.
9 9 Example of Audit Finding Elements Effect/RISK Lack of appropriate training prior to processing revenue increases the risk for the loss of university funds.
10 10 Example of Audit Finding Elements Action Plan All employees who have not taken the required Revenue training and/ or the SAE training will complete the training. All employees needing training have registered and all training was completed by December 15, 2012.
11 Top 10 Audit Issues
12 12 Audit Issue #10 Lack of Inventory Controls
13 13 AUDIT ISSUE #10 Current Condition = Inventory controls don t exist to control or monitor: Shrinkage Obsolete inventory Accounting for inventory Criteria = Best Practice; GAAP; Auxiliary SOP Risk = Lost funds due to theft, spoilage, obsolescence
14 14 #10 Lack of Inventory Controls Examples A department sells parking passes but does not account for the passes. Ideally passes should be pre-numbered and reconciled to sales. Inventory should also be accounted for monthly. Would be same situation for any other inventory item, books, prescription drugs, apparel, gifts, metal used in fabrication, etc.
15 15 Inventory Controls Policies & SOP Auxiliary Financial Standards FIN-ACC-I-600 Accrual Account FIN-ACC-I-350 Auxiliary Standard Operating Procedures
16 16 AUDIT ISSUE #9 Failure to Comply with Contracts or Agreements
17 17 AUDIT ISSUE #9 Current Condition = Contracts, agreements, and memorandums of understanding are not complied with Criteria = Provisions outlined in contract, agreements, memos Risk = Fines, penalties, reputation risk, legal risk for breach of contract
18 18 Failure to Comply with Contracts or Agreements Examples Signing contracts or agreements with no signature authority. Purchasing contracts Insurance certificates for a special event. Memorandums of understanding between IU and third parties
19 19 Failure to Comply with Contracts or Agreements - Relevant Policy Signature Authority and Delegation FIN-TRE- VI-100 ( reasurers-office/fin-tre-vi-100-signatureauthority-and-delegation.shtml) No officer, agent, or employee of the University has the authority to sign contracts or other agreements on behalf of the University or any unit, department or subdivision of the University
20 20 Audit Issue #8 Non-compliance with Purchasing Card Guidelines
21 21 AUDIT ISSUE #8 Current Condition = Purchasing cards used to: Circumvent dollar limits on cards by stacking transactions Purchase unallowable items Purchase items which were available in EPIC Criteria = P-card process & restrictions Risk = Thousands of dollars could be spent before being detected because transactions are not preapproved; theft
22 22 Non-compliance with P-card Guidelines Examples Stacking! - #1 thing we see in audits Unallowable purchases: Cell phones (must purchase and get reimbursed via supplemental pay) Ammunition Furniture Travel or travel related expenses
23 23 Non-compliance with P-card Guidelines Relevant Policy and Guidelines urchasing/fin-pur-20.0-university-procurementcontracts.shtml ml
24 24 AUDIT ISSUE #7 Lack of Procedures to Mitigate Risk
25 25 AUDIT ISSUE #7 Current Condition = Common business processes not followed. Criteria = Financial policy I-470 Internal Controls; best business practice Risk = Undetected loss of funds, inefficiencies, theft
26 26 Lack of Procedures to Mitigate Risk - Examples No segregation of duties for collecting, depositing, and reconciling revenue. Reconciliation of accounts (monthly operating statement; credit cards; accounts receivable) Accountability for critical documents supporting transactions (revenue transactions, receipts, travel documents, etc.)
27 27 Lack of Procedures to Mitigate Risk - Policy ccounting-administration/fin-acc-i-470-internalcontrols.shtml
28 28 AUDIT ISSUE #6 Non-Compliance with IU Policies and Related Laws
29 29 AUDIT ISSUE #6 Current Condition = Failure to have adequate internal controls to ensure policy compliance: Delegation of signature authority Programs Involving Children Fair Labor Standards Act Conflict of Commitment/Conflict of Interest Donor Intent Criteria = IU Policies; Relevant Laws Risk = loss of funds; fines and penalties; loss of reputation
30 30 Non-Compliance with IU Policies and Related Laws - Examples Delegation of signature authority Programs Involving Children Fair Labor Standards Act Conflict of Commitment/Conflict of Interest Donor Intent
31 31 Non-Compliance with IU Policies and Related Laws Policies Many of our policies reference or are based on state and federal laws Whistleblower Ghost employment Overtime
32 32
33 33 AUDIT ISSUE #5 Inadequate IT Physical Security
34 34 AUDIT ISSUE #5 Current Condition = Physical security inadequate. Criteria = Management of Institutional Data, IT Policy DM01, Information Security & Privacy Policies, Best Practice Risk = Loss of data, loss of equipment, harmed reputation, loss of funds
35 35 Inadequate IT Physical Security - Examples Access to server room not controlled People working in server room Lack of fire suppression device Location of server room (basement prone to flooding)
36 36 Inadequate IT Physical Security - Policy n-it/it/it-12.shtml - IT-12: Security of IT Resources DRAFT IT-28: Provisioning of IT Services n-it/data-management/dm-01.shtml -Management of Institutional Data
37 37 AUDIT ISSUE #4 Non-compliance with Revenue Processing Policy
38 38 AUDIT ISSUE #4 Current Condition = Revenue policy VI-120 is not followed. Common violations on next slide. Timely deposits Credit card reconciliation Training provisions Endorsing checks Payment Card Industry Data Security Standards (PCI DSS) Criteria = Processing Revenue Policy VI-120 Risk = Theft, lost revenue, fines/penalties, reputational risk
39 Non-compliance with Revenue Processing Policy - Examples Timely deposits not made/ Credit card reconciliation not performed daily. Training provisions not met. Checks are not endorsed immediately upon receipt. Payment Card Industry Data Security Standards (PCI DSS) are not met. 39
40 Non-compliance with Revenue Processing Policy - Policy easurers-office/fin-tre-vi-120-processingrevenue.shtml 40 This is a long policy but all of it is important!
41 41 AUDIT ISSUE #3 Failure to Pay Employees Accurately
42 42 AUDIT ISSUE #3 Current Condition = Employees not paid accurately Paid too much or not enough epto adjustments for Absent without pay Paid for not working (ghost employment) Criteria = IU must pay for time worked; must not pay for time not worked Fair Labor Standards Act Department of Labor state law IU policy MUST pay employees for time worked; must NOT pay employees if they are not working (ghost employment) Risk = Fines/penalties; low employee morale; reputation
43 43 Failure to Pay Employees Accurately Examples and Relevant Policy/Law Examples: Paid too much or not enough epto adjustments for Absent without pay Paid for not working (ghost employment) IU policy MUST pay employees for time worked; must NOT pay employees if they are not working (ghost employment) Policy/Law: HR and Payroll policies Fair Labor Standards Act Indiana Department of Labor
44 44 AUDIT ISSUE #2 Inadequate IT Logical Security
45 45 AUDIT ISSUE #2 Current Condition = Policy IT-12, Security of IT Resources is not followed, creating weaknesses in logical security. Criteria = Policy IT-12 and best practices Risk = Security breach/lost data Lost dollars Reputational risk Legal issues
46 46 Inadequate IT Logical Security - Examples Vulnerability scans Patch management issues Administrative rights Lack of disaster recovery plan/business continuity plan No review of system logs Backups on off site Failing to encrypt data Anti-virus scans not performed
47 47 Inadequate IT Logical Security - Policy n-it/it/it-12.shtml IT-12: Security of Information Technology Resources
48 48 AUDIT ISSUE #1 Failure to Secure Sensitive Data
49 49 AUDIT ISSUE #1 Current Condition = Sensitive data not secured (manual and electronic records) Criteria = guidance from Information Security & Privacy Program Risk = major fines, reputational risk, financial impact, personal liability, violations of state law
50 50 Failure to Secure Sensitive Data - Examples HIPAA data PHI protected health information Credit card numbers Check numbers SSN FERPA BOTH PAPER AND ELECTRONIC
51 Failure to Secure Sensitive Data Policy and Guidance DM01- Management of Institutional Data n-it/data-management/dm-01.shtml n- it/index.shtml#informationsecurityandprivacyprogr amispp = all IT policies UISO when in doubt, call! 51
52 52 What Did We Learn? Process of identifying audit issues Elements of audit issues (findings) Awareness of Top 10 Audit Issues, examples of each with policy/law references
53 53 Questions? Christine Swafford
54 54 Next Topic What to Expect When You Are Audited May 22, 2013 Other topics of interest?
55 55
Client Security Risk Assessment Questionnaire
Select the appropriate answer from the drop down in the column, and provide a brief description in the section. 1 Do you have a member of your organization with dedicated information security duties? 2
NONPROFIT FINANCIAL MANAGEMENT SELF ASSESSMENT TOOL
NONPROFIT FINANCIAL MANAGEMENT SELF ASSESSMENT TOOL I. Financial Planning/Budget Systems 1. Organization has a comprehensive annual budget which includes all sources and uses of funds for all aspects of
University of San Diego University Audit Office Self-Audit Tool. A - General
University of San Diego University Audit Office Self-Audit Tool Department: Budget Officer: Completed by: Date: The Self-Audit Tool is a guide and is not all-inclusive. Yes indicates a needed control is
Nationwide Review of CMS s HIPAA Oversight. Brian C. Johnson, CPA, CISA. Wednesday, January 19, 2011
Nationwide Review of CMS s HIPAA Oversight Brian C. Johnson, CPA, CISA Wednesday, January 19, 2011 1 WHAT I DO Manage Region IV IT Audit and Advance Audit Technique Staff (AATS) IT Audit consists of 8
Top Ten Technology Risks Facing Colleges and Universities
Top Ten Technology Risks Facing Colleges and Universities Chris Watson, MBA, CISA, CRISC Manager, Internal Audit and Risk Advisory Services cwatson@schneiderdowns.com April 23, 2012 Overview Technology
Example Accounting/Financial Policies
Example Accounting/Financial Policies TABLE OF CONTENTS INTERNAL CONTROLS... 2 ACCESS TO RECORDS BY MEMBERS... 3 ACCOUNTING COMPUTER FILE BACK-UP PROCEDURE... 3 ACCOUNTING METHOD... 3 AUDIT COMMITTEE...
UTAH STATE UNIVERSITY POLICIES AND PROCEDURES MANUAL
UTAH STATE UNIVERSITY POLICIES AND PROCEDURES MANUAL Title: Credit Card Handling and Acceptance Policy Policy Number: C3875 Effective Date: November 8, 2006 Issuing Authority: Office of VP Business and
plantemoran.com What School Personnel Administrators Need to know
plantemoran.com Data Security and Privacy What School Personnel Administrators Need to know Tomorrow s Headline Let s hope not District posts confidential data online (Tech News, May 18, 2007) In one of
Community Ambulance Service District
Community Ambulance Service District For the period July 1, 2011 through June 30, 2013 Oklahoma State Auditor & Inspector Gary A. Jones, CPA, CFE This publication, issued by the Oklahoma State Auditor
InfoGard Healthcare Services. 2015 InfoGard Laboratories Inc.
InfoGard Healthcare Services 10 Steps To Protect My Covered Entity From Breach Your Presenters Alan Martin Account Manger Marvin Byrd Security Engineer Test and Certification Laboratory Healthcare Payment
INTERNAL CONTROL POLICIES
INTERNAL CONTROL POLICIES 2701 Internal Control Policy 2701.1 Addendum Internal Control Standard #1 Payments Cycle 2701.2 Addendum Internal Control Standard #2 Conversion Cycle 2701.3 Addendum Internal
Northeast Higher Education District Itasca Community College
Northeast Higher Education District Itasca Community College Internal Control and Compliance Audit Office of Internal Auditing June 6, 2016 Reference Number 2016-06 Report Classification: Public Northeast
Purchasing Card Training
Purchasing Card Training Contents Purchasing card program summary Purchase restrictions Violations Reporting requirements Delegation Absentee cardholders Cardholder expectations Account set up and card
IT04 UO ACH Security Policy
IT04 UO ACH Security Policy Effective 1 July 2009 Last Revised Who Should Read This Policy Employees who have access to and, therefore, responsibility for safeguarding customer bank account and Automated
SAS 70 Exams Of EBT Controls And Processors
Appendix VIII SAS 70 Examinations of EBT Service Organizations Background States must obtain an examination by an independent auditor of the State electronic benefits transfer (EBT) service providers (service
Information Security Policy and Handbook Overview. ITSS Information Security June 2015
Information Security Policy and Handbook Overview ITSS Information Security June 2015 Information Security Policy Control Hierarchy System and Campus Information Security Policies UNT System Information
THE UNIVERSITY OF TEXAS-PAN AMERICAN OFFICE OF AUDITS & CONSULTING SERVICES. Department of Rehabilitation Report No. 14-15
THE UNIVERSITY OF TEXAS-PAN AMERICAN OFFICE OF AUDITS & CONSULTING SERVICES Report No. 14-15 OFFICE OF INTERNAL AUDITS THE UNIVERSITY OF TEXAS - PAN AMERICAN 1201 West University Drive Edinburg, Texas
Fraud Protection, You and Your Bank
Fraud Protection, You and Your Bank Maximize your chances to minimize your losses Presentation for Missouri GFOA April 2011 By: Terry Endres, VP, Government Treasury Solutions Phone: 314-466-6774 Terry.m.endres@baml.com
MEMORANDUM INTERNAL CONTROL REQUIREMENTS FOR NON-PROFITS
DIVISION OF CHILD CARE AND EARLY CHILDHOOD EDUCATION HEALTH AND NUTRITION UNIT P O BOX 1437, SLOT S 155 501-320-8982 FAX: 501-682-2334 TDD: 501-682-1550 TO: NON-PROFIT INSTITUTIONS FROM: HEALTH AND NUTRITION
SUA - Payroll and Inventory Payroll System
1 SUA - Payroll and Payroll System SUA Chapter 5 Characteristics of the Payroll System Accountant s Objectives Similar to the purchases and cash disbursements system however employees are retained long-term
INTERNAL CONTROL QUESTIONNAIRE OFFICE OF INTERNAL AUDIT UNIVERSITY OF THE VIRGIN ISLANDS
Cabinet Member or Representative responsible for completing this form: INSTRUCTIONS FOR COMPLETING THIS FORM: Answer each question by placing an X in the either the Yes, No,, or Applicable () column. Provide
Course: Information Security Management in e-governance. Day 1. Session 5: Securing Data and Operating systems
Course: Information Security Management in e-governance Day 1 Session 5: Securing Data and Operating systems Agenda Introduction to information, data and database systems Information security risks surrounding
Internal Controls and Political Committees
Internal Controls and Political Committees Under the Federal Election Campaign Act (FECA) and the Commission s regulations all political committees are required to file accurate and complete disclosure
Vanderbilt University
Vanderbilt University Payment Card Processing and PCI Compliance Policy and Procedures Manual PCI Compliance Office Information Technology Treasury VUMC Finance Table of Contents Policy... 2 I. Purpose...
Oklahoma Workers Compensation Commission
OPERATIONAL AUDIT Oklahoma Workers Compensation Commission For the period February 1, 2014 through June 30, 2015 Oklahoma State Auditor & Inspector Gary A. Jones, CPA, CFE Audit Report of the Oklahoma
A8.700 TREASURY. This directive applies to all campuses of the University of Hawai i.
Prepared by Treasury Office. This amends A8.710 dated July 2001. A8.710 April 2005 A8.700 TREASURY P 1 of 5 A8.710 Credit Card Program 1. Purpose To provide uniform procedures for the processing of credit
6/17/2013 PRESENTED BY: Updates on HIPAA, Data, IT and Security Technology. June 25, 2013
Updates on HIPAA, Data, IT and Security Technology June 25, 2013 1 The material appearing in this presentation is for informational purposes only and should not be construed as advice of any kind, including,
Internal Controls: Best Practices for Political Campaigns in New York City
Internal Controls: Best Practices for Political Campaigns in New York City This document describes standard financial controls and procedures that can help you protect and manage your campaign s assets
Fiscal Procedure Sequence page number
Table of Contents Fiscal Procedure Sequence page number Treasurer Responsibilities Maintenance of General Ledger Financial Statements Financial Signature/Review Policy Insurance Protection Payroll Procedures
Accounting software & data
Accounting software & data Accounting software and data should reside at church or be webbased where the data base can be accessed by multiple users Multiple people should be trained on software Software
How To Manage A Corporation
Western Climate Initiative, Inc. Accounting Policies and Procedures Adopted May 8, 2013 WESTERN CLIMATE INITIATIVE, INC ACCOUNTING POLICIES AND PROCEDURES Adopted May 8, 2013 Table of Contents I. Introduction...
University of California, Riverside Computing and Communications. IS3 Local Campus Overview Departmental Planning Template
University of California, Riverside Computing and Communications IS3 Local Campus Overview Departmental Planning Template Last Updated April 21 st, 2011 Table of Contents: Introduction Security Plan Administrative
2011 2012 Aug. Sept. Oct. Nov. Dec. Jan. Feb. March April May-Dec.
The OCR Auditors are coming - Are you next? What to Expect and How to Prepare On June 10, 2011, the U.S. Department of Health and Human Services Office for Civil Rights ( OCR ) awarded KPMG a $9.2 million
HIPAA Compliance: Are you prepared for the new regulatory changes?
HIPAA Compliance: Are you prepared for the new regulatory changes? Baker Tilly CARIS Innovation, Inc. April 30, 2013 Baker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed
FINANCIAL MANAGEMENT POLICIES AND PROCEDURES
FINANCIAL MANAGEMENT POLICIES AND PROCEDURES SAMPLE 1. GENERAL PURPOSE The purpose of these policies is to establish guidelines for developing financial goals and objectives, making financial decisions,
HIPAA/HITECH Compliance Using VMware vcloud Air
Last Updated: September 23, 2014 White paper Introduction This paper is intended for security, privacy, and compliance officers whose organizations must comply with the Privacy and Security Rules of the
RISK ASSESSMENT TOOL: Business Processes
: Business Processes Purpose This tool can be utilized by departments and units to determine where risks and opportunities for control activities exist within their administrative business processes. For
Connecting the dots: IT to Business
Connecting the dots: IT to Business Jason Wood, CPA, CISA, CIA, CITP, CFF April 2015 1 Speaker Bio Jason Wood Over 18 years of international business experience in planning, conducting, and quality reviewing
CITY OF SAN ANTONIO OFFICE OF THE CITY AUDITOR. Audit of the Finance Department. Payroll. Project No. AU13-024. June 9, 2014
CITY OF SAN ANTONIO OFFICE OF THE CITY AUDITOR Audit of the Finance Department Project No. AU13-024 June 9, 2014 Kevin W. Barthold, CPA, CIA, CISA City Auditor Executive Summary As part of our annual Audit
TOP 10 Security Questions Introduction Breaches and other privacy and security incidents in healthcare are on the rise due to the vast size of the industry and the oneoffs of protected health information
WASHINGTON STATE UNIVERSITY MERCHANT ACCOUNT AGREEMENT FOR UNIVERSITY DEPARTMENTS
WASHINGTON STATE UNIVERSITY MERCHANT ACCOUNT AGREEMENT FOR UNIVERSITY DEPARTMENTS I. Introduction, Background and Purpose This Merchant Account Agreement (the Merchant Agreement or Agreement ) is entered
THE UNIVERSITY OF TEXAS-PAN AMERICAN OFFICE OF AUDITS & CONSULTING SERVICES. Office of Alumni Relations Report No. 15-10
THE UNIVERSITY OF TEXAS-PAN AMERICAN OFFICE OF AUDITS & CONSULTING SERVICES Report No. 15-10 OFFICE OF INTERNAL AUDITS THE UNIVERSITY OF TEXAS - PAN AMERICAN 1201 West University Drive Edinburg, Texas
Accepting Payment Cards and ecommerce Payments
Policy V. 4.1.1 Responsible Official: Vice President for Finance and Treasurer Effective Date: September 29, 2010 Accepting Payment Cards and ecommerce Payments Policy Statement The University of Vermont
Department of Health and Mental Hygiene. Alcohol and Drug Abuse Administration
Audit Report Department of Health and Mental Hygiene Alcohol and Drug Abuse Administration July 2009 OFFICE OF LEGISLATIVE AUDITS DEPARTMENT OF LEGISLATIVE SERVICES MARYLAND GENERAL ASSEMBLY This report
GRINNELL COLLEGE CREDIT CARD PROCESSING AND SECURITY POLICY
GRINNELL COLLEGE CREDIT CARD PROCESSING AND SECURITY POLICY PURPOSE The Payment Card Industry Data Security Standard was established by the credit card industry in response to an increase in identify theft
Understanding PCI Compliance
Understanding PCI Compliance www.cognoscape.com Understanding PCI Compliance What is PCI Compliance? What exactly is PCI compliance? PCI stands for Payment Card Industry, and the compliance component ensures
CREDIT CARD POLICY DRAFT
APPROVED BY Ronald J. Paprocki I. Policy Statement Any office of the University that processes credit card transactions may do so only in the manner approved by the University Treasury Office and in compliance
SUBSIDIARY LEDGER MANAGEMENT AND INTERNAL CONTROLS
SUBSIDIARY LEDGER MANAGEMENT AND INTERNAL CONTROLS Introduction: A critical component of the University s internal control environment over financial transactions is the departmental subsidiary ledger
PCI Compliance: How to ensure customer cardholder data is handled with care
PCI Compliance: How to ensure customer cardholder data is handled with care Choosing a safe payment process for your business Contents Contents 2 Executive Summary 3 PCI compliance and accreditation 4
Introduction. Purpose. Reference. Applicability. HIPAA Policy 7.1. Safeguards to Protect the Privacy of PHI
Office of Regulatory Compliance 13001 E. 17 th Place, Suite W1124 Mail Stop F497 Aurora, CO 80045 Main Office: 303-724-1010 Main Fax: 303-724-1019 HIPAA Policy 7.1 Title: Source: Prepared by: Approved
Protecting Personal Information: The Massachusetts Data Security Regulation (201 CMR 17.00)
Protecting Personal Information: The Massachusetts Data Security Regulation (201 CMR 17.00) May 15, 2009 LLP US Information Security Framework Historically industry-specific HIPAA Fair Credit Reporting
Information Technology
Credit Card Handling Security Standards Overview Information Technology This document is intended to provide guidance to merchants (colleges, departments, organizations or individuals) regarding the processing
Gramm Leach Bliley Act. GLBA/HIPAA Information Security Program Committee GLBA, Safeguards Rule Training, Rev. 7/1/2007
Gramm Leach Bliley Act 15 U.S.C. 6801-6809 6809 GLBA/HIPAA Information Security Program Committee GLBA, Safeguards Rule Training, Rev. 7/1/2007 1 Objectives for GLBA Training GLBA Overview Safeguards Rule
Internal Control Guidelines
Internal Control Guidelines The four basic functions of management are usually described as planning, organizing, directing, and controlling. Internal control is what we mean when we discuss the fourth
OVERVIEW. In all, this report makes recommendations in 14 areas, such as. Page iii
The Office of the Auditor General has conducted a procedural review of the State Data Center (Data Center), a part of the Arizona Strategic Enterprise Technology (ASET) Division within the Arizona Department
EAA Policy for Accepting and Handling Credit and Debit Card Payments ( Policy )
EAA Policy for Accepting and Handling Credit and Debit Card Payments ( Policy ) Background Due to increased threat of identity theft, fraudulent credit card activity and other instances where cardholder
Meeting the HIPAA Training and Business Associate Requirements Questions and Answers, with HIPAA Security Expert Mike Semel
Meeting the HIPAA Training and Business Associate Requirements Questions and Answers, with HIPAA Security Expert Mike Semel Questions Answers 1 Is a Business Associate (BA) responsible for assuming a Covered
ACCOUNTING POLICIES AND PROCEDURES SAMPLE MANUAL
(Name of Organization & logo) ACCOUNTING POLICIES AND PROCEDURES SAMPLE MANUAL (Date) Note: this sample manual is designed for nonprofit organizations with the following staff involved with accounting
City of Brentwood. Thomas A. Schweich Missouri State Auditor FOLLOW-UP REPORT ON AUDIT FINDINGS. October 2013 Report No. 2013-109
Thomas A. Schweich Missouri State Auditor FOLLOW-UP REPORT ON AUDIT FINDINGS City of Brentwood October 2013 Report No. 2013-109 http://auditor.mo.gov Follow-Up Report on Audit Findings Table of Contents
HIPAA Compliance Evaluation Report
Jun29,2016 HIPAA Compliance Evaluation Report Custom HIPAA Risk Evaluation provided for: OF Date of Report 10/13/2014 Findings Each section of the pie chart represents the HIPAA compliance risk determinations
HIPAA BUSINESS ASSOCIATE AGREEMENT
HIPAA BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement ( BAA ) is effective ( Effective Date ) by and between ( Covered Entity ) and Egnyte, Inc. ( Egnyte or Business Associate ). RECITALS
How To Protect Yourself From Cyber Threats
Cyber Security for Non- Profit Organizations Scott Lawler CISSP- ISSAP, ISSMP, HCISPP Copyright 2015 LP3 May 2015 Agenda IT Security Basics e- Discovery Compliance Legal Risk Disaster Plans Non- Profit
EVALUATION REPORT. Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review. March 13, 2015 REPORT NUMBER 15-07
EVALUATION REPORT Weaknesses Identified During the FY 2014 Federal Information Security Management Act Review March 13, 2015 REPORT NUMBER 15-07 EXECUTIVE SUMMARY Weaknesses Identified During the FY 2014
ACE Advantage PRIVACY & NETWORK SECURITY
ACE Advantage PRIVACY & NETWORK SECURITY SUPPLEMENTAL APPLICATION COMPLETE THIS APPLICATION ONLY IF REQUESTING COVERAGE FOR PRIVACY LIABILITY AND/OR NETWORK SECURITY LIABILITY COVERAGE. Please submit with
ASC Financial Policies Page i of 18 Originally Approved by BOT: November 2006 Revised: July 2014/Revisions approved by BOT
All Souls Church, Unitarian Financial Policies and Procedures Table of Contents Page A. Fiscal Year and Accounting System 1 B. Cash Management and Control 1 1. Types of Accounts 1 2. Opening/Closing Accounts
Internal Controls Best Practices
Internal Controls Best Practices This list includes the most common internal controls applied by small to medium sized businesses to their operations. It includes controls that apply to the processes most
Vulnerability Management Policy
Vulnerability Management Policy Policy Statement Computing devices storing the University s Sensitive Information (as defined below) or Mission-Critical computing devices (as defined below) must be fully
Indiana University Payment Card Merchant Agreement
Indiana University Payment Card Merchant Agreement This Merchant Agreement (the Agreement ), executed on the date stated below, which includes any schedule or addendum to this Agreement, all of which are
FINAL May 2005. Guideline on Security Systems for Safeguarding Customer Information
FINAL May 2005 Guideline on Security Systems for Safeguarding Customer Information Table of Contents 1 Introduction 1 1.1 Purpose of Guideline 1 2 Definitions 2 3 Internal Controls and Procedures 2 3.1
Auditing your institution's cybersecurity incident/breach response plan. Baker Tilly Virchow Krause, LLP
Auditing your institution's cybersecurity incident/breach response plan Objectives > Provide an overview of incident/breach response plans and their intended benefits > Describe regulatory/legal requirements
Managing data security and privacy risk of third-party vendors
Managing data security and privacy risk of third-party vendors The use of third-party vendors for key business functions is here to stay. Routine sharing of critical information assets, including protected
GENERAL PAYROLL CONTROLS Dates in scope:
GENERAL PAYROLL CONTROLS Risk # Risk Expected Control Step # Testing Documents/Info Needed 1 Unauthorized initial pay rate 2 Unauthorized/unsupported deductions (statutory deductions and benefits). Initial
TREASURER S OFFICE ADMINISTRATIVE STANDARDS FOR THE TREASURER S FISCAL PROCEDURE No. 08-01 MERCHANT DEBIT AND CREDIT CARD RECEIPTS
TREASURER S OFFICE ADMINISTRATIVE STANDARDS FOR THE TREASURER S FISCAL PROCEDURE No. 08-01 MERCHANT DEBIT AND CREDIT CARD RECEIPTS 1. Introduction Debit and Credit Card Receipt Standards apply to the administration
PCI Compliance. Top 10 Questions & Answers
PCI Compliance Top 10 Questions & Answers 1. What is PCI Compliance and PCI DSS? 2. Who needs to follow the PCI Data Security Standard? 3. What happens if I don t comply? 4. What are the basic requirements
MEMORANDUM. Municipal Officials. From: Karen Horn, Director, Public Policy and Advocacy; and Abby Friedman, Director, Municipal Assistance Center
MEMORANDUM To: Municipal Officials From: Karen Horn, Director, Public Policy and Advocacy; and Abby Friedman, Director, Municipal Assistance Center 89 Main Street, Suite 4 Montpelier, Vermont 05602-2948
Reconciliation of Cash
2. Trial Balance Notes Trial Balance and Reconciliation of Cash Trial balance: w used to confirm that accounts receivable, program expenditures, and cash balance equal amount of funds authorized and should
The Practice of Internal Controls. Cornell Municipal Clerks School July 16, 2014
The Practice of Internal Controls Cornell Municipal Clerks School July 16, 2014 Page 1 July 18, 2014 Cash Receipts (Collection procedures) Centralize cash collections within a department or for the local
AUDITOR GENERAL WILLIAM O. MONROE, CPA
AUDITOR GENERAL WILLIAM O. MONROE, CPA FLORIDA COMMUNITY COLLEGE AT JACKSONVILLE ORION SYSTEM INFORMATION TECHNOLOGY AUDIT For the Period April 30, 2001, Through August 13, 2001 And Selected College Actions
INCIDENT RESPONSE CHECKLIST
INCIDENT RESPONSE CHECKLIST The purpose of this checklist is to provide clients of Kivu Consulting, Inc. with guidance in the initial stages of an actual or possible data breach. Clients are encouraged
T H E R E A L C O S T O F A D ATA B R E A C H
T H E R E A L C O S T O F A D ATA B R E A C H Hosted by AllClear ID www.allclearid.com/business WELCOME // QUICK NOTES Presentation is being recorded and will be available within 2-3 business days at www.allclearid.com/business
ACCOUNTING AND FINANCIAL REPORTING REGULATION MANUAL
ACCOUNTING AND FINANCIAL REPORTING REGULATION MANUAL STATE BOARD OF ACCOUNTS 302 West Washington Street Room E418 Indianapolis, Indiana 46204-2769 Issued January 2011 Revised April 2012 TABLE OF CONTENTS
The policy and procedural guidelines contained in this handbook are designed to:
BASIC POLICY STATEMENT The Mikva Challenge is committed to responsible financial management. The entire organization including the board of directors, administrators, and staff will work together to make
Avoiding Theft in Your Nonprofit Ohio Attorney General Mike DeWine
Avoiding Theft in Your Nonprofit Ohio Attorney General Mike DeWine 1 Dear Nonprofit Leader, The single greatest asset of a nonprofit is arguably its reputation. When theft or misappropriation of assets
PCI General Policy. Effective Date: August 2008. Approval: December 17, 2015. Maintenance of Policy: Office of Student Accounts REFERENCE DOCUMENTS:
Effective Date: August 2008 Approval: December 17, 2015 PCI General Policy Maintenance of Policy: Office of Student Accounts PURPOSE: To protect against the exposure and possible theft of account and personal
Audit Guidelines. The Annual Church Audit. by Dan Busby. Key Concepts. Idea! Use this document as a checklist for your annual audit.
The Annual Church Audit by Dan Busby Audit Guidelines Church board members have a long list of responsibilities. Among these is the responsibility for the money that flows through the church. Included
Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH)
Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH) Table of Contents Introduction... 1 1. Administrative Safeguards...
R345, Information Technology Resource Security 1
R345, Information Technology Resource Security 1 R345-1. Purpose: To provide policy to secure the private sensitive information of faculty, staff, patients, students, and others affiliated with USHE institutions,
TABLE OF CONTENTS OBJECTIVES, SCOPE, AND METHODOLOGY... 1 BACKGROUND... 1. 1. Authorized Signers Not Updated... 5
TABLE OF CONTENTS Page OBJECTIVES, SCOPE, AND METHODOLOGY... 1 BACKGROUND... 1 FINDINGS AND RECOMMENDATIONS 1. Authorized Signers Not Updated... 5 2. Insufficient Employee Background Checks... 6 3. Discrepancy
INFORMATION SECURITY AND PRIVACY INSURANCE WITH ELECTRONIC MEDIA LIABILITY COVERAGE. I. GENERAL INFORMATION Full Name:
INFORMATION SECURITY AND PRIVACY INSURANCE WITH ELECTRONIC MEDIA LIABILITY COVERAGE NOTICE: COVERAGE UNDER THIS POLICY IS PROVIDED ON A CLAIMS MADE AND REPORTED BASIS AND APPLIES ONLY TO CLAIMS FIRST MADE
California State University, Sacramento INFORMATION SECURITY PROGRAM
California State University, Sacramento INFORMATION SECURITY PROGRAM 1 I. Preamble... 3 II. Scope... 3 III. Definitions... 4 IV. Roles and Responsibilities... 5 A. Vice President for Academic Affairs...
Report on. Office of the Superintendent of Financial Institutions. Corporate Services Sector Human Resources Payroll. April 2010
Report on Office of the Superintendent of Financial Institutions Corporate Services Sector Human Resources Payroll April 2010 Table of Contents 1. Background... 3 2. Audit Objectives, Scope and Approach...
Virginia Commonwealth University School of Medicine Information Security Standard
Virginia Commonwealth University School of Medicine Information Security Standard Title: Scope: Business Continuity Management Standard for IT Systems This standard is applicable to all VCU School of Medicine
Virginia Commonwealth University Information Security Standard
Virginia Commonwealth University Information Security Standard Title: Scope: Data Classification Standard This document provides the classification requirements for all data generated, processed, stored,
Corbin Del Carlo Director, National Leader PCI Services. October 5, 2015
PCI compliance: v3.1 Key Considerations Corbin Del Carlo Director, National Leader PCI Services October 5, 2015 Today s Presenter Corbin Del Carlo QSA, PA QSA Director, National Leader PCI Services Practice