Business relationship risk assessment related to the United States Department of the Treasury, Office of Foreign Assets Control

Transcription

1 Business relationship risk assessment related to the United States Department of the Treasury, Office of Foreign Assets Control Process document (for a Company that doesn t have a standard automated OFAC system in place) Approvals: XXXXX XXXXX

2 Contents Document Overview... 3 Purpose... 3 Process Document Scope... 3 Process Design... 4 Overview... 4 Step 1: New contact assessment... 4 Step 2: Assessment of existing organizations and individuals... 5 Step 3: On-going assessments Step 4: Concluding comments Page 2 of 27

3 Document Overview Purpose: In an effort to remain compliant with United States federal laws and regulations, the following are a sample series of procedures that relate to the monitoring of US government identified restricted bodies so that the Company does not conduct business transactions with these organizations, groups, or individuals. The United States Department of the Treasury has established a set of policies that must be followed when making payments to suppliers, organizations, and individuals so that funds are not made accessible to targeted foreign countries and regimes, known terrorists, narcotics traffickers, or other restricted groups. Regardless of the actual business location, these laws are enforceable against all persons and companies who are deemed to be a US individual or entity, as well as those who are currently residents of the US regardless of citizenship status. Under the direction of the Treasury Department, the Office of Foreign Assets Control (OFAC) oversees and manages economic sanctioning of identified countries or groups of individuals via the blocking of assets and/or through trade restrictions. Additionally, the OFAC has created an on-line listing of Specially Designated Nationals, (SDN) which is a complete database of restricted entities and individuals known to the US Treasury Department. This listing should be used as the resource for validating that the Company is not conducting business activities with listed bodies. While the OFAC actually does allow organizations to conduct business with any sanctioned individuals, groups, or organizations, there are steps that must be taken in order to obtain a general license which authorizes transactions within certain categories and with these bodies. While this option is available to any company or individual through the OFAC s transaction application process, it is up to the Company to determine whether or not it will obtain any special exceptions if they identify a country, group, or individual on the SDN list. Rather, the Company will immediately cease all business activity with the identified country, group, or individual until such time that the sanctioned body no longer appears on the OFAC s Specially Designated Nationals listing. Process Document Scope: The scope of this document is to focus on the detailed activities that are completed within the relevant department as well as at the Company -wide level as it relates to testing an entity s status in relation to the Office of Foreign Asset Control s SDN listing. Entities and activities that are addressed within this document include: Suppliers: goods and services, pre-contract assessments and banking institutions Employees: operations and faculty, full-time, part-time, temporary, adjunct, etc. Students: full-time, part-time, transfer, class audit, etc. Expense reporting and P-Card transactions Awards, gifts, giveaways, prizes, donations, etc. Licensure and certifications Although the process of assessing and tracking an SDN identified body s status appears to be complex on the surface, there are three steps that the Company should manage in order to monitor compliance with the laws of the United States Treasury Department. These steps are identified as follows: Assessment of new entities Assessment of existing entities On-going assessment of entities Page 3 of 27

4 Additionally, there are processes such as the Requisition and Purchase Order process, the Accounts Payable payment process, employee offer letter process, and so on that will be affected if the assessment and testing findings generate a positive hit on the OFAC SDN listing. However, the impact related to these specific processes will not be addressed within this document. Process Design Overview The purpose of this process document is to outline activities that aide the Company in complying with the United State s Federal Government regulation to assess and avert the risk of conducting business with known bodies that are identified on the US Department of Treasury, OFAC, Specially Designated Nationals (SDN) list. By following the procedures below, the Company will be able to identify potential issues with existing and/or new bodies prior to conducting business transactions with these organizations or individuals. While this procedure may not be a fool-proof method to identify and avoid these risks, the documented procedures are intended to cast a large blanket across each of the listed groups in an effort to identify the majority of possible issues when encountered. Since this process is also meant to deal with individuals who are obviously not forthcoming, it is possible that the the Company may not be able to identify each occurrence of risk due to a lack of information being provided by the sanctioned body in an effort to avoid detection, timing differences between the Company s assessment and the OFAC SDN list updates and naming variances between our records and those of the Federal Government. As mentioned within the scope and approach section above, each of the steps mentioned on the following pages will be outlined to include activity details regarding each processing step. The goal of this document is to provide sufficient information surrounding the process which will allow the reader to manage the process from start to finish if necessary. As with any document of this nature, not every step will be outlined in extensive detail and in some cases may assume the reader s level of understanding of the software being used and Company policies. Page 4 of 27

5 Step 1: New contact assessment Throughout the year additions of new vendors, employees, contracts, etc. are not uncommon due to the need to purchase products and services or to replace and add new staff members to the Company s employment roles. In the event that a new contact needs to be added to an International campus a quick assessment and search of the SDN database should occur so that the Company can determine the contact s status in order to gain comfort to transact business activities with the Company. Prior to moving forward with any supplier, employee candidate, or prospective student, the International Campus user should first perform a quick search of the OFAC Excluded Parties List System in order to validate that the company or individual is not identified as a sanctioned body. By doing so, the Company will potentially eliminate future issues which could preclude business transactions from occurring. Also, the user will reduce and eliminate any additional time spent working with OFAC identified entities that will ultimately be excluded from the Company s systems as a result of being listed by OFAC. Within the paragraphs that follow there will be references to Company users. These users are Company - designated and would be responsible for the sample transactions/processes in the table below. Transactions / processes that are covered by the following outline include: Transaction / Process Requests for Proposal Requests for Information Requests for Quotes Development and signing of Purchase Contracts Development and signing of Service Contracts Scheduling of employment candidate interviews Development and signing of employment offer letters Processing of employee name or employee banking information changes Processing of supplier name or supplier banking information changes Processing of student name or student banking information changes Distribution of Company awards; Honorary degree, tuition credits, etc. Distribution of Company gifts; Company gear, prizes, etc. Completion of supplier Licensed Vendor applications Page 5 of 27

6 If purchasing and employment decisions are not managed within a central location, this step may require any user contemplating a purchase or employment offer to access the following OFAC EPLS site prior to making any decision to proceed: Once the user has arrived at this web destination they will use the site s search functionality to access the EPLS listing. Although the user may not have complete supplier or employee information they should be able to enter a reasonable amount of data within the EPLS search system in order to make a reasonable determination that will allow them to proceed with their desired business transaction. This exercise is simply a measure to avoid potential future issues with suppliers or employees and is used to reduce the time spent to work with entities that ultimately appear on the OFAC listing. In most cases the Excluded Parties List System user will utilize the current exclusions search area located on the lefthand portion of the EPLS site as shown above. By choosing this option the user will have the ability to enter known information about the supplier or individual that had been made available to the user. The user should simply select the search option and enter the appropriate name as well as any additional information that is known about the entity that can be used on the search criteria form. There will be a disclaimer screen that the user must acknowledge prior to proceeding to the search forms which simply indicates that any users of the EPLS system should be cautious when using the system and not to assume that a hit has occurred until they have validated the information with the specific barring agency identified on the supplier record. Page 6 of 27

7 Once the EPLS user has gained access to the search items screen it is fairly self-explanatory as to how to use the search form. Additionally, there are fields that contain predetermined values which can be used rather than self-entry of information. Within these fields the user simply selects a value from the list for use in the data query field. The examples below show a query on the name Osama Bin Ladin and the corresponding OFAC system results: Please note that the example entry above used the Partial Name field to search the database. By using this field the search engine will return all instances of a match that contain any portion of the name entered within the Partial Name field. By using this field the user will generate better odds of finding a hit during the initial process of searching the database. As shown below, the EPLS system found a variety of records and returned the entire list of items that had a potential match to the searched name. At this point the EPLS user would review the SDN listing (if any) and determine if the supplier or employee is cleared for future business activities or if additional questions need to be answered prior to conducting any business activities with the new or modified contact. If it is determined that the supplier or employee candidate or student is not identified within the EPLS database the user should proceed to the following steps. Suppliers: With anticipation of an approved supplier the user should create a request to purchase goods and services in conjunction with the Company s standard business process. During this process they will identify a supplier of the products or services being purchased. If it is determined that the vendor is not part of the existing Oracle supplier database, the user should complete paperwork/procedures to have the supplier approved for inclusion in the Oracle supplier database. Page 7 of 27

8 In addition, the user should also complete additional paperwork/procedures to capture data regarding the banking information of the vendor so that EFT payments can be processed via the Oracle Accounts Payable application.. It is at this point that the supplier should be fully tested for inclusion on the SDN listing of the OFAC system since more extensive information about the supplier will be known at this time. The user may then open the EPLS Excluded Parties database. Once the user is able to access the EPLS site they will navigate to the search section of the site which can be found in either two locations as highlighted in yellow below: In most cases the user will use the current exclusions search area located on the left-hand portion of the EPLS site as shown above. By choosing this option the user will have the ability to enter information about the supplier based upon the data received during the new supplier process. The user should simply select the search option and enter the vendor s name as well as any additional information that is known about the supplier that can be entered on the search criteria form. Once again, there will be a disclaimer screen that the user must acknowledge prior to proceeding to the search forms. Additionally, there are fields that contain predetermined values which can be used as mentioned above. Within these fields the user simply selects a value from the list for use in the data query if necessary or convenient. The examples below show a slight modification to the previous query on the name Osama Bin Ladin. In this example the user entered the information within the Exact Name field as identified on the New Supplier forms as a first test of searching the database. Page 8 of 27

9 However, as shown below, the system did not recognize this supplier as an excluded party. Therefore, if the EPLS user stopped at this point they could potentially grant approval to conduct business with a known OFAC sanctioned body. Page 9 of 27

10 In order to avert this occurrence, the user would attempt a second search of the supplier name by using the Partial Name field option. In this event the system could potentially identify a number of different entities of which the user would need to evaluate each occurrence in order to determine if a hit has occurred. * - for more detailed information on using the exact name and partial name fields all users of the search site can click on the Search Help link located directly below the Partial Name search field on the website. By using the Partial Name search option in the example above the EPLS system found a variety of matching records and returned the entire list of items that had a potential match as shown below. At this point the user would review the listed entities (if any) and determine if the vendor can be created or if additional questions need to be addressed. If it is determined that the vendor on the SDN list is the same vendor as that being requested for Oracle entry, the user should reject the entry for this vendor and should send copies of the forms back to the requesting user with a brief explanation as to why the request was denied. If the vendor has already been established within Oracle and is being modified the same search and validation process should occur. If the vendor appears on the SDN listing the user should again deny the request and return copies of the paperwork back to the requesting user. However, in this case the user will also need to place the Oracle vendor into an Inactive status so that no future payments can be processed to the vendor. They will continue to leave the vendor on hold until the status of the vendor can be determined in relation to being restricted via the government records. Remember, both the vendor name and vendor banking data need to be assessed in order to comply with this validation process since the banking institution could also be considered a known sanctioned body while the vendor may not be listed on OFAC s SDN database. In either event, listed or not, the user should print the results of the EPLS search and will attach the printed results to the vendor paperwork (or equivalent Company procedure). If the supplier is not found within the EPLS database the report will indicate this search result and will show the name that was used to search the EPLS system. If the user does generate a hit against the database, the EPLS report will provide more detailed information regarding the supplier. Examples of each report are shown below: Page 10 of 27

11 In all cases, if the EPLS user identifies a supplier or banking institution that is included within the EPLS database they should immediately contact the responsible/critical parties at the Company per established procedures. Processes to test employee candidates and students are handled no differently than those steps outlined above. The area making a decision to employ a new individual or to accept a new student into the Company will need to follow the same steps above in order to confirm that the individual is not identified as an excluded body according to the OFAC database. Additionally, any search results should be attached to all preliminary paperwork related to the employee candidate or student and the proper Company individuals should be notified as quickly as possible. Page 11 of 27

12 Other assessments: Purchasing-card(P-Card) transactions: The decision to make P-card purchases is generally not guided by the processes outlined above to conform to OFAC guidelines, but rather it is the decision of the individual making the purchase as the holder of the Company charge card. In these instances purchasing decisions are made at the discretion of the buyer and without direct input from the Procurement Services department (or equivalent) of the Company. Therefore, the Company makes the OFAC rules known to all employees who have the ability to conduct Company business and to pay suppliers for goods and services via the P-card process. Additionally, these individuals are instructed to view the OFAC SDN listing when they believe they may need to gather additional confirmation that a supplier is not listed as a sanctioned body. Ultimately the employee is viewed as the individual who is responsible for this process of OFAC compliance since they have the ability to make a purchasing decision at will rather than processing transactions through the Company s normal purchasing process. The Company does however assist employees with rules and requirements as outlined on OFAC s website whenever necessary and requested. Additionally, the banking institution that manages the Company purchasing card program has a responsibility to test for sanctioned bodies when transactions flow through the bank s payment systems. In the event that the bank does encounter a sanctioned body, they should immediately notify the Company s Accounting department (or equivalent) who should work with appropriate parties to resolve the issue. Gifts, Awards, Tuition, Honorary Degrees, etc: Occasionally in an effort to recognize exceptional efforts of students, faculty, external parties, and staff members, the Company will present gifts and awards to deserving individuals or entities. While these awards may be nominal from a financial perspective they still represent a business transaction non-the-less. In order to validate that the Company is conducting business with appropriate individuals and entities, the process of testing gift recipients against the OFAC SDN listing is an essential component of compliance. In essence, the individual or department that is disbursing the gift or award is responsible for validating that the gift recipient is a non-sanctioned organization or individual. The OFAC system user should follow the same steps as outlined above for testing of new or modified vendor information and will utilize the EPLS search application in the same fashion as outlined above. Additionally, the EPLS system user should print the results of the OFAC search and attach the report results to the gift / award authorization paperwork (or equivalent). Page 12 of 27

13 Final comments: Although not specific to any one group of parties to be tested; vendors, employees, banks, etc., any OFAC search that occurs as outlined above should also include a search of the individual s country affiliate since the OFAC has identified specific countries that are sanctioned against business dealings with the United States. Therefore, while a company or individual may not be a listed entity there is a reasonable possibility that the country where the entity conducts business may be restricted. These search results should also be attached to the tested entity s paperwork (or equivalent) in order to validate that all forms of testing have occurred. Also, the processes above address only a portion of the activities outlined at the onset of this testing section; however, all of the following sample activities will require the individual involved in the process to conduct similar search activities and reporting requirements prior to conducting any business transactions. Transaction / Process Requests for Proposal Requests for Information Requests for Quotes Development and signing of Purchase Contracts Development and signing of Service Contracts Scheduling of employment candidate interviews Development and signing of employment offer letters Processing of employee name or employee banking information changes Processing of supplier name or supplier banking information changes Processing of student name or student banking information changes Distribution of Company awards; Honorary degree, tuition credits, etc. Distribution of Company gifts; Company gear, prizes, etc. Completion of supplier Licensed Vendor applications Page 13 of 27

14 Step 2: Assessment of existing organizations and individuals The first step in the process of managing the Company s risk level will be a thorough review of the Oracle Supplier database, the Oracle supplier banking institution directory for suppliers, the employee master listing, the student directory, and the contract listing in relation to the OFAC SDN listing. While each of these groups has a large number of entries that relate to Company -wide activities, this document and process will only relate to testing of bodies that conduct business with the International Programs. Therefore, references to suppliers, employees, banks, etc. as mentioned within the context of this document should be viewed as organizations or individuals with potential business activities related to the International Programs and no other segment of the Company. This review will take place at least once a year in order to confirm that all of these organizations and individuals have the most current information and have been compared with the Federal Government s database at least one time during the year. This process will occur prior to the start of the new calendar year so that the Company will start each calendar year with a clean database related to each group. Suppliers and banking institutions assessment: In order to validate the Oracle supplier and supplier banking institution database there are two items that will be needed in order to conduct the SDN assessment. First, the user will need to obtain a current supplier and banking institution directory from the Oracle Purchasing and Accounts Payable databases in excel format. The second component of this process focuses on the data capture of a current SDN listing from the OFAC website at the following address: This page will allow the user to view existing PDF and text reports of all identified suppliers. Additionally, there is a section of this site that allows users to obtain files for use in managing compliance. These files are created by OFAC in a variety of formats ranging from ASCII and Fixed-Width to CSV and XML formats. For the purposes of the Company s assessment, the XML file format should be used since it migrates to Microsoft Excel without much user interaction. The user will simply log on to the Department of the Treasury website via the link above and navigate to the center section of the site which is entitled Delimited and XML Versions of the SDN list. Within this section are links to files that can be exported from the Treasury s website for use by companies and individuals. The user should select the link to allow for the download of all file types that will function with the Company s operating system. Page 14 of 27

15 Although this title does not indicate that the XML file type is included, the Treasury Department s link does in fact contain an XML file format for use within Microsoft Excel. There are an additional 32 files contained within this download process which allows for all files to be saved to the user s personal (or preferred) directory for possible use at a later time if needed. Use of the following link will assist in navigating to the proper download process steps: ASCII Delimited, Fixed-Width and CSV data files in a Windows operating system 32 bit archive Page 15 of 27

16 At the time the system user clicks the above link or enters this address within their Internet Explorer application, they will be directed to a preliminary download screen as shown below: The user will click the Save File button which will prompt the system to move to the download screen as shown: With the download process ready to start, the user will double-click the identified executable file: sdallw32(x).exe, in order to activate the transfer of data. One last message will appear which will indicate to the user that they are about to begin the download process. When the OK button is selected, the system will prompt the user to identify a location to store the files that are about to be downloaded. This is the point where the system user will identify a shared directory or a personal directory for the US Treasury Department to store the files during the download process. Page 16 of 27

17 At the time the directory has been identified, the system user will click the Unzip button and the files will be sent to the designated directory location specified. Also, upon completion of the download routine, the system will indicate that the files have been transferred successfully at which time the self-extractor tool can be closed. In order to open the newly downloaded XML file for use in comparison to Oracle s supplier database, the user will open the Excel application and then open the directory that contains the downloaded Treasury Department files. The user will also need to look at all file types since the download process will not convert any of the Treasury files to an Excel format. With all files listed the user will search for the XML document that has a title of SDN. Upon identifying this file, the user will select the file for opening and will be prompted with another system message as shown below: The user will select OK which will cause the system to generate an additional message regarding the file. If this is the first time using the file, the system will not have a format to use for the file; however, it can create a properly formatted file by selecting the OK button when the notification message below is encountered. At the time the OK button is selected, the Excel application will modify the file into a format that is useable within Excel. This file will also include auto-filters for all columns of data within the spreadsheet for ease of use since the file has a large amount of data. This process may take a few minutes to complete depending upon the size of the data file captured from the Treasury s website. With both oracle purchasing and accounts payable databases files and the SDN data loaded into Excel, the user will merge the data files together using the Excel copy / paste functionality. The user should create two new tabs ( Suppliers and Banks ) in the SDN file and copy the data from the appropriate data warehouse files and place it within the new tabs of the SDN file. At this point, the user should sort the warehouse data by alphabetic order based upon the vendor or bank name. Once this is accomplished the user will insert vlook-ups for vendor name, address line one or bank name and use the SDN data as part of the Excel look-up function. Upon completion of this exercise, the user will add a third vlook-up to compare the warehouse vendor name with the SDN AKA name column. If a match is found, the system should indicate such via the vlook-up columns that were added to the spreadsheet. However, if no match is found the system will simply return a value of N/A. Page 17 of 27

18 Since this process is quite straightforward to complete, it should be run on an annual basis and will help to identify suppliers and banking institutions that may require further investigation as to their business dealings prior to making any payments to them. This may also identify vendors or banks who have received payments from the Company in the past when they were not an identified OFAC entity but who have been added to the list since the Company s last payment transaction. This information would be helpful as a red-flag indicator in order to avoid future business dealings with the identified entity. At the conclusion of the process of validating the Oracle supplier and bank database, the user should save the Excel file containing the SDN list, Oracle supplier and Oracle banking data. This is necessary so that the results of each annual validation process can be referenced in the future if needed. Additionally, the user should generate a onepage overview and status report indicating the findings of this assessment process. This report will contain a listing of those entities identified as non-compliant or an indication that no entities were identified as a result of this testing exercise. An additional step will need to be completed if the assessment process identifies a supplier or bank that is a part of the SDN listing. At the time the user identifies a hit, they will immediately notify the responsible/critical parties per established procedures. At that point the parties should work together to eliminate the possibility of the Company conducting any future business transactions with the identified entity. Page 18 of 27

19 Employee master list assessment: The process of comparing the Company employee master listing to the OFAC SDN listing is very similar in process steps as to that of the supplier database comparison process as outlined above and will be conducted by the same user who is responsible for completing the supplier comparison. The first step in the process will be to work with the Company s Human Resources group (or equivalent) in order to obtain a complete listing of all employees as of the assessment date. This listing will need to be generated so that the employee name format conforms to the SDN name format. In other words, the employee name within the file will need to be generated as first name space last name. No commas or special characters will be needed to separate the names, simply a space. If the file is not captured in this format the automated comparison process within Excel will not work properly since the data contained in the OFAC listing and the Company employee listing will not be comparable as to their format. Once the employee listing has been obtained from the Human Resources department, the data should be loaded into the same SDN listing file that contains the supplier and banking information. The employee data should be placed into a new tab that will be added to the Excel worksheet and will be named Empl data. With this data loaded into the Excel file, the user will create an Excel vlook-up to compare the SDN name to the employee name in a manner similar to that created for the supplier and banking directory. This process should be conducted on an annual basis in conjunction with the supplier assessment and should be documented as outlined on the pages above. Page 19 of 27

20 Student directory assessment: Although probable that the Company does not normally pay students or prospective students for supplies, services or employment related activities, there is a possibility that students could receive scholarships, work-study program opportunities, access to confidential Company information as part of assisting a professor, and other non-monetary items that could potentially place the Company at risk for non-compliance with OFAC regulations. In an effort to mitigate this issue, the user will work with the Student Enrollment group (or equivalent) in order to obtain a complete student directory which will be used to compare against the OFAC SDN listing in a manner similar to that of suppliers and employees. Once the list is received from Enrollment Services, the user should perform a similar function within Excel in order to format the data in a manner that is useable to compare with the SDN listing data. The student information should also be placed into the SDN comparison file that includes supplier and employee data and will be resident within a separate tab entitled Student data. With the data contained in the SDN comparison file the user will validate that the format of the student information is useable to compare against the SDN listing data. In other words, the student data should be in the format of first name space last name with no commas or special characters. Once the data has been assessed the user will create a vlook-up to compare the student data with the SDN listing data for all students contained within the list. After reviewing the results of the comparison the user will document the results of this activity as outlined on pages above in relation to the supplier comparison process. Similar to the supplier process, an additional step will need to be completed if the assessment process identifies a student that appears to be a part of the SDN listing. At the time the user identifies a hit, they will immediately notify the responsible/critical parties per established procedures. Once this notification is received, they should immediately contact the Director, Enrollment Services (or equivalent) to inform them of the issue with the student or applicant. At that point, the individuals will work together to eliminate the possibility of the Company conducting any future business transactions with the identified student. Contracts assessment: Although the Company should have a process to test suppliers for inclusion on the OFAC SDN listing, this process does not completely eliminate the possibility that the Company has become engaged and or obligated to conduct business with a known sanctioned body. The process of testing for SDN listings during the development of a contract is an essential component of keeping the Company s reputation with OFAC intact as well as to remain compliant with the laws for conducting business activities with sanctioned bodies. In order to complete this testing process on an annual basis, the user should obtain a listing of all contracts that relate to International campus activities. These contracts could range from housing and building maintenance, to travel and adjunct faculty services. In order to test this segment of the Company s business processes the user will need to first obtain a complete listing of contracts from the Company s General Counsel department (or equivalent). This listing can either be in an Excel, Word, or text format for use within the Excel SDN comparison file. Similar to the processes above for data validation, the user should review and confirm that the contract listing is formatted in a manner that will allow for automated matching within the Excel application. Once the contract data has been received and evaluated, the user should insert a new tab into the SDN comparison file and will then copy the contract data into this new tab. At the time all the data has been loaded into the Excel file the user will create a vlook-up to compare the contract data and SDN listings automatically. As with the processes outlined above, the user will follow the appropriate steps to notify responsible/critical individuals when a match is encountered as well as to complete the proper established procedures to validate that an audit of this data has occurred. Page 20 of 27

21 Other areas of concern: P-card transactions: Normally the process of generating P-card purchases is quite straightforward as the holder of the Company P-card has the ability to make purchasing decisions at their discretion and without direct input from the Procurement Services department (or equivalent). In these instances the decision to make a purchase is not guided by the processes outlined above to conform to OFAC guidelines, but rather it is the decision of the individual making the purchase along with the banking institution s responsibility to manage the process of OFAC testing when P-card transactions are encountered. In these instances the Company should occasionally run a series of tests on an annual basis to compare P-card transaction supplier activity against the OFAC SDN sanctioned body listing to confirm that purchases were not made with sanctioned individuals or suppliers. As with the other Company assessment activities outlined above, the user who is conducting this audit should log the group of P-card transactions that were tested along with the findings related to these purchases. This listing should be reviewed by responsible/critical parties for validation of the process and findings and should be used in an effort to comply with the OFAC rules for conducting business with sanctioned bodies. Additionally, the banking institution responsible for managing the Company s P-card program is also responsible for prohibiting and voiding any potential payment to an OFAC sanctioned body. This banking process will not be addressed within this document other than to note that the banking institution also has a responsibility to conduct OFAC testing and to notify the Company when a hit is encountered. If it is determined that an individual did in fact make a purchase with a known or listed entity, the user should immediately notify the responsible/critical parties who should work with the cardholder who made the purchase along with the Procurement Services and Payables departments to notify the banking institution who is responsible for managing the Company s Purchasing card program. Page 21 of 27

22 Gifts / Prizes: Occasionally the Company will award groups or individuals with gifts or prizes as part of a ceremony or activity related to Company promotions. Examples of these events would include graduation presentation of honorary degree, awarding prizes to winners of selected activities, etc. Additionally, the Company may be the recipient of gifts or awards due to participation in events that aide in the promotion of the Company s reputation. Therefore, it is necessary for the respective department to validate that any receipt or distribution of gifts and awards are not linked with an OFAC sanctioned body. While these activities may be small in comparison to the number of purchases or payments made to supplier and staff members, the importance of conforming to the OFAC rules of conducting business with known sanctioned bodies is no less important. Therefore on an annual basis the user may conduct an audit of the activities related to these giveaways and receipt of gifts. Final comments: Although the vlook-up process of testing should identify most all occurrences of matching data, there is always a possibility that the OFAC records and Company records do not use the same spelling of organizations or individuals. As a result, the user should conduct a manual assessment of the data through simple list sorting functions within Excel as well as manual observation and comparison of the OFAC and Company data. A simple side-by-side comparison of the OFAC and Company sorted data will aide in validating that sanctioned bodies were not missed as part of the vlook-up process. However, if a sanctioned body is identified, the user of the data will notify the responsible/critical parties of this issue immediately via the same process outlined above. Page 22 of 27

23 Step 3: On-Going Assessments Since criminal acts are not scheduled and do not fit into a pattern of recurring activity the nature of the SDN list is one that is very dynamic and can be updated daily if necessary. Therefore, the Company has a method for keeping track of the ongoing updates to the SDN list. In essence the user will access the OFAC main page and will look to the section regarding the latest SDN updates, as shown below: Page 23 of 27

24 The user should also utilize a tracking tool to determine the latest file downloaded in order to determine if the OFAC file is new or has already been captured by the Company and will use this tool to decide if they should download the latest OFAC file. If they choose to download the OFAC file they should note this in the tracking tool. The next step will be to capture the OFAC file by clicking the date indicated on the OFAC website. The OFAC system user will open a screen for use in downloading files to the user s system or to the network. The user will also have the ability to modify the type of file that will be downloaded of which Microsoft Word appears to be the easiest format to use. Other formats can be used based upon the user s individual preferences. Page 24 of 27

25 Once the file is downloaded the user will save the file with the chosen file naming convention format. The user should also use this file to compare against the Oracle vendor file in order to confirm that none of the individuals or companies listed is contained within the Company supplier database. This process will require the user to either use the data warehouse query in order to obtain a current Oracle supplier listing, or the user can access the Oracle supplier table via the Oracle Supplier inquiry form contained within the Accounts Payable or Purchasing modules. If the OFAC update list is somewhat small, it is easiest to use the Oracle inquiry form since the user can copy SDN names directly from the report and paste them into the supplier name field as shown below. In this example the first identified SDN name was copied and placed into the Oracle inquiry form. However, the supplier name was not found within the Oracle database as noted at the bottom left side of the Oracle inquiry form. Page 25 of 27

26 In this example the result is positive since this supplier name is not resident within the Oracle supplier table. The user would continue this process for each name listed on the SDN update report until all names included on the update report have been tested. The user should also print the OFAC update report and check each name as they validate that the supplier is not resident within the Company Oracle database. At the conclusion of this exercise the user should next open the Oracle HR module in order to validate that none of the entities listed on the OFAC report are resident within the employee database. Additionally, the user should validate that none of the OFAC entities is a student of the University with the assistance of the Enrollment Services department. In all cases above, the user will check off each name on the list to confirm that all three database areas have been validated. The user should also sign and date the report and will forward the signed report to the responsible/critical parties per established procedures. The user should file the signed report for future reference if needed. If the user encounters a situation where the vendor name does appear within the Oracle inquiry form as a supplier, employee, or student they should immediately notify the responsible/critical parties so that appropriate action can be taken to inactivate this entity from the Company databases and eliminate any possible future activities with the entity until further investigation can be completed. Screen shots (as shown above) of all Oracle or System search test results should also be printed and attached to the SDN update report in order to validate that a test has occurred and that the system was unable to locate a record with the same search attributes. Once all reports have been signed (or subjected to an equivalent procedure) they should be filed within the respective area for validation of testing and for future reference if needed. Page 26 of 27

27 Step 4: Concluding comments: As noted, this document addresses the processes that are in place relative to OFAC testing of organizations and individuals who do/potentially conduct business with International Programs. However, there may also be additional testing measures managed within other areas of the Company that serve as another level of risk management layer to the processes outlined within this document. These processes are likely managed not only by internal Company personnel such as within the Purchasing, Finance, and Accounts Payable areas, but also functioning at external non- Company locations, primary at the Company s banking institutions. Page 27 of 27