Internal Audit Annual Report Fiscal Year 2016

Transcription

1 Internal Audit Annual Report Fiscal Year 2016 Office of Internal Audit 800 West Campbell Rd., SPN 32 Richardson, TX

2 October 24, 2015 Dr. Richard Benson, President Ms. Lisa Choate, Chair of the Institutional Audit Committee: We are pleased to submit the annual report of the Office of Internal Audit for the fiscal year ended August 31, This report is required by the Texas Internal Auditing Act and provides information on the assurance services, consulting services, and other activities of the internal audit function. During fiscal year 2016, we issued 32 reports related to audits, consulting reviews, and investigations. We believe the work of our office has enhanced university operations and provided value to management with recommendations relating to governance, risk management, and control processes at the University of Texas at Dallas. If you have any questions about the contents of this report, please do not hesitate to contact me. Respectfully submitted, Toni Stephens, CPA, CIA, CRMA Institutional Chief Audit Executive, UT System at UT Dallas Report Distribution: State Auditor s Office Governor s Office of Budget, Planning, and Policy Legislative Budget Board Sunset Advisory Commission Members of the UT Dallas Audit Committee UT System Audit Office 2

3 TABLE OF CONTENTS Purpose of the Internal Audit Annual Report... 4 I. Compliance with the Texas Government Code Section : Posting the Internal Audit Plan, Internal Audit Annual Report, and Other Audit Information On Internet Web Site... 5 II. Internal Audit Plan for Fiscal Year III. Consulting Services and Non-Audit Services... 8 IV. External Quality Assurance Review... 9 V. Internal Audit Plan for Fiscal Year Risk Assessment Methodology VI. External Audit Services Procured in Fiscal Year VII. Reporting Suspected Fraud and Abuse VIII. Office of Internal Audit Internal Audit Staff Organization Chart

4 PURPOSE OF THE INTERNAL AUDIT ANNUAL REPORT The purpose of this annual report is to provide information on the assurance services, consulting services, and other activities of the internal audit function. In addition, the annual internal audit report assists oversight agencies in their planning and coordination efforts. The Texas Internal Auditing Act, Texas Government Code, Chapter 2102, requires that an annual report on internal audit activity be filed by November 1st of each year and submitted to the Governor, the Legislative Budget Board, the Sunset Advisory Commission, the State Auditor s Office (SAO), and the entities governing boards and chief executives. The SAO prescribes the form and content of the report. The annual report was prepared using the guidelines provided by the Texas State Auditor s Office. In addition to the minimum requirements, we also included other information we felt was important to the internal audit operations during fiscal year (FY) Additional information regarding the UT Dallas Office of Internal Audit can be found at the following website: 4

5 I. COMPLIANCE WITH THE TEXAS GOVERNMENT CODE SECTION : POSTING THE INTERNAL AUDIT PLAN, INTERNAL AUDIT ANNUAL REPORT, AND OTHER AUDIT INFORMATION ON INTERNET WEB SITE In accordance with Texas Government Code, Section , the UT Dallas Office of Internal Audit has posted its Fiscal Year 2016 Internal Audit Annual Report and the approved Fiscal Year 2017 Audit Plan at the following web site: II. INTERNAL AUDIT PLAN FOR FISCAL YEAR 2016 The UT Dallas 2016 Audit Plan outlines the internal audit activities to be performed by Internal Audit during FY 2016 in accordance with responsibilities established by the UT System, the Texas Internal Auditing Act, the Institute of Internal Auditors International Standards for the Professional Practice of Internal Auditing, and Generally Accepted Government Auditing Standards, consistent with the UT Dallas Audit Charter. The plan is prepared using a risk-based approach to ensure that areas and activities specific to UT Dallas with the greatest risk are identified for consideration to be audited. The information on the following pages contains the Internal Audit Plan for FY 2016, including the status of the plan at October 24, Audit that were postponed or deleted were approved by the UT Dallas Institutional Internal Audit Committee. Financial Assistance to Deloitte - FY 15 Fieldwork Assistance to Deloitte - FY 16 Interim Financial Statement Certifications (UTS 142) R1610 January 5, 2016 Financial Statement Certifications 5 assistance assistance Consulting Review: Data Warehouse Reporting Postponed to FY 2017 Reserve for FY 15 carryforward audits: Journal Entries/IDT Process R1603 October 27, 2015 Journal Entry and Interdepartmental Transfer Process Receivables R1601 September 8, 2015 Receivables Operational School of ATEC (School of Arts, Technology, & Emerging Communication) Postponed to FY 2017 Honors College Postponed to FY 2017 Executive Travel and Entertainment R1614 January 25, 2016 Executive Travel and Entertainment Entertainment Audit FY 2016 Audit Plan Engagements Naveen Jindal School of Management Report # assistance. To be issued October 2016 Academic Advising In process as of October 2016 Health Center Postponed to FY 2017 Technology Commercialization In process as of October 2016 One Card In process as of October 2016 Outside Contractors In process as of October 2016 Gifts, including Raiser's Edge In process as of October 2016 Purchasing R1624 August 17, 2016 Purchasing and Contracting Compliance Research Postponed to FY 2017 Hiring & Compensation R1621 July 14, 2016 Hiring and Compensation Process Faculty Start-ups Postponed to FY 2017 Budget Process R1623 August 17, 2016 Budget Process Report Date Report Title Comments

6 FY 2016 Audit Plan Engagements Reserve for FY 15 carryforward audits: Cash Management R1606 December 8, 2015 Cash Management and Treasury Function Career Center R1611 January 5, 2016 Career Center Policy and Procedures Governance January 22, 2016 Policy Management Process Memo Scholarships R1617 February 22, 2016 Scholarships School of Engineering and Computer Science R1618 February 26, 2016 School of Engineering and Computer Science Student Housing R1622 July 25, 2016 Student Housing Meal Plans R1612 January 8, 2016 Dining Meal Plans Tuition & Fees R1604 December 3, 2015 Tuition & Fees Compliance Confucius Institute R1701 September 8, 2016 Confucius Institute Lena Callier Trust R1616 January 28, 2016 Lena Callier Trust OMB Uniform Guidance March 29, 2016 OMB Uniform Guidance Implementation Memo Benefits Proportionality Funding R1619 March 7, 2016 Benefits Proportionality by Fund External Audit Assistance Report # Report Date Report Title Comments Consulting Review - issued memo to the President Consulting Review - issued memo to Research Office assistance Minors on Campus International Travel (Education Abroad) R1702 October 24, 2016 Education Abroad THECB Facilities Audit R1607 December 11, 2015 THECB Facilities Audit Reserve for FY 15 carryforward audits Contracts and Grants R1608 December 15, 2015 Contracts and Grants Export Controls R1602 September 9, 2015 Export Controls Financial Aid - Pell Grants R1615 January 25, 2016 Pell Grants Information Technology Networking Consulting: Financial Aid Data Analysis - Eligibility PCI (Payment Card Industry) Compliance R1620 May 26, 2016 PCI Compliance HIPAA Security Postponed to FY relying on Compliance Office assurance Deleted from plan due to outside vendor review. To be consulting review in FY Consulting memo to be issued October 2016 Deleted from plan due to outside vendor review. Consulting: Staffing Data Analysis Combined in audit of Hiring and Compensation, Report No Databases In process as of October 2016 consulting and IT Consulting and Participation participation on IT committees Unix Reserve for FY 15 carryforward audits TAC 202 R1605 December 3, 2015 TAC 202 Security Control Standards Management R1613 January 12, 2016 Business Continuity Planning Physical Access Controls Management R1609 January 5, 2016 Physical Access Controls UT Dallas Marketplace Follow Up. To be issued October Awaiting Management's Responses.. To be issued October Awaiting Management's Responses. Quarter 1 Quarter 2 Quarter 3 Quarter 4. Results reported to executive management and Audit Committee each quarter 6

7 Development - Operations FY 2017 Audit Plan August 26, 2016 Annual Internal Audit Plan Internal Audit Committee Internal Audit Annual Report October 22, 2015 Internal Audit Annual Report Participation on Institutional Committees Internal Quality Assurance and Improvement Program Reporting Requests Hotline Team Participation Department Manager Leadership Software Development and Maintenance Training Provided by Internal Audit to Other Departments Internal Audit Staff Meetings Development - Initiatives and Education Participation in System Initiatives Institutional Strategic or Quality Initiatives Participation in Professional Organizations/Associations Participation in Quality Assurance Reviews for Other Organizations Professional writing, publications, external presentations CPE Training CPE Travel Travel Non-CPE Related Reserve Investigations Special Requests FY 2016 Audit Plan Engagements Report # Report Date Report Title Comments six investigations various requests As required by the State Auditor s Office FY 2016 guidelines for submitting this report, the following audits are included in the above list: A compliance audit of Benefits Proportionality Funding (Report No. R1619) was completed on March 7, The audit resulted in no issues or significant recommendations. An audit required by the Texas Education Code, Section (h), as added by Senate Bill 20 (84 th Legislature), Purchasing and Contraction Compliance (Report No. R1624), was completed on August 17, Senate Bill 20 made several modifications and additions to Texas Government Code and the Texas Education Code (TEC) related to purchasing and contracting. Effective September 1, 2015, TEC requires that, The chief auditor of an institution of higher education shall annually assess whether the institution has adopted the rules and policies required by this section and shall submit a report of findings to the state auditor. Based on review of current institutional policy and the UT System Board of Regents Rules and Regulations, UT Dallas has generally adopted all of the rules and policies required by TEC Review and revision of institutional and System policy is an ongoing process. These rules and policies will continue to be assessed annually to ensure continued compliance with TEC

8 III. CONSULTING SERVICES AND NON-AUDIT SERVICES COMPLETED Report Date* Title of Report Objectives Observations, Results and Recommendations 9/15/15 Confidential Data Management Determine the adequacy of controls over confidential data at the institution. Improvement necessary to ensure that confidential data is being adequately protected. An audit has been planned to assess controls in FY 17. 1/22/16 Policy Management Process 3/29/16 OMB Uniform Guidance Implementation To review the policy management process, including policy writing, review, and publishing. Determine if UT Dallas has implemented OMB Uniform Guidance. *Consulting and non-audit services were not issued report numbers Based on the results of the review, although processes are in place for amending the HOP, they do not fully comply with certain requirements of UTDPP1056, Handbook of Operating Procedures (HOP) Amendment Approval Process. In addition, although the HOP is a responsibility of the President s Office, administrative resources have not been dedicated for HOP management, and limited information is communicated or available online for HOP Committee members and/or those requesting amendments to the HOP. Implementation is near completion, and full implementation is expected by September 1,

9 IV. EXTERNAL QUALITY ASSURANCE REVIEW An external quality assessment was performed during fiscal year Such reviews are required every three years by the Texas Internal Auditing Act and every five years by the Institute of Internal Auditors (IIA) International Standards for the Professional Practice of Internal Auditing (Standards). The results of the assessment are indicated below. All recommendations specific to UT Dallas Internal Audit have been implemented. 9

10 10

11 11

12 12

13 V. INTERNAL AUDIT PLAN FOR FISCAL YEAR 2017 The FY 2017 approved audit plan is shown on pages As required per the State Auditor s Office guidelines: Budgeted hours are included. There are no audits that address benefits proportionality, expenditure transfers, or limitations or restrictions in the General Appropriations Act. An audit of Campus Construction may include capital budget controls. A list of additional risks ranked as high on the risk assessment but are not included in the FY 2017 plan are included on pages A brief description of the risk assessment methodology is included on page

14 FY 2017 Audit Plan Engagements Original Budget Risk Based Audits Academic Hiring and Compensation 320 Campus Clinics 440 Campus Construction 400 Collaboration Tools 400 Confidential Data Management 360 Data Warehouse Reporting 360 Decentralized Computing 480 Disaster Recovery Process 200 Ethics 200 IT Governance 240 IT Incident Response Plan 240 Lab Safety 400 Property Management 360 Purchasing Process 360 Research Centers 500 Research Expenditures 300 Tax Compliance 360 Title IX 240 Travel and Reimbursements 440 Risk Based Audits Subtotal 6,600 Required Audits (Externally and Internally) Assistance to External Auditors - Financial Statement 150 Assistance to External Auditors - State or Federal 80 Assistance to UT System Auditors - Presidential Audit 80 Emergency Management/Preparedness 240 Executive Travel and Entertainment (UT System) 280 Financial Statement Certifications (UTS 142.1) 80 JAMP (UT System) 80 Lena Callier Trust (UT Dallas Trust Agreement) 80 Purchasing (Senate Bill 20) 20 Required Audits Subtotal 1,090 Consulting Projects Fraud Training Initiative 80 Logging Infrastructure 320 Monthly Financial Reporting 200 Change in Leadership Reviews 500 Reserve for Consulting Project Requests 250 Responding to Institutional Requests for Information and Advice 50 School and Division Reviews 600 Consulting Subtotal 2,000 14

15 FY 2017 Audit Plan Engagements Original Budget Investigations Reserve for Investigations 300 Investigations Subtotal 300 Follow Up Quarter 1 40 Quarter 2 40 Quarter 3 40 Quarter 4 40 Follow Up Subtotal 160 General Reserve Reserve for Special Requests 250 Reserve for FY 16 carryover audits 500 School of ATEC Honors College JSOM Academic Advising Technology Commercialization One Card Outside Contractors Gifts Faculty Startups EHS Governance Review Networking Consulting Databases General Reserve Subtotal 750 Development - Operations Executive Management and Leadership of the IA 500 Department External Quality Assurance Review 100 FY 2018 Audit Plan 100 Hotline Team Participation 20 Internal Audit Annual Report 16 Internal Audit Committee 120 Internal Audit Monthly Staff Meetings 250 Internal Quality Assurance and Improvement Plan 100 Maintenance and Implementation of Audit Software and 80 Technical Support Participation on UT Dallas Committees 100 Reporting Requests 50 Development - Operations Subtotal 1,436 15

16 FY 2017 Audit Plan Engagements Development - Initiatives and Education CPE Training 720 CPE Travel 300 Participation in Professional Organizations/Associations 100 Participation in Quality Assurance Reviews for Other Organizations Professional writing, publications, external presentations Original Budget UT Dallas Initiatives 80 UT Dallas SACSCOC Participation 40 UT System Academic CAE Weekly Meetings 50 UT System Initiatives 100 TeamMate Project 100 Development - Initiatives and Education Subtotal 1,720 Total Budgeted Hours 14,056 16

17 RISK ASSESSMENT METHODOLOGY The UT Dallas 2017 Audit Plan outlines the internal audit activities that will be performed by Internal Audit during FY 2016 in accordance with responsibilities established by the UT System, the Texas Internal Auditing Act, the Institute of Internal Auditors International Standards for the Professional Practice of Internal Auditing, and Generally Accepted Government Auditing Standards. The plan is prepared using a risk-based approach to ensure that areas and activities specific to UT Dallas with the greatest risk are identified for consideration to be audited. As part of the FY 2017 Audit Plan process, the UT System Audit Office risk assessment methodology was used. The goals for this common risk assessment approach were to start at the top with an awareness of critical initiatives and objectives to ensure the risks assessed were the most relevant. The assessment process was standardized by creating common terms and criteria, enabling trending of risk and System-wide comparisons. An emphasis was placed on collaboration with other functions that assess, handle, or manage risk. The risk assessment approach was based on a top-down process that included conversations and requests for input with risk collaborators, executives, and managers from the various operating areas on campus. The graph below depicts the institution risks. High UTD Institution Risks Property Management Governance Finance Probability Risk Management Auxiliary Services Academic Support University Relations Purchasing Public Service Student Services Enrollment Management Human Resources Information Technology University Development Instruction Research Facilities Management Low Impact High 17

18 The following is a list of additional areas ranked as a high risk that we have identified but not included in the fiscal year 2017 audit plan with and explanation of risk mitigations. Risk Area Risk Mitigation/Explanation Campus Growth Management THECB Facilities Audit peer review of space allocation and management performed FY 2016 Strategic Plan SACS/COCS Review planned for FY 2017; new President to address Enrollment Management Reviewed enrollment forecasting during FY 2016 audit of the Budget Process. Tuition and Fees Funding FY 2016 budget process audit conducted that included this area Minors on Campus Reliance on FY 2017 inspection of program by Office of Institutional Compliance. Will conduct audit in FY Contracts & Grants/Compliance with FY 2016 audit of Contracts and Grants Federal Regulations Financial Aid and Scholarships State Auditor s Office conducting a full scope audit of Financial Aid during FY 2017; FY 2016 audits of Scholarships and Pell Grants conducted Budgetary Risks FY 2016 audit of Budget Process Procurement Cards FY 2016 audit of One Cards in process Network Security Outside review planned by UT Dallas Office of Information Technology; consulting work by Internal Audit is planned as well Mobile Devices Outside review planned by UT Dallas Office of Information Technology; consulting work by Internal Audit is planned as well; UT System audit of mobile devices in FY 2016 PCI Compliance FY 2016 audit of PCI Compliance Research FY 2016 audit of Contracts and Grants Export Controls FY 2016 audit of Export Controls Campus Large Project Construction UT System contracts with firm to audit large construction projects Compliance Program Potential UT System-wide audit Policy Management and Governance FY 2016 consulting review of policy and procedure governance; UT System audit of new President Gifts and Endowments FY 2016 audit of Gifts; CAE participates in quarterly endowment compliance team meetings Global Economy Looked at enrollment forecasting during FY 2016 Budget Process audit Advising Process FY 2016 audit of Academic Advising 18

19 Risk Area Risk Mitigation/Explanation Hiring and Retention FY 2016 audit of Hiring and Compensation Duplicate Payments to Vendors FY 2016 consulting data analytics review in process Human Subjects Evaluated new process for research subject payments in FY 2015 consulting review; reliance of Office of Institutional Compliance inspections Conflicts of Interest New process in place, to be audited in FY 2018 Cash Handling and Management FY 2016 audit of Cash Management Growth of North Texas Population and New Companies Looked at enrollment forecasting during FY 2016 Budget Process audit Grade Changes Potential Consulting Review Fleet Management Will be incorporated in Division audit Library Changing Technology Potential Consulting Review Texas Public Information Act Will be incorporated in Division audit Identity Management System In process of implementing a new system; potential FY 2018 audit VI. EXTERNAL AUDIT SERVICES PROCURED IN FISCAL YEAR 2016 The following external audit services were procured or were ongoing in fiscal year 2016, per the UT Dallas Contract Administration Office. These services include, but are not limited to, financial and performance audits and attestation engagements such as a review or an agreed-uponprocedures engagement. Weaver - Cancer Prevention Research Institute of Texas (CPRIT) audit. The audit was performed to audit UT Dallas compliance with the types of compliance requirements specific to CPRIT grants. 19

20 VII. REPORTING SUSPECTED FRAUD AND ABUSE The following actions were taken by The University of Texas at Dallas to implement the requirements of: FRAUD REPORTING Section 7.09, Fraud Reporting, General Appropriations Act (84 th Legislature, Conference Committee Report), Article IX A state agency or institution of higher education appropriated funds by this Act, shall use appropriated funds to assist with the detection and reporting of fraud involving state funds as follows: (a) By providing information on the home page of the entity's website on how to report suspected fraud, waste, and abuse involving state resources directly to the State Auditor's Office. This shall include, at a minimum, the State Auditor's Office fraud hotline information and a link to the State Auditor's Office website for fraud reporting; and (b) By including in the agency or institution's policies information on how to report suspected fraud involving state funds to the State Auditor's Office. The following actions have been taken by UT Dallas to ensure compliance with the fraud reporting requirements: UT Dallas has a link for fraud reporting under Required Links at the University s home page, which provides information about reporting fraud, waste and abuse to the State Auditor s office. UT Dallas has a hotline for reporting suspected noncompliance, ethics violations, and fraud at The Office of Internal Audit has a website for fraud at UT Dallas complies with this in conjunction with the UT System Policy UTS118, Statement of Operating Policy Pertaining to Dishonest or Fraudulent Activities, located at 20

21 COORDINATION OF INVESTIGATIONS Texas Government Code, Section , Coordination of Investigations a) If the administrative head of a department or entity that is subject to audit by the state auditor has reasonable cause to believe that money received from the state by the department or entity or by a client or contractor of the department or entity may have been lost, misappropriated, or misused, or that other fraudulent or unlawful conduct has occurred in relation to the operation of the department or entity, the administrative head shall report the reason and basis for the belief to the state auditor. The state auditor may investigate the report or may monitor any investigation conducted by the department or entity. b) The state auditor, in consultation with state agencies and institutions, shall prescribe the form, content, and timing of a report required by this section. c) All records of a communication by or to the state auditor relating to a report to the state auditor under Subsection (a) are audit working papers of the state auditor. The following actions have been taken by UT Dallas to ensure compliance with the Coordination of Investigations requirements: UT Dallas reports such activities to the State Auditor s Office via their website at: sao.fraud.state.tx.us/hotline.aspx. The UT System Audit Office requires reporting of such activities to the Director of Specialty Audit Services. The UT Dallas Office of Internal Audit Policies and Procedures Manual, Chapter 5, Investigations, also references this section to ensure compliance. VIII. OFFICE OF INTERNAL AUDIT In alignment with UTD s overall mission, goals, and objectives, the mission of the Office of Internal Audit is: To enhance and protect organizational value by providing risk-based and objective assurance, advice, and insight to UT Dallas and UT System executive management relating to the achievement of the University s strategic and operational objectives. For more information about the Office, please see Internal Audit s website at This site gives links to audit information including our charter, services offered, audit reports and plans, fraud, the audit committee, and staff information. 21

22 INTERNAL AUDIT STAFF Staff Size: The organization chart, shown on page 23, consists of the organization structure as of October Staff Experiences and Certifications: The internal audit staff consists of highly qualified and skilled audit professionals with certifications including Certified Public Accountant (CPA), Certified Internal Auditor (CIA), Certified Information Systems Auditor (CISA), Certified Fraud Examiner (CFE) Certificate in Risk Management and Assurance (CRMA), and GIAC Systems and Network Auditor (GSNA). A complete list of internal audit qualifications can be found at Training: Internal Audit staff received an average of 50 hours of continuing professional education during fiscal year Key areas of training included emerging audit issues, risk assessment, information systems auditing, fraud, compliance, and ethics. Most of the training was received by participating in conferences, seminars, and webinars offered by the Association of College and University Auditors (ACUA), the Dallas Chapter of the Institute of Internal Auditors (IIA), the Texas Association of College and University Auditors (TACUA), the Institute of Internal Auditors, ISACA, and the Association of Certified Fraud Examiners (ACFE). Contributions to the Profession: Members of the staff contributed to the profession in numerous ways: The Chief Audit Executive (CAE) participated on the Association of College and University Auditors (ACUA) Faculty and served as the Chair of the Volunteer Appreciation Committee. The CAE served as a member of the Internal Auditing Education Partnership Program advisory board at the UT Dallas Naveen Jindal School of Management. The audit staff works with and mentors student interns in the Internal Auditing Education Partnership (IAEP) program as they participate in various audit projects as student auditors during the year. During fiscal year 2016, Internal Audit worked with 16 student interns. The CAE spoke at various professional conferences on the topic of internal auditing standards and spoke to the IAEP fall 2015 and spring 2016 classes on risk assessment and audit planning. The CAE participated in a peer review of a not-for-profit institution. The senior auditor participated on the technology committee for the Dallas Chapter of the IIA. 22

23 ORGANIZATION CHART 23