September 9, Dr. Hobson Wildenthal, President ad interim Ms. Lisa Choate, Chair of the Institutional Audit Committee:

Transcription

1 THE UNIVERSITY OF TEXAS SYSTEM AT THE UNIVERSITY OF TEXAS AT DALLAS OFFICE OF INTERNAL AUDIT 800 W. CAMPBELL RD. SPN 32 RICHARDSON, TX PHONE FAX September 9, 2015 Dr. Hobson Wildenthal, President ad interim Ms. Lisa Choate, Chair of the Institutional Audit Committee: We have completed an audit of Export Controls as part of our fiscal year 2015 Audit Plan, and the report is attached for your review. The audit was conducted in accordance with the Institute of Internal Auditors International Standards for the Professional Practice of Internal Auditing. The objective of our audit was to ensure UT Dallas' compliance with export controls regulations. Overall, we found that improvements are needed to ensure that the Export Control compliance program is operating effectively and that UT Dallas is in compliance with Export Control regulations. The attached report details recommendations to improve monitoring over sponsored projects conducted at the Applied Research Center, screening of research personnel, risk assessing the area, tracking paperwork for international travelers, hazardous materials inspection and training for individuals who handle shipments. Management has reviewed the recommendations and has provided responses and anticipated implementation dates. Though management is responsible for implementing the course of action outlined in the response, we will follow up on the status of implementation subsequent to the anticipated implementation dates. We appreciate the courtesies and considerations extended to us during our engagement. Please let me know if you have any questions or comments regarding this audit. Toni Stephens Institutional Chief Audit Executive UT Dallas Responsible Parties: Mr. Rafael Martin, Associate VP for Research Ms. Sanaz Okhovat, Assistant VP for Research Compliance Mr. Bob Fishbein, Assistant VP for Auxiliary Services Dr. James Wright, Assistant VP for Administration Mr. David Liner, Director of Environmental Health & Safety Mr. Peter Bond, Assistant VP for Procurement Ms. Cristen Casey, Assistant VP for International Programs Members of the UT Dallas Institutional Audit Committee: External Members: Mr. Bill Keffler Mr. Ed Montgomery Ms. Julie Knecht Dr. Inga Musselman, Acting Provost Dr. Calvin Jamison, Vice President for Administration Mr. Terry Pankratz, Vice President for Budget and Finance Mr. David Crain, Vice President and Chief Information Officer Dr. George Fair, Vice President for Diversity and Community Engagement; Compliance Officer Dr. Gene Fitch, Vice President for Student Affairs Mr. Timothy Shaw, University Attorney The University of Texas System: Dr. Steven Leslie, Executive Vice Chancellor for Academic Affairs Alan Marks, Attorney Mr. J. Michael Peppers, CIA, CRMA, CPA, FACHE, Chief Audit Executive Ms. Moshmee Kalamkar, CPA, CIA, Audit Manager State of Texas Agencies: Legislative Budget Board Governor s Office State Auditor s Office Sunset Advisory Commission AN EQUAL OPPORTUNITY/AFFIRMATIVE ACTION UNIVERSITY

2 Executive Summary Export Controls, Report No Audit Objective and Scope: To ensure UT Dallas' compliance with export controls regulations. The following is a summary of the audit recommendations by priority and risk type. See Appendix A for additional details. High (0) High/Medium (4) Medium (1) Low (0) Estimated Recommendation (1) Monitor Sponsored Projects Conducted by the Applied Research Center (2) Document All Screenings/Develop Monitoring Plan for Ongoing Projects (3) Develop a Comprehensive Risk Assessment (4) Improve Compliance with Export Controls over Shipping Priority and Risk Type Implementation Date Compliance September 30, 2015; October 31, 2015 Compliance September 30, 2015 Compliance January 31, 2016 Compliance January 31, 2016 (5) Track Traveler Status Compliance October 31, 2015 Responsible Vice Presidents: Responsible Parties: Dr. Bruce Gnade, VP Research Dr. Calvin Jamison, VP Administration Mr. Terry Pankratz, VP Budget & Finance Dr. Gene Fitch, VP Student Affairs Research: Recommendations (1) (2) (3) (4) Rafael Martin, Associate VP Research; Sanaz Okhovat, Assistant VP Research Compliance Administration Recommendation (4) Bob Fishbein, Assistant VP Auxiliary Services Dr. James Wright, Assistant VP Administration; David Liner, Director of Environmental Health & Safety Budget & Finance: Recommendation (5) Pete Bond, Assistant VP Procurement Management Student Affairs Recommendation (5) Cristen Casey, Assistant VP for International Programs Staff Assigned to Audit: Project Leader: Dominique DiAndrea, CIA, Senior Auditor 2

3 Table of Contents Background... 4 Audit Objective... 5 Scope and Methodology... 5 Audit Results and Management s Responses... 5 Audit Recommendations... 6 (1) Monitor Sponsored Projects Conducted by the Applied Research Center... 6 (2) Document All Screenings/Develop Monitoring Plan for On-going Projects... 7 (3) Develop a Comprehensive Risk Assessment... 8 (4) Improve Compliance with Export Controls over Shipping... 9 (5) Track Traveler Status Conclusion Appendix: Priority Findings and Risk Matrix

4 Background United States export control law regulates the export of and access to data, technologies, software, and hardware for reasons of foreign policy, national security, and trade protection. Export controls are governed by three federally-managed lists 1. Noncompliance with federal regulations could result not only in loss of funding, substantial fines to the University and researchers, and reputational harm, but also injuries, accidents or contamination if hazardous materials are not properly inspected immediately upon entry onto campus. All UT Dallas employees are required to comply with export control regulations 2. Export controls are considered a high-risk area under the UT Dallas institutional compliance program, which is why risk management plans (RMP) were put in place to minimize risks and ensure compliance with federal regulations. As shown below, while the Vice President (VP) for Research is responsible for export controls compliance for the University, export controls operations are handled under two separate vice presidents. Export Controls Compliance Vice President for Research Area Responsible VP Responsible for Compliance Responsible for Operations Research VP for Research AVP Research Compliance Research Compliance Shipping VP for Administration AVP Auxiliary Services Central Receiving As of May 1, 2015, there were 144 active non-classified sponsored projects awarded to UT Dallas during FY 2015, with research dollars of approximately $21.6 million. Most of the research conducted at UT Dallas is fundamental, wherein the results are open to the public. As such, they are excluded from U.S. export control regulations. UT Dallas, however, remains responsible for determining if new projects are subject to export control regulations, for screening all research personnel against restricted party lists, ensuring all persons traveling abroad disclose if they plan to take electronic data and/or technology with them, and for educating the university community on export control regulations. All classified research, which is subject to export control regulations, is conducted at the Applied Research Center (ARC). As of May 1, 2015, there were three on-going projects at the ARC with research dollars totaling approximately $283, International Traffic in Arms Regulations (ITAR); Department of State covers military technologies found on the United States Munitions List (USML), and is the policy of denial for exports to certain countries. Export Administration Regulations (EAR); Department of Commerce covers dual use items found on the Commerce Control List (CCL), and regulates items designed for commercial purposes which also have military applications. Office of Foreign Assets Control (OFAC); Department of the Treasury covers sanctions and embargoes against specific countries or persons, and maintains a Specially Designated Nationals and Blocked Persons List export-controls; 4

5 Audit Objective To ensure UT Dallas' compliance with export controls regulations. Scope and Methodology The scope of this audit was fiscal year 2015 and our fieldwork concluded on July 13, To satisfy our objectives, we performed the following: Gained an understanding of export control operations on campus. Reviewed applicable federal and university policies and procedures regarding Export Controls. Reviewed the University s Export Control Risk Management Plans (RMP). Determined if: o An underlying, comprehensive risk assessment had been conducted. o Proper export control paperwork (checklists, Technology Control Plans, B16- EXC forms for international travelers) was on file. o Research personnel were properly screened through Visual Compliance (VC) against restricted party lists. o Training on export controls, as it related to research and shipping, was being conducted. o Hazardous materials were inspected at Central Receiving to ensure compliance with applicable safety regulations. o International shipments contained export-controlled items, or were sent to countries where there might be embargoes or sanctions, e.g. North Korea, Iran, and Syria. Where applicable, we conducted our examination in accordance with the guidelines set forth in The Institute of Internal Auditor s International Standards for the Professional Practice of Internal Auditing. The Standards set criteria for internal audit departments in the areas of independence, professional proficiency, scope and performance or audit work, and management of the internal auditing department. Audit Results and Management s Responses Controls Our audit work indicated that the following controls currently exist: Risk Management Plans for export controls have been documented and contain monitoring, training, and reporting procedures designed to reduce instances of noncompliance. 5

6 Audit Recommendations Although the above controls are in place, opportunities exist to improve compliance with regulations and the effectiveness over export control operations. Priority Findings UT System A UT System priority finding is defined by the UT System Audit Office as: an issue identified by an internal audit that, if not addressed timely, could directly impact achievement of a strategic or important operational objective of a UT institution or the UT System as a whole. 3 We have no UT System Priority Findings resulting from this audit. However, we do recommend export control compliance be improved by implementing the recommendations outlined below. See Appendix A for the Priority Findings and Risk Matrix defining the various risk factors and risk levels for each audit recommendation. (1) Monitor Sponsored Projects Conducted by the Applied Research Center Risk Factor: Compliance; Risk Rating: High/Medium Although screening of research personnel through Visual Compliance is being performed, sponsored projects conducted at the Applied Research Center (ARC) are not being monitored for export control compliance by the ORC. The risk to UT Dallas, however, is significantly reduced as the ARC s business practice is to not allow foreign nationals access to classified projects. Federal regulations for export controls exist to protect the national security and foreign policy interests of the U.S. To obtain comfort that UT Dallas is export control compliant, every project must be monitored. This is especially important as UT Dallas's long-term strategic plan involves conducting a greater volume of classified research. By not doing so, the ORC may not be aware of export control issues, and violations could result. These may include civil and criminal penalties, large fines evaluated for the university and its researchers, suspension of research programs, and reputational harm to the university. Recommendation: We recommend that the ORC continue to develop a monitoring plan for export controls compliance with the ARC. Management s Response: ARC projects are currently being monitored for export control compliance in the same process as all other research projects with external funding or involving non-utd proprietary information. ORC reviews all ARC projects to determine if a Technology Control Plan (TCP) is required. ORC and ARC leadership are developing a quarterly monitoring program to address export control regulations. In addition, ORC will develop Export Control Training for individuals listed on a TCP. 3 Appendix A defines the priority and risk ranking used for all internal audit recommendations. 6

7 Estimated Date of Implementation: September 30, 2015 (monitoring program); October 31, 2015 (training) Person Responsible for Implementation: Rafael Martin, Associate VP Research (2) Document All Screenings/Develop Monitoring Plan for On-going Projects Risk Factor: Compliance; Risk Rating: High/Medium Export control regulations govern, for reasons of foreign policy and national security, when and how access can be granted to research equipment and technology. When sponsored project proposals are submitted, a Grants & Contract Specialist (GCS) will screen research personnel through Visual Compliance (VC), which checks against restricted party lists. Screenings should occur prior to the project award date to ensure that no one working on the project was found to be a restricted party; however, we acknowledge that the award date does not necessarily indicate that work on the project begins. The Research Compliance Manager verifies on a monthly basis that the GCS s ran each member of the project team through VC and documents this review by logging the individual, screen date, and results into an Excel spreadsheet. Only the most recent screenings are logged. ORC is in the process of developing a monitoring plan for ongoing projects. This plan will incorporate annual reviews for all active projects, including ensuring that Technology Control Plans are being followed, and that researchers added to the project are cleared through VC. We reviewed a sample of 49 sponsored projects to verify that all research personnel were screened through VC and identified the following: One individual was not screened, and was not caught by the ORC during their monthly review. No support was provided to show that four individuals were screened prior to their projects' award date. Projects are not being monitored throughout the life of the grant, including monitoring for research personnel added to the project. Recommendation: We recommend that the screening process be reviewed and improvements made to ensure that all individuals listed on research proposals are screened through VC by the GCS s and are doing so prior to the projects' award date, and that each screening be logged, not just the most recent. 7

8 Management s Response: ORC has reviewed the federal requirements that stipulate restricted party screenings for research contracts, and has already implemented an updated process for screening individuals prior to the project award or start date. ORC will continue to use Visual Compliance as the system of record for restricted party screenings to avoid redundant recordkeeping. Visual Compliance logs each screening and allows ORC to pull historical screenings. ORC and Office of Post Award Management are developing a monitoring plan to ensure individuals added to the project after the initial award dates are also screened in Visual Compliance. ORC is also developing a post-approval monitoring plan for projects with an active TCP. Estimated Date of Implementation: September 30, 2015 Person Responsible for Implementation: Rafael Martin, Associate VP Research (3) Develop a Comprehensive Risk Assessment Risk Factor: Compliance; Risk Rating: High/Medium The Bureau of Industry and Security under the Department of Commerce directs that not only should a risk assessment be developed for export controls, but that a core element of an effective export compliance program is to continually reassess risks 4. The RMP s developed for research and shipping activities provide a broad overview of the risks and mitigating controls, but not a complete representation of how new and current risks are identified, or how each ITAR, EAR and OFAC regulation is addressed. These may include civil and criminal penalties, large fines evaluated for the university and its researchers, suspension of research programs, and reputational harm to the university. Without developing and periodically updating an underlying risk assessment to the RMP s, risks may go unmitigated, and violations may occur. With university growth, risks related to export controls can change. Recommendation: A comprehensive, specific risk assessment should be prepared and continuously assessed for all research and shipping activities to ensure that all federal regulations and associated risks are being identified and mitigated. Management s Response: ORC is investigating risk assessment models that may applicable to the export control program to incorporate into the RAMP. Estimated Date of Implementation: January 31, 2016 Person Responsible for Implementation: Rafael Martin, Associate VP Research 4 8

9 (4) Improve Compliance with Export Controls over Shipping Risk Factor: Compliance; Risk Rating: High/Medium The current reporting structure for export controls compliance is multi-tiered and complex. As outlined on page four, the overall responsible party for export controls compliance at UT Dallas is the VP for Research. The UT Dallas Institutional Compliance Program requires a RMP for each high-risk area. The VP for Research is responsible for the export controls RMP as well as reporting the results of its compliance monitoring and training each quarter to Institutional Compliance who reports the results to the Executive Compliance Committee. Monitoring and reporting have been delegated to the ORC. Because export controls over shipping operations are managed under Auxiliary Services, reporting to the VP for Administration, a separate RMP was developed. Each quarter Auxiliary Services submits their RMP monitoring report to the ORC for their review. The ORC is responsible for submitting both the quarterly ORC RMP and the Auxiliary Services Shipping RMP to the Institutional Compliance Office. We reviewed the export controls RMP for shipping and identified the following opportunities for improvement: Inspections of hazardous materials are not accurately documented in the RMP: o The RMP for shipping activities states that a log is maintained of all hazardous materials received at Central Receiving, and that the internal controls are to isolate all materials, await inspection by a Safety Technician with the Office of Environmental Health & Safety (EH&S), and deliver according to instructions from EH&S. Through discussions with Auxiliary Services, however, actual procedures to inspect and approve hazardous materials are performed at the point-of-order in SciQuest. A Safety Manager reporting to ORC oversees the hazardous materials program and is forwarded the Purchase Order (PO) for any hazardous material ordered. To process the order, the Safety Manager must first evidence approval in the system. As materials are received, the packages are scanned by Central Receiving against a listing of approved PO s. For any items not matching the PO list that are labeled hazardous, the Safety Technician with EH&S will be notified. In addition, if packages arrive labeled as radioactive or hazardous but were damaged in transit, the EH&S representative will be called upon to inspect. Once packages have been identified and, if applicable, inspected, Mail Services will deliver the materials to the labs. 9

10 Purchasing card expenses are not monitored by the ORC: o All research personnel ordering chemicals and lab supplies are directed to do so exclusively through SciQuest. Purchasing cards, however, are not monitored for chemical and lab supplies, which would help identify those who are ordering outside of SciQuest and, therefore, may not be receiving the same level of pre-purchase review. o UT Dallas faculty, staff and students are informally instructed to ship using eshipglobal. Purchasing cards, however, are not monitored for FedEx, UPS, DHL and other carrier charges, which would indicate that shipments are occurring outside of eshipglobal and without knowledge by UT Dallas. Training for certain persons is not mandated: o UT Dallas faculty, staff and students who work on sponsored projects that involve the use of export-controlled information, equipment, or software, have not been properly, or recently trained on export control compliance, specific to shipping. The RMP has not been updated: o The RMP for shipping activities does not reflect risks associated with having untrained faculty, staff and students handle shipments. eshipglobal is not customized appropriately: o eshipglobal users are not required to enter an item description when preparing shipping labels. Of the 592 international shipments that have shipped during FY 2015, 88 item descriptions were left blank. Five of these shipments contained descriptions using key words found on EAR's Commerce Control List (CCL) such as "specimen," "semiconductor" and "Ni films on Si wafer," all of which should have been identified, and inspected prior to shipment. A control has been put in place to alert Mail & Distribution Services, ORC and the appropriate Department Head/Dean of a questionable item being shipped; users still can choose to not enter a description. A policy has not been developed: o No policy exists to instruct faculty, staff and students to explicitly ship using eshipglobal. Federal regulations state that export controls govern the shipment, transmission, or transfer of regulated items, information and software to foreign countries, persons or entities. Knowledge of export controls and how it affects all faculty, staff and students is essential. 10

11 Recommendation: We recommend that shipping processes be improved by ensuring: Assignment for export control responsibilities is properly aligned. Due to the complexity of the reporting structure, and the high risk nature of export controls, we recommend that the current structure be reviewed and responsibilities properly placed between the offices of Research and Auxiliary Services. As each area completes their own RMP, formally separating these risk areas for export control purposes should be considered. Purchasing cards are periodically monitored to identify purchases of hazardous materials, and users who are shipping outside of eshipglobal. Certain faculty, staff and students receive training on export control compliance, specifically as it relates to shipping. This training should be developed with the involvement by both ORC and Mail & Distribution Services. The RMP for shipping activities is updated to reflect actual procedures for inspecting hazardous materials prior to delivery to university labs, in addition to risks associated with having untrained faculty, staff and students ship. eshipglobal be customized to force users to enter an item description. This should be emphasized as part of the training program on export control compliance for eshipglobal users. A policy is developed to instruct faculty, staff and students to explicitly ship using eshipglobal. Office of Research Compliance Management s Response: ORC recommends the oversight of shipping and export control to be transitioned to the VP for Administration; this includes a distinct shipping RAMP. Dr. Gnade will present arguments to shift oversight of shipping/export control to the VP for Administration at the next Executive Committee meeting. In addition: Hazardous materials entering or leaving campus should not be monitored by ORC; all hazardous materials are not necessarily ITAR/EAR regulated, if one is identified, management of the material will be outlined in a TCP. ORC will develop specific Export Control training for individuals listed on a TCP; the training will include information on shipping. Purchasing card expenses should not be monitored by ORC, however, ORC will assist in identifying a process to address purchases of Export Control materials. ORC will wait for direction from Internal Audit regarding this matter. Estimated Date of Implementation: October 31, 2015 (training) 11

12 Person Responsible for Implementation: Rafael Martin, Associate VP Research Auxiliary Services Management s Response: ORC and Central Receiving communicate daily to reduce risks due to export controls and will review future RMPs together. ORC and Central Receiving will be creating enhanced training materials. These new training documents along with eshipglobal classes will be available to all UTD employees. The RMP for shipping has been updated to reflect that the four individuals on campus that are certified and authorized shippers for hazardous materials are fully trained. All hazardous materials are inspected prior to shipping to maintain compliance. New software changes are in place within eshipglobal. The item description field must manually be filled in by the shipper in order to print a package label and shipping form. Estimated Date of Implementation: January 31, 2016 (training) Person Responsible for Implementation: Bob Fishbein, Assistant VP Auxiliary Services Environmental Health & Safety Management s Response: We support the tracking of chemical procurement through the SciQuest and eshipglobal system. EHS will conduct inspections for chemicals that are not related to a P.O. purchase or chemicals off specifications when contacted by Auxiliary Services and/or determine a standard inspection frequency to adequately address hazardous chemicals received. Estimated Date of Implementation: December 31, 2015 Person Responsible for Implementation: Mr. David Liner, Director of Environmental Health & Safety (5) Track Traveler Status Risk Rating: Medium UT Dallas travel procedures direct all faculty, staff and students traveling abroad to complete a B16-EXC form prior to travel. B16-EXC forms inform faculty, staff and students about the Export Control policies surrounding any UT Dallas or personal property they intend to bring with them. The form must be signed by both the traveler and ORC prior to travel. As the RMP indicates, any absence of these forms suppresses institutional approval for foreign travel. 12

13 We reviewed a sample of 56 travelers to verify that signed B16-EXC forms were on file, and identified the following: One form was approved by ORC three days following the traveler's departure date. In addition, the form was signed by a Program Coordinator on behalf of the traveler as they had already traveled abroad. The form did indicate that the traveler would not be carrying any electronic devices; however, the issue remains in the timeliness of the forms' submission to ORC. ORC should have been given ample time to review, and make the proper determination prior to travel. Two forms could not be located for two different travelers. It was verified with UT Dallas's travel company, Corporate Travel Planners, that neither trip had been cancelled, and with Procurement that neither put in requests for expense reimbursement. When confirming with International Programs (IP), however, they only had a record of travel for one of the two travelers. Federal regulations dictate that a license is required for all electronic devices containing export controlled data or technology. To determine if the traveler does or does not intend to travel abroad with export controlled electronic devices or technology, authorization must occur prior to the traveler's departure date. Recommendation: We recommend that more robust procedures be established to track traveler status and approvals. This process should be developed to better track workflow, enhance communication between the ORC, IP, and Procurement, and make it easier to locate forms when needed. Finally, a process should be put in place to notify the ORC, IP and Procurement when there are trip alterations or cancellations processed by the university s contracted travel agencies. This will allow any change to be tracked accurately and timely. Management s Response: Several offices (Office of Procurement, International Center, and Office of Research) are exploring software options that would give us more control over the international travel process. Items under review: automation through PeopleSoft, Concur Request, or Terradotta. Within the next 60 days, we will determine a plan of action on how to best address this item. Estimated Date of Implementation: October 31, 2015 Internal Audit will follow up on this matter during our audit of International Travel, planned for 4 th quarter FY Person Responsible for Implementation: Peter Bond, Assistant VP Procurement; Cristen Casey, Assistant VP International Programs 13

14 Conclusion Based on the audit work performed, we conclude that improvements are needed to ensure that the Export Control compliance program is operating effectively and that UT Dallas is in compliance with Export Control regulations. We appreciate the courtesy and cooperation received from the management and staff in Research, Mail & Distribution Services, International Programs, Auxiliary Services and Environmental Health & Safety as part of this audit. 14

15 Definition of Risks Appendix: Priority Findings and Risk Matrix Risk Level High High/Medium Medium Low Definition High probability of occurrence that would significantly impact UT System and/or UT Dallas. Reported to UT System Audit, Compliance, and Management Review Committee (ACMRC). Priority findings reported to the ACMRC are defined as an issue identified by an internal audit that, if not addressed timely, could directly impact achievement of a strategic or important operational objective of a UT institution or the UT System as a whole. Risks are considered to be substantially undesirable and pose a moderate to significant level of exposure to UT Dallas operations. Without appropriate controls, the risk will happen on a consistent basis. The risks are considered to be undesirable and could moderately expose UT Dallas. Without appropriate controls, the risk will occur some of the time. Low probability of various risk factors occurring. Even with no controls, the exposure to UT Dallas will be minimal. Risk Factors Reputation - damage to the image of UT Dallas and/or UT System Information Security - integrity, confidentiality and availability of information Compliance compliance with external legal or regulatory requirements Accomplishment of Management s Objectives goals being met, projects being successful Effectiveness and Efficiency objectives at risk and/or resources being wasted Capital Impact - loss or impairment of the use of assets Life Safety including loss of life, injury, toxics/infectious disease Management Oversight Operational Alignment management s alignment of people, process and technology to efficiently accomplish organization objectives Designed Controls adequacy of controls within critical operations Payments/Expenditures including fines and legal costs Lost Revenue actual and/or opportunities 15