AGENDA ECU Board of Trustees Audit Committee Meeting Medenhall Student Center April 15, I. Approval of February 25, 2010 Minutes Action

Transcription

1 AGENDA ECU Board of Trustees Audit Committee Meeting Medenhall Student Center April 15, 2010 I. Approval of February 25, 2010 Minutes Action II. Enterprise Risk Management Report Mr. Tim Information Wiseman III. BSOM Compliance Office Report Mr. Ken Information Deville IV. Internal Audit Report Ms. Stacie Tronto a. Revised 2009/2010 Audit Plan Action b. Revised Audit Committee Charter Action c. Dashboard/ Metrics Update Information d. External Audits Information e. UNC FIT Monitoring Visit Results Information f. Administrative Items Information V. Other Business

2 Minutes from ECU BOT Audit Committee February 25, 2010 East Carolina Heart Institute Conference Room Committee members present: Joel Butler-Chair, Ken Chalk, Carol Mabe, Bob Greczyn Others present: Steve Ballard, Philip Rogers, Chris Locklear, Donna Payne, Stacie Tronto, Tim Wiseman, John Chinn, Joan Kavuru, Beth Wood, Lynne Sanders, and Ray Whitby Chairman Butler convened the meeting at 8:35 a.m. and read the conflict of interest provisions as required by the State Government Ethics Act. Mr. Butler asked if anyone would like to declare a conflict of interest. Hearing none, he asked for the approval of the minutes for the February 25, 2010 Audit Committee meeting. The minutes of the February 25, 2010 were approved with no changes. Dr. Steve Ballard updated the Committee on the status of the University Policy Manual. He introduced Philip Rogers and Chris Locklear as the co-chairs of the University Policy Committee, which is overseeing the implementation of the University Policy Manual. Dr. Ballard provided background information on the policy infrastructure and the framework the University is utilizing to implement the appropriate infrastructure. Mr. Butler introduced three special guests from the North Carolina Office of the State Auditor. The Honorable Beth Wood, Ms. Lynne Sanders, and Mr. Ray Whitby were invited to the Committee meeting to provide comments regarding the ECU Financial Audit for Ms. Wood made opening remarks and Mr. Whitby reported on the outcome of the financial audit for There were no instances of significant deficiencies with regard to the financial audit for Mr. Whitby was very complimentary of the cooperation received from ECU staff. Ms Sanders explained the elements of a fiscal control audit. Fiscal control audits are internal control and/or compliance reviews that do not take into account materiality. The State Auditor s Office identifies topics that would be of value to the University. Mr. Butler thanked the guests for taking time out of their busy schedule to attend ECU s Audit Committee meeting. Ms. Tronto provided a report on Internal Audit. The Audit Committee bylaws and charter were presented to the Committee for discussion to include risk management in the bylaws and charter. Ms. Tronto informed Mr. Butler that an Audit Committee vote was not needed for the change that Board Chairman David Brody would need to approve the change. Mr. Butler will confer with Board Chairman David Brody regarding the change to the bylaws. Ms. Tronto will update the Audit Committee Charter and the change will be approved at the next meeting. Ms. Tronto presented current dashboard metrics regarding the completion of the annual audit plan and management s corrective actions. As of February 2, 2010, 35% of the audit plan has been completed; 33% is in progress,

3 and management has satisfactorily resolved 94% of audit observations. As required by UNC policy regarding associated entities, Ms. Tronto reported on the external audits of the East Carolina University Alumni Association, the East Carolina University Educational Foundation, and the East Carolina University Medical & Health Sciences Foundation. Ms. Tronto updated the Committee on the establishment of the UNC FIT Internal Audit Advisory Team, which was established to provide feedback from an internal audit perspective regarding UNC FIT. Ms. Joan Kavuru updated the Committee on the activities of the Brody School of Medicine Compliance Office. During this transition period while searching for a Chief Compliance Officer, Mr. Ken Deville is serving as the Interim Compliance Officer. They have added two coder positions and are forging ahead with the compliance plan. Dr. Nick Benson provided an update on the search for the Chief Compliance Officer. The person selected for the position had to decline due to a family matter and the search committee is starting a new search. Mr. Tim Wiseman reported on the activities of Enterprise Risk Management. Dr. Ballard spoke to the ERM Committee in March and Mr. Ken Chalk will speak at the next ERM Committee meeting. Mr. Wiseman stated he will be developing a playbook for the ERM Committee explaining what the expectations are of each committee member. Mr. Wiseman reported that he will be reviewing benchmarks at other universities regarding ERM and plans to visit Texas A&M and attend an ERM Summit. Mr. John Chinn provided an update on the Conflict of Interest policy and forms. The forms and policy have been approved and an online version will be implemented next year. Under other business, Ms. Donna Payne announced two position changes in the University Attorney s office. Ms. Kitty Wetherington has returned to the University and Dr. Greg Hassler will be taking a faculty position. With there being no further business, the Audit Committee meeting was adjourned at 10:00am. Respectfully submitted by Stacie Tronto

4 Enterprise Risk Management Risk Survey March 2010 Instructions to participants: Thank you for taking the time to complete this brief survey. It is important that we receive responses from all enterprise risk management committee members and other selected participants. Please return the completed survey to Mr. Tim Wiseman (or Ms. Kim Walters), NLT Tuesday, March 30, 2010 so that the results can be compiled for the April ERMC meeting. The completed surveys can be ed back to or They may also be faxed to our attention at *** Survey *** Name Department Position Date Completed 1. Of the major risk categories (Strategic, Operational, Financial, Compliance, and Reputational), which category do you consider the most prominent and applicable to your current position at ECU? 2. What do you feel is the #1 enterprise risk concern in your primary risk category (identified in question #1 above) area? 3. Why is this your #1 concern (for example: frequency or likelihood of occurrence, inadequate monitoring/controls, high consequence/cost of incident, other)? 4. Thinking about ECU as an enterprise, what is your biggest risk concern other than the issue identified in Question #2, from any of the five risk categories? 5. Related to your answer to Question #4, why did you choose this risk area/issue (for example: frequency or likelihood of occurrence, inadequate monitoring/controls, high consequence/cost of incident, other)? 6. Many of our risks are a result of flawed or outdated processes. If ECU was to address one single process or subprocess in a dedicated business process review to effect change/improvement, what process would you nominate?

5 East Carolina University Office of Internal Audit Annual Engagement Plan By Type FY As of 03/20/10 Project Budget Budgeted Revised %age Actual %age Current Risk # of Description Number Status Hours Bud Hrs of Total Hours of Total Variance Status Ranking Obs Operational Audits: EAGLE Assessment CYP % Cancelled High Dining A10036 CYP % 2 0% 698 In Progress High Housing CYP % Pending High UNC FIT Financial Aid A10017 BF % 472 8% (27) In Progress High UNC FIT Contracts and Grants A10037 BF % 274 5% 167 In Progress High UNC FIT Payroll BF % Pending High UNC FIT Purchase to Pay BF % Pending High UNC FIT General Acctg., & Fin Reporting A09019 WIP % 84 1% (24) Completed High 0 Graduate School A09013 WIP % 364 6% (164) Completed High 5 Continuing Studies A09026 WIP % 111 2% 189 In Progress High Total Operational Audit Hours % % Compliance Audits: Title IX - Athletics A09025 WIP % % (174) In Progress High Total Compliance Audit Hours % % (174) 0 Information Technology Audits: Disaster Recovery 2009 CYP % Pending High 2nd Follow-Up State IT Audit L10021 CYP % 68 1% 32 Completed High 1 ITCS Log Review Processes and Privileged User Acct CYP % Pending High University's Mobile Computing Practices CYP % Pending High Total Information Technology Audit Hours % 68 1% 32 1 Special Reviews: Special Reviews - Pending (1000) CYP % Pending Use of Resources - Dental Clinic L10018 CYP-B % 207 4% (57) Completed High 8 Nephrology - Misuse of State Time L10020 CYP-B % 163 3% (63) In Progress Low Reporting Misuse L10014 CYP-B % 5 0% 36 In Progress Low Nursing - Misuse of State Time L10012 CYP-B % 294 5% (194) Completed High 4 ECU PD Alleged Liability Issue L10010 CYP-B % 102 2% (82) Completed Low 1 ECU PD Compromised Security L10011 CYP-B % 13 0% 7 In Progress Medium BSOM Grant Issue L10003 CYP-B % 215 4% (115) Completed High 4 Recreation and Leisure Studies L10001 CYP % 294 5% (94) Completed Medium 6 International Affairs Issue L09004 WIP % 51 1% 49 Completed High 2 Athletics Procard L10033 CYP-B % 161 3% (11) In Progress High Review of Employee Entry/Exit Processes L08052 WIP % 0 0% 40 In Progress High Math Grant L10045 CYP-B % 41 1% (1) In Progress Low OAP Resource Use L10046 CYP-B % 35 1% 66 In Progress High 2nd Follow-Up OSA Reportable Conditions L09028 WIP % 50 1% (10) Completed High 0 Total Special Review Audit Hours % % (428) 25 Follow-Up Reviews: University Policies and Training (L08031) BF % Pending High Maritime Studies (L08030) F10030 BF % 78 1% (38) Completed Low 0 Readmission of Student (L08020) BF % Pending High EAGLE (L08060) F10050 AYP % 15 0% 65 In Process High O/S 06/07 Audit - 2nd FU Radiation Onc. (N07015) F10042 CYP % 3 0% 37 In Process High O/S 07/08 Audit - 2nd FU Stud Life MC (L07035) F10006 CYP % 65 1% (45) Completed Low 0 O/S 07/08 Audit - 2nd SOA Issue/Keys (L07007) F10009 CYP % 25 0% 15 Completed Low 1 Fundraising Events (L08008) F10029 CYP % 4 0% 7 Completed Low 0 Moving Expenses (L07055) F10049 CYP % In Progress Low CHSC Employee Expenses (L08011) F10052 CYP % 7 0% 33 Completed Low 0 Petty Cash Controls (L ) F10016 CYP % 11 0% 30 Completed High 0 Accounts Payable (A07020) F10023 CYP % 7 0% 94 In Progress High Chemistry Payroll & Admin (L08021) F10025 CYP % 36 1% 5 Completed Low 1 Chemistry Purchases & Inventory (L08058) F10026 CYP % 92 2% (52) Completed Low 0 University Cashier's Office (A08010) F10032 CYP % 23 0% (3) Completed High 0 REAP Expenses Review (L09014) F10031 CYP % 147 3% (47) Completed Medium 1 Biology Research (L08036) F10048 CYP % 8 0% 12 Completed Medium 0 ECU PD (L09041) F10047 CYP % 4 0% 6 Completed High 0 O/S 06/07 Audit - Friends of Joyner (L05039) F09043 WIP % 23 0% (3) Completed Low 0 Total Follow-Up Review Audit Hours % % Budget Status: BF = Brought Forward From Previous Year's Plan AYP = Added to Current Year Plan CYP = Current Year Plan CYP-B = Current Year Plan (Budgeted under Special Reviews - Pending) WIP = Work-In-Progress Page 1 OF 2

6 East Carolina University Office of Internal Audit Annual Engagement Plan By Type FY As of 03/20/10 Project Budget Budgeted Revised %age Actual %age Current Risk # of Description Number Status Hours Bud Hrs of Total Hours of Total Variance Status Ranking Obs Special Projects: Consultations CYP % % (529) Pending High NA Dashboard/Performance Metrics J10022 AYP % In Progress High Continuous Auditing/Monitoring J10002 CYP % 33 1% 968 In Progress High Fraud Risk Assessment J10019 CYP % 10 0% 190 In Progress High Internal Audit 2011 QAR CYP % Pending High Risk Assessment 2010/2011 CYP % Pending High Risk Assessment 2009/2010 J09042 WIP % 71 1% (31) Completed High 0 Total Special Project Hours % % 1126 Total Audit Hours % % =Completed =In Progress = Canceled Budget Status: BF = Brought Forward From Previous Year's Plan AYP = Added to Current Year Plan CYP = Current Year Plan CYP-B = Current Year Plan (Budgeted under Special Reviews - Pending) WIP = Work-In-Progress Page 2 OF 2

7 East Carolina University Board of Trustees Audit Committee Charter Background All constituent institutions of the University of North Carolina (UNC) are required by State law to have their financial audit conducted by the North Carolina Office of the State Auditor. Historically, the Office of the State Auditor has not performed non-audit services, including those prohibited by the Sarbanes-Oxley Act. The Office of the State Auditor determines staff assignments for individual audits, including rotation of Audit Managers for each audit client. Purpose To assist the East Carolina University Board of Trustees in fulfilling its oversight responsibilities for (1) the integrity of the University s financial statements, (2) the University s compliance with legal, regulatory, and ethical requirements, (3) the performance of the University s internal audit function, and (4) the University s compliance with the Best Financial Practices Guidelines adopted by the UNC Board of Governors in November of The Audit Committee has jurisdiction over internal audit, enterprise risk management, compliance, conflicts of interest, and ethics. Organization The Audit Committee shall be a standing committee of the ECU Board of Trustees. Each Committee member must be independent of management and free of any relationship that would impair such independence. If practicable, at least one member of the Committee should be a financial expert. A financial expert is someone who has an understanding of generally accepted accounting principles and financial statements; experience in applying such principles; experience in preparing, auditing, analyzing, or evaluating financial information; experience with internal controls and procedures for financial reporting; and an understanding of the audit committee function. If feasible, the role of financial expert will be rotated on an annual basis. Meetings The audit committee shall meet at least four times a year and hold additional meetings as circumstances require. The Committee will invite representatives of management, auditors, legal counsel, and others to attend meetings and provide pertinent information as necessary. The Committee will receive reports regarding internal audit, enterprise risk management, compliance, conflicts of interest, and ethics. It will also hold private meetings with the Director of Internal Audit if deemed necessary. Meeting agendas will be prepared and provided in advance to members, along with appropriate briefing materials. Minutes of the meetings will be prepared.

8 Duties and Responsibilities The following shall be the principal duties and responsibilities of this Committee: Per UNC-BOG: Meet at least quarterly during the year. Review the results of the annual financial audit with the North Carolina State Auditor or his designated representative. Discuss the results of any other audit performed and report/management letter (i.e. information system audits, investigative audits, etc.) issued by the North Carolina State Auditor with either the State Auditor or his staff, the Director of Internal Audit, or appropriate campus official. For any audit finding contained within a report or management letter issued by the State Auditor, review the institution s corrective action plan and receive a report once corrective action has taken place. Discuss the results of any audit performed by independent auditors and, if there were audit findings, review the institution s corrective action plan and receive a report once corrective action has taken place. Review all audits and management letters of University Associated Entities as defined in section [R] of the UNC Policy Manual. Receive quarterly reports from the Director of Internal Audit that, at a minimum, reports material (significant) reportable conditions, the corrective action plan for these conditions and a report once these conditions have been corrected. The Director of Internal Audit reports to the Chancellor with a clear, recognized reporting relationship to the chair of the BOT Audit Committee. Receive, review, and approve the annual audit plan for the internal audit department. Ensure that all internal audits were conducted in accordance with professional standards. Receive and review an annual summary of audits performed by the internal audit department. Ensure the Director of Internal Audit forwards copies of both the approved audit plan and summary of internal audit results to UNC General Administration in the prescribed format. Other: Review and concur in the appointment, replacement, or dismissal of the Director of Internal Audit and the compensation package. Meet privately with the Director of Internal Audit as deemed necessary. Review and assure the internal audit function has appropriate budget and staff resources. Review and accept internal audit reports when issued. Periodically review and revise the internal audit charter as needed.

9 Resolve disagreements between internal audit and management concerning audit findings and recommendations. The Committee, with the assistance of the Director of Internal Audit should periodically review and assess the adequacy of the Audit Committee Charter. Approved by ECU BOT Audit Committee September 09, 2008

10 Dashboard/Metrics Update As of 03/20/10 Completion of Audit Plan: Goal =? Status of Audit Plan Number of Audits % of Total Plan Completed 24 50% In Process 19 40% Pending** 5 10% Total % **For purposes of reporting, the total for pending audits does not match the approved audit plan as three audits are included in the 2009/2010 audit plan but will be deferred until later. These audits/projects include: UNC FIT Purchase to Pay UNC FIT Payroll Quality Assurance Assessment Productivity Ratios: Goal = 70% Direct Hours 72% Indirect Hours 28% Management s Corrective Actions: Goal = 90% Completed Outstanding % Complete % Outstanding Observations by Division: Academic Affairs % 0% Administration and Finance % 9% Chancellor % 0% Health Sciences % 0% Research & Graduate Studies % 0% Student Life % 0% University Advancement % 0% Total Observations 34 1 Total Percentages 97% 3%

11