THE UNIVERSITY OF TEXAS AT TYLER

Transcription

1 THE UNIVERSITY OF TEXAS AT TYLER Internal Audit Annual Report Fiscal Year Ending August 31, 2017 The University of Texas at Tyler 3900 University Boulevard Tyler, Texas 75799

2 Table of Contents I. Compliance with Texas Government Code, Section II. Internal Audit Plan for Fiscal Year III. Consulting Services and Nonaudit Services Completed IV. External Quality Assurance Review (Peer Review) V. Internal Audit Plan for Fiscal Year VI. External Audit Services Procured in Fiscal Year VII. Reporting Suspected Fraud and Abuse

3 Purpose of the Internal Audit Annual Report The purpose of this Internal Audit Annual Report is to provide information on the assurance services, consulting services, and other activities of the internal audit function. In addition, the annual report assists oversight agencies in their planning and coordination efforts. The Texas Internal Auditing Act, (Texas Government Code, Chapter 2102), requires that an annual report on internal audit activity be filed by November 1st of each year and submitted to the Governor, the Legislative Budget Board, the Sunset Advisory Commission, the State Auditor s Office (SAO), and the entities governing boards and chief executives. The report was prepared using the guidelines provided by the Texas State Auditor s Office. Additional information regarding the UT Tyler Office of Internal Audit can be found at the following website: I. Compliance with Texas Government Code, Section The University of Texas at Tyler (UT Tyler) has posted the Fiscal Year 2017 Internal Audit Annual Report, Fiscal Year 2018 Annual Audit Plan, and other audit information on its web site at Each periodic internal audit report is submitted as required throughout the year. 3

4 II. Internal Audit Plan for Fiscal Year 2017 Report FY 2017 Audit Plan Status Date Notes Risk Based Audits Departmental Account Reconciliations Complete Aug 17 Alumni House Construction Cancelled ~ (B) Campus Programs for Minors In Progress *** Change in Management: President Complete May 17 Change in Management: Physical Plant Complete Aug 17 Financial Aid Cancelled ~ (B) IT Risk Assessment Complete ~ (A) Contract Administration Audit (carryforward from FY 2016) Complete Nov 16 (A) Student Fees Expenditures (carryforward from FY 2016) Complete Mar 17 (A) PeopleSoft FY 2016 to FY 2017 Balance Forward Audit Complete Mar 17 Required Audits (External and Internal) Annual Financial Report and UTS Assurance Complete Dec 16 Annual Financial Report Deloitte External Audit Complete ~ Annual Financial Report Interim Procedures Complete ~ Executive Travel and Entertainment Expenses Complete Aug 17 Texas Higher Education Coordinating Board Facilities Audit Complete June 17 Joint Admission Medical Program (JAMP) Complete Oct 16 President's Office Travel and Entertainment Complete ~ Texas Administrative Code (TAC) 202 Compliance Complete Aug 17 Senate Bill 20 Compliance Assessment Complete Aug 17 (A) Consulting Compliance Department Coordination and Assistance Complete ~ Executive Management Consulting Review Complete ~ Export Controls Consulting Review Complete Aug 17 Faculty Recruitment Consulting Review Complete Feb 17 Innovation Academy Annual Financial Audit and Board Meetings Complete ~ International Student Recruiting and Foreign Travel Consulting Review Complete Feb 17 PeopleSoft Assistance and Review Complete ~ Southern Association of Colleges and Schools Accreditation Steering Committee Complete ~ University Advancement Endowment Compliance Annual Report Consulting Review Complete Feb 17 4

5 II. Internal Audit Plan for Fiscal Year (FY) 2017, Continued Report FY 2017 Audit Plan Status Date Notes Investigations Investigations Complete ~ Follow Up Follow Up of Audit Recommendations Complete Aug 17 Reserve Carryforward and Additional Requests (individual projects are included above) Complete ~ Development - Operations Annual Audit Report for the State Auditor's Office Complete ~ Annual Risk Assessment and FY 2018 Audit Plan Complete ~ Computer and Software Maintenance and Updates Complete ~ External Quality Assessment Review Strategic and Quality Initiatives Implementation Complete ~ External Quality Assessment Complete ~ Institutional Audit Committee Meeting Preparation and Participation Complete ~ Internal Quality Assurance and Improvement Program and Management of the Internal Audit Department Complete ~ State Auditor's Office and UT System Reporting, Requests and Meetings Complete ~ Training Provided to Institutional Departments and Employees Complete ~ UT Tyler Institutional Committees and Meetings Preparation and Participation Complete ~ Development - Initiatives & Education Auditor Training and Continuing Professional Education Complete ~ Professional Organizations and Presentations Complete ~ UT System Audit Office Initiatives Participation Complete ~ 5

6 Deviations from Original Fiscal Year 2017 Audit Plan: (A) Additions: The original audit plan was amended to add these required or requested audits and to allocate carryforward audits from the Reserve. (B) Deletions: The original audit plan was amended to delete the Alumni House Audit since related procedures were included in the Contract Audit and the Change in Management Physical Plant Audit and to delete the Financial Aid Audit since the Financial Aid office planned to request a Department of Education Desk Review. ***The completed all projects except the Campus Programs for Minors Audit which was in process at year end. Issues identified in FY 2017 engagements, the actions taken by management, and the current implementation status of each is summarized on the following pages to address HB 16 web site posting requirements. Benefits Proportionality Funding: Benefits Proportionality Audits for funding in fiscal years 2012, 2013 and 2014 were completed in prior years. The FY 2018 audit plan will be amended to include the required audit of fiscal years 2015, 2016 and Senate Bill 20: Senate Bill 20 (84 th Legislative Session) made several modifications and additions to Texas Government Code (TGC) and Texas Education Code (TEC) related to purchasing and contracting. Effective September 1, 2015, TEC requires that, The chief auditor of an institution of higher education shall annually assess whether the institution has adopted the rules and policies required by this section and shall submit a report of findings to the state auditor. The Office of Audit and Consulting Services conducted this required assessment for fiscal year 2017, and found the following: Based on review of current institutional policy and the UT System Board of Regents Rules and Regulations, The University of Texas at Tyler has generally adopted the rules and policies required by TEC Review and revision of institutional and System policies is an ongoing process. 6

7 II. Summary of Fiscal Year 2017 Audit Report Issues Report Name & Date Results and Recommendations Management Action Plan Status Joint Admission Medical Program October 2016 A committee should be convened to meet the requirements of the JAMP Agreement. A committee will be convened by January 31, Contract Administration November 2016 The Office of Legal Affairs should create departmental policies and procedures to document their responsibilities. The Office of Legal Affairs intends to draft a departmental policies and procedures manual by January 31, The Office of Financial Services should create departmental policies and procedures to document their responsibilities. Policies and Procedures will be developed by February 28, The Contract Management Handbook should be finalized and submitted for review as required. The Handbook will be finalized and submitted by February 28, The Management Responsibilities Handbook and the Standards of Conduct Guide should be updated. The documents will be amended by January 31, Contract routing and signature requirements should be included in Budget Authority Training. Financial Services employees should be reminded to obtain completed Contract Routing Form prior to issuing a purchase order. Information will be included in December 2016 training. Financial Services employees will be reminded to obtain completed Contract Routing form prior to issuing a Purchase Order. 7

8 II. Summary of Fiscal Year 2017 Audit Report Issues, Continued Report Name & Date Results and Recommendations Management Action Plan Status FY 2016 Annual Financial Report Newly appointed Budget Authorities should receive training. Budget Authority Training will be implemented by January Dec 2016 The Quality Assurance Review (QAR) process should be completed in accordance with the Internal Controls Monitoring Plan or alternative processes should be developed. The Office of Business Affairs will review and update, as necessary, the Internal Controls Monitoring Plan and related responsibilities. The Internal Controls Monitoring Plan implementation should be improved and related internal controls strengthened. The Internal Controls Monitoring Plan will be reviewed and updated February 28, Student Fees Expenditures March 2017 The Student Catalog should be updated to accurately include fee information. Guidelines for appropriate use of Instructional Support Fees should be developed and communicated. The catalog will be updated by May Detailed guidelines will be developed and communicated by May 15, The Student Union Advisory Committee should submit the required documents to the President. The documents will be submitted by May 15, All transfers not included in the originally approved budget should be approved by the President in writing or via and communicated to Student Advisory Committee. Documentation of approvals will be maintained and communicated. Fee committee information should be published. The committee information will be published by May Correct account codes should be used to process expenditures. Correct account codes will be used in the future. 8

9 II. Summary of Fiscal Year 2017 Audit Report Issues, Continued Report Name & Date Results and Recommendations Management Action Plan Status PeopleSoft FY 2016 to FY 2017 Balances Roll Forward The roll forward process should be completed timely and should be optimized by using data analytics. Budget Office will continue to use data analytics. The roll forward process should be completed by October March 2017 Differences should be identified in the unreconciled cost centers and correcting entries should be recorded. Reconciliations are scheduled to be completed by April 30, Texas Higher Education Coordinating Board Facilities Audit June 2017 Procedures should be developed and one office should be responsible for submitting required documents. Construction projects should be monitored and reported as required. The AVP for Facilities Management and Capital Planning will develop procedures by Aug 31, 2017, and submit documents, and monitor projects as required. The Physical Plant Department Change in Management August 2017 Departmental policies and procedures should be updated. A policy regarding campus renovations should be developed and communicated. Policies and procedures will be updated by October 31, A policy will be created and submitted for inclusion in the Handbook of Operating Procedures by October 31, In Process In Process Required details on projects should be obtained. All future projects will contain the required information. Purchase orders should be completed in compliance with policies. Future purchase orders will follow policies. Corrections should be made to transactions recorded incorrectly and future transactions should be processed with the correct account codes. The Budget Office will be contacted for necessary corrections by August 31, Future transactions will be processed correctly. 9

10 II. Summary of Fiscal Year 2017 Audit Report Issues, Continued Report Name & Date Results and Recommendations Management Action Plan Status Audit of Compliance with Texas Administrative Code 202 August 2017 Internal control compliance reports from external services providers should be reviewed. Policies and procedures should be developed for the secure management of university-wide authenticators. Risk assessments will be conducted to evaluate internal controls by July 31, Policies and procedures will be developed by May 31, In Process In Process Campus-wide system development life cycle policy that includes security considerations should be developed. System refresh guidelines will be developed by March 31, In Process The information security plan should be updated to include critical information systems. The Information Security department should review the plan for adequacy. IT will supply a list of critical systems by July 31, The plan will be reviewed by August 31, In Process Purchasing policies should be updated to include procedures for approving external services. IT will include procedures for approving external services by March 31, In Process The Information Security Policy should be updated to include information related to security assessments of university owned information systems. Policies and procedures will be developed February 8, In Process An automated process should be implemented requiring all users to sign the university s Acceptable Use Policy (AUP) annually or when updates are made throughout the year Employees will be informed and log on banners will be modified to include the date the AUP was changed. Departmental Account Reconciliations August 2017 The importance of completing account reconciliations by the required date should be communicated to all Budget Authorities and Administrative Assistants. The VPBA Office will communicate the importance to all Budget Authorities and Administrative Assistants. 10

11 III. Consulting Services and Nonaudit Services Completed Project Name and Date Engagement Objectives, Results, and Recommendations Faculty Recruitment Consulting Review February 2017 Review recruitment methods and resources to determine if a diversified pool of applicants is obtained and considered. Recruiting documents did not include information on applicants who were not interviewed; therefore, information was not available for analysis. Information on all qualified applicants should be included. To enable evaluation of the advertising resources, applicants should be asked to disclose the source they used to learn of the open positions. Foreign Travel and Recruitment Consulting Review Gather and analyze data to determine the resources used to recruit international students and the purpose of other foreign travel. February 2017 University Advancement Endowment Compliance Annual Report Determine if accurate and complete information is included in the Endowment Compliance Annual Report. The report included incorrect information. An amended report was submitted with corrections. Spending plans were not on file as required but were later obtained from responsible parties. February 2017 Export Controls Consulting Review August 2017 Review adequacy of policies and procedures related to Export Controls. Recommendations were made to communicate policies, conduct training, appoint and Export Controls Officer and implement a compliance program. IV. External Quality Assurance Review (Peer Review) An External Quality Assessment of the was completed by Baker Tilly with a report dated September 7, The summary letter is included on the following page. 11

12 12

13 Office of Audit Services V. Internal Audit Plan for Fiscal Year 2018 Project Name Budget Risk Based Projects Account Reconciliations 130 Change in Management - VP for University Advancement*, VP for Research*, VP for Marketing, Dean of Engineering, Director of International Programs*, Director of Human Resources, and others as changes occur 400 Financial Aid 50 Information Technology Administrative Privileges 50 Information Technology Access Management 50 PeopleSoft Balance Forward 60 Research Programs 200 Student Housing Revenues 200 University Advancement Endowment Compliance Annual Report 50 University Pines Housing Financial Review 150 Risk Based Projects Subtotal 1340 Required Audits (External and/or Internal) Annual Financial Report - UTS Assurance 150 Annual Financial Report - External Audit for FY Annual Financial Report - External Audit Interim Procedures for FY Senate Bill 20 Compliance Assessment 40 Risk Based Consulting Projects Required Audits Subtotal 290 Compliance Department Coordination and Assistance 120 Executive Management Consulting 150 Innovation Academy Annual Financial Audit and Board Meetings 40 PeopleSoft Assistance and Review 40 Southern Association of Colleges and Schools Accreditation Steering Committee (SACS) 50 Training Provided by Internal Audit to Institutional Departments and Employees 120 UT Tyler Institutional Committees and Meetings Preparation and Participation 160 Consulting Projects Subtotal 680 Investigations 300 Investigations Subtotal

14 Office of Audit Services V. Internal Audit Plan for Fiscal Year 2018 Continued Project Name Budget Follow Up Follow-Up: Quarterly procedures 280 Risk Based Reserve Follow Up Subtotal 280 Carry Forward of FY 2017 Audits and Additional Requests 215 Development - Operations General Reserve Subtotal 215 Internal Audit Annual Report 45 Annual Risk Assessment and Audit Plan 200 Computer and Software Maintenance and Updates 100 External Quality Assessment Review 50 External Quality Assessment Review - Recommendation Implementation 40 Institutional Audit Committee Meeting Preparation and Participation 300 Internal Quality Assurance and Improvement Program and Management of the Internal Audit Department 130 State Auditor's Office and UT System Requests and Meetings 180 Development - Initiatives and Education Development - Operations Subtotal 1045 Auditor Training and Continuing Professional Education 260 Professional Organizations and Presentations 80 UT System Audit Office Initiatives Participation 120 Development - Initiatives and Education Subtotal 460 Total Budgeted Hours

15 Office of Audit Services Other High Level Risks: High level risk areas that have been identified but are not included in the FY 2018 Audit Plan are as follows: Environmental Health and Safety Campus Police and Clery Act Reporting International Programs and Travel Student Housing Safety Fire and Building Code Compliance Athletics Safety Risk Assessment Process: The UT Tyler 2018 Audit Plan was prepared using a risk-based approach developed by the University of Texas System to ensure that areas and activities specific to UT Tyler with the greatest risk were identified for consideration to be audited. The goals for this risk assessment approach were to start with an awareness of critical initiatives and objectives to ensure the risks assessed were the most relevant. The risk assessment approach was based on a top-down process that included conversations and requests for input with risk collaborators, executives, and managers from the various operating areas on campus. The assessment process was standardized by creating common terms and criteria, enabling trending of risk and Systemwide comparisons. An emphasis was placed on collaboration with other functions that assess, handle, or manage risk. The risk assessment was reviewed and approved by members of executive management and the Internal Audit Committee. VI. External Audit Services Procured in Fiscal Year 2017 External Audit Services for the year ending August 31, 2017 were provided as follows: Deloitte conducted audit procedures related to the FY 2016 Annual Financial Report and interim procedures for the FY 2017 Annual Financial Report audit. Belt Harris Pechacek conducted an audit of the financial statements of The University of Texas at Tyler Innovation Academy for the fiscal year ended August 31,

16 Office of Audit Services VII. Reporting Suspected Fraud and Abuse Actions taken by The University of Texas at Tyler to comply with the following requirements are summarized below: Sec General Appropriations Act (84 th Legislature, Conference Committee Report) A state agency or institution of higher education appropriated funds by this Act, shall use appropriated funds to assist with the detection and reporting of fraud involving state funds as follows: 1) providing information on the home page of the entity's website on how to report suspected fraud, waste, and abuse involving state resources directly to the State Auditor's Office. This shall include, at a minimum, the State Auditor's Office fraud hotline information and a link to the State Auditor's Office website for fraud reporting; and 2) including in the agency or institution's policies information on how to report suspected fraud involving state funds to the State Auditor's Office. The University has a link for fraud reporting on the University s home page at which provides information on how to report suspected fraud, waste, and abuse involving state resources directly to the State Auditor s Office (SAO). This includes the SAO s fraud hotline, a link to the SAO s website, and UT Tyler s policies for reporting suspected fraud. Texas Government Code, Section Coordination of Investigations a) If the administrative head of a department or entity that is subject to audit by the state auditor has reasonable cause to believe that money received from the state by the department or entity or by a client or contractor of the department or entity may have been lost, misappropriated, or misused, or that other fraudulent or unlawful conduct has occurred in relation to the operation of the department or entity, the administrative head shall report the reason and basis for the belief to the state auditor. The state auditor may investigate the report or may monitor any investigation conducted by the department or entity. b) The state auditor, in consultation with state agencies and institutions, shall prescribe the form, content, and timing of a report required by this section. c) All records of a communication by or to the state auditor relating to a report to the state auditor under Subsection (a) are audit working papers of the state auditor. UT Tyler reports such activities to the State Auditor s Office via the following website: 16