TEACHERS RETIREMENT BOARD CONSENT: ATTACHMENT(S): 1. DATE OF MEETING: June 8, 2016/ 15 mins

Transcription

1 TEACHERS RETIREMENT BOARD AUDITS AND RISK MANAGEMENT COMMITTEE Item Number: 5 SUBJECT: Audit Services Annual Risk Assessment CONSENT: ATTACHMENT(S): 1 ACTION: INFORMATION: DATE OF MEETING: / 15 mins PRESENTER: Larry Jensen PURPOSE This item summarizes Audit Services Fiscal Year (FY) annual risk assessment results. The purpose of the annual risk assessment is to identify and assess the risks of achieving the organizations objectives and to propose audits for FY BACKGROUND As required by the International Standards for the Professional Practice of Internal Auditing (IIA Standards), Audit Services must establish risk-based plans to determine the priorities of the internal audit activity consistent with the organization s goals and objectives. Risk assessment is a systematic process for assessing and integrating professional judgments about probable adverse conditions and/or events. The following diagram illustrates the risk assessment and audit plan preparation process: Audit Universe External factors Internal factors Strategic Plan Risk Report Management input Past audit results Risk Assessment Identify risk universe Apply risk factors Assess risk impact, likelihood and velocity Score auditable entities Develop Risk Based Audit Plan Develop complete listing of prioritized auditable entities Identify Employers within each risk rank Identify other audit activities Allocate audit resources Obtain Audit Plan Approval CalSTRS Executive Management Review Present proposed audit plan to Audit and Risk Management Committee Obtain Audit and Risk Management Committee Approval ARM 19

2 Page 2 ANALYSIS Audit Services conducts an annual risk assessment using two different models, one for employer audits and the other for internal audit services. Employer Risk Assessment The employer audit risk assessment process begins with discussion of potential employer, member, and compensation spiking risk areas. The employer audit team obtains and assesses inputs, and obtains and analyzes reported payroll data during the last two fiscal years to determine the potential risk factors. Audit Services conducted a risk assessment of all 1,751 employers who report member census and payroll data to CalSTRS. This information is stored within the CalSTRS corporate database: the START system. The Los Angeles Unified School District (LAUSD) was excluded from this risk assessment process due to the extent of audit coverage and the results of the LAUSD s audits performed during the last two years. Audit Services completed 15 separate audits of the LAUSD with another four audits in process. Of the 15 LAUSD completed audits, ten audits did not have any findings. All other school districts/employers are included in the risk assessment universe and considered separate auditable entities. Audit Services analyzed, tabulated, and ranked the auditable entities using 12 predetermined risk factors. For each risk factor, Audit Services rated and assigned each entity a risk value using numeric values of 1 (low risk) to 5 (high risk) based on the risk factor s potential occurrence and impact. Of the 12 risk factors, three are associated with potential spiking, and three relate to high amounts of reported compensation. Five of these six risk factors are assigned a greater weight than the other risk factors. The risk factor values are then applied to each auditable entity in the audit universe. See Attachment 1 of this agenda item for a comprehensive list of risk factors, assigned risk values, and descriptions. The following 12 risk factors were applied to each auditable entity: Risk Factors: 1. Retirees with large increases in compensation while active 2. Retirees with high monthly earnings while active 3. High special compensation 4. Significant increases in compensation for active members 5. Members reported as non-members 6. Retirees with excess sick leave days 7. No prior audits in the last five years 8. Active members nearing retirement with large increases in compensation 9. Retirees with sick leave exceeding possible accumulated leave earned 10. Actives with reported pay rate exceeding $250,000 annually or $20,834 monthly 11. More than 1,500 active members 12. PEPRA active members exceeding PERPA compensation limits (firsttime members on or after January 2013) ARM 20

3 Page 3 Each individual risk factor score was applied to each applicable auditable entity. For instance, 460 auditable entities received a score for Risk Factor 1 - Retirees with increased annual compensation earnable greater than 10 percent (while active). Table 1 Reporting Units by Risk Factors Number of Reporting Units Reporting Units by Risk Factor Score Risk Factors The auditable entities are then divided into three risk categories (high, medium, and low) based upon total score values. This risk ranking process provides a logical and equitable method of prioritizing each auditable entity for audit coverage. For a summary of the risk assessment results, see Table 2. Table 2 Number of Entities by Risk Categories School/Employer High-Risk Medium-Risk Low-Risk Total Community Colleges County Superintendents K12 Schools K12 / Charter Schools State Agencies (Dept. of Ed, Corrections, and Commissions) Regional Occupational Centers Grand Total ARM 21

4 Page 4 This risk ranking process provides an equitable method of prioritizing each auditable entity for audit coverage. Based on available staff resources, Audit Services plans to conduct 55 full-scope employer audits, five direct reporting compliance audits, and three limited scope/focused audits during Fiscal Year The number of completed Employer Audits progressively increased from 15 audits in fiscal year , to a projected 55 audits in Fiscal Year , as shown in Table 3 below. Audit Services will select the 55 employer audits during Fiscal Year using the following methodology: 71 percent of audits will be from High Risk = 39 (39 / 55) 11.7 percent of entities assessed as of high risk will be audited (39 audits / 333 entities) 20 percent of audits will be from Medium Risk = 11 (11 / 55) 1.4 percent of entities assessed as medium risk will be audited (11 / 758) 9 percent of audits will be from Low Risk = 5 (5 / 55) 0.7 percent of entities assessed as low risk will be audited (5 / 660) Audit Services will perform full-scope employer audit coverage on 3.1 percent (55 / 1751) of the auditable employer universe. Over the past four fiscal years, including next fiscal year, Audit Services will have provided audit coverage to approximately 37.6 percent of the active member population. Audit Services will continue to consider special requests and referrals. Table 3 Number of Employer Audits Completed by Fiscal Year Number of Audits Completed Number of Employer Audits Completed Fiscal Year ARM 22

5 Page 5 Internal Audit Risk Assessment The internal audit risk assessment begins with obtaining information from various sources such as CalSTRS Strategic and Business Plans, Enterprise Risk Management (ERM) Report, interviews with executive and senior management, prior year audit results, legislative and regulatory changes, industry benchmarks, economic factors, external evaluation results, and auditor s professional judgment. The results of the risk assessment prioritize the risks that may affect achievement of strategic and operational objectives. When an organization has an ERM program, best practices recommend building upon that framework to obtain an understanding of the risk the organization is managing. As part of the ERM process, CalSTRS executive management produces an ERM Report that identifies business objectives, risks associated with achievement of those objectives and risk rankings using three common ratings: impact, probability, and velocity. Audit Services worked with senior management from each division to identify which risks from the ERM Report dated December 31, 2015 affect the achievement of a business unit objective within their respective divisions. Senior management also identified the risks of accomplishing the objectives outlined in the draft strategic plan presented to the board in February 2016, as well as other significant operational risks. Senior management was asked to rank each risk linked to the strategic plan and the operational risks using the ERM risk rating criteria and then further rank each of their respective business unit risks using the following five risk factors: Level of Complexity and Degree of Management Judgment The level of complexity and/or degree of judgment required to complete the business activities/functions. Degree of Business Change Change in internal processes or procedures, key personnel, or implementation of new information technology systems. Level of Dollar Value or Volume of Transactions The greater the dollar or volume of transactions processed, the greater the risk. Potential Opportunity for Fraud Potential opportunity for fraud would create significantly adverse reputational and/or financial impact if fraud occurred. Potential Impact on CalSTRS Reputation Potential impact on external customers would create exposure or adverse publicity. ARM 23

6 Page 6 Audit Services shared the risk assessment results with each branch executive for their respective divisions to confirm the risk assessment results. The risk universe is then sorted in descending order based on its aggregate score. Audit Services then evaluated the top risks to determine if it should be included in the Proposed Audit Plan. The results of the risk assessment are displayed in the following table: Areas of Highest Risk Proposed Audit Plan Audited within Prior 3 Years Information Security Cloud Computing Security Incident Response Plan Members Appeal Rights Unauthorized Building Access START Maintenance and Processing Payment of Benefits Member Data Internal Controls Program Allocation of Investment Values Accounting for Investment Agreements Employee Safety and Health HR Investigations Disaster Recovery Site Location Implementing Pension Solution (change management, integration with existing systems, financial reporting, staff resources) Migrating Data from START to Pension Solution Pension Solution System Internal Controls Workforce Planning (key staff dependencies, workload, vacancies, succession) Fraud Contracts Issuance and Management Employee Separation Voluntary Defined Contribution Plan Manual Processes to use START Dependence on accurate START information Maturing ERM - risk appetite etc. Cash forecasting and management ARM 24

7 Page 7 Audit Services contracts with external audit firms to conduct investment and information technology audits because of the specialized knowledge and expertise required. An external firm conducts an audit of each investment asset classes and the associated portfolio risk on a rotating four-year cycle. Information Technology Services conducts a separate risk assessment. Audit Services reviews the risk assessment and works with Technology Services executive management to identify audits that address the highest risks to be included in the annual audit plan. Areas of Highest Risk Investments: Fixed Income Real Estate Private Equity Global Equities Innovation and Risk Corporate Governance Inflation Sensitive Investment Policy Compliance Information Technology: Availability of Mission Critical Systems Technical Infrastructure IT Staff Recruitment & Retention Maintaining New Pension Solution Project Management System Back-up and Recovery Proposed Audit Plan Audited within Prior 3 Years DISCUSSION Audit Services seeks input from the Audit, Risk Management Committee on the risks identified and proposed audits. Audit Services utilizes the results of the risk assessments in the development of the FY risk based audit plan (See Agenda Item #5). ARM 25

8 Attachment 1 Audits and Risk Management Committee Item 5 Page 1 Table 1 Risk Factors, Assigned Risk Value, and Description # Risk Factors Risk Value (1-5) (Low - High) 1 Retirees with increased annual compensation earnable greater than 10 percent (while active) 2 Retirees with monthly compensation earnable greater than $ Special compensation of $2,500 or more Description 4 Employers with members who retired during the last two years and received over 10percent increase in compensation during fiscal year or Employers with retirees who retired during fiscal year or that had monthly compensation earnable greater than $8,333 (while active). 4 Employers reported members' special compensation of $2,500 or more during fiscal year or Active members with increased annual compensation earnable greater than 20 percent 5 Members reported as nonmembers 6 Retirees reported with excess sick leave days 3 Employers reported active members with increases greater than 20 percent in annual compensation earnable during fiscal year or Employers reported members as non-members during fiscal year or Employers with members who retired during fiscal year or with excess sick leave. 7 Prior audits 1 Employers not audited during the last five fiscal years through Active members that are eligible to retire with increased annual compensation earnable greater than 10percent 4 Employers reported active members with birthdays prior to January 1, 1961, that had increases greater than 10 percent in annual compensation earnable during fiscal year or Retirees reported with total sick leave days greater than basic service credit multiplied by Active members with reported pay rates exceeding IRC 401(b)(17) earnings limitation 11 Number of active members of 1,500 or more 12 Active PEPRA members exceeding PERPA compensation limits 3 Employers who reported retirees total unused sick leave days greater than basic service credit multiplied by 10 that retired during fiscal year or a) Employers reported member monthly pay rates exceeding $20,834 during fiscal year or b) Employers reported member annual pay rates exceeding $250,000 during fiscal year or Employers with active members of 1,500 or more during fiscal year Active members who became members on or after January 1, 2013, whose annual earnable was at least $137,941, or monthly earnable was at least $11,496 in fiscal year ARM 26