APA Update CUAV Annual Conference

Transcription

1 APA Update CUAV Annual Conference April 25, 2016 Martha S. Mavredes Auditor of Public Accounts

2 Discussion Areas Implementation of GASB 68 Changes to NCAA Agreed Upon Procedures 2015 General Assembly Session 2016 General Assembly Session Results of FY2015 audits Upcoming changes to audits of SFA/R&D Upcoming changes for Fiduciary Activities Page 2

3 IMPLEMENTATION OF GASB 68 Page 3

4 Implementation of GASB 68 APA audited GASB 68 Schedules for VRS, SPORS, JRS, and VaLORS Only reports on our website for Teachers, Political Subdivisions and entities in the State plan that have a CPA firm auditing their financial statements APA issued an attestation report on management s assertions regarding the census data Page 4

5 myvrs Navigator Integrated System intended to manage employee data and calculate VRS benefits Business rules facilitate determination of VRS benefits Driven by HR transactions Manages member accounts and benefits for >300,000 members at >1,000 employers participating in 4 pension plans and 4 other employee benefit plans Page 5

6 myvrs Navigator Data Flow New hire keyed into the HR system The HR system may interface with the payroll system, but some agencies may have to dual key The changes are either keyed into myvrs Navigator or the agency uploads through a batch file myvrs Navigator generates a bill each month following the contribution confirmation Page 6

7 Reconciliation Required Purpose: to ensure data is properly reflected in myvrs Navigator for administration of VRS benefits Reconcile myvrs Navigator contributions due to contributions charged in payroll system Reconciliation process may differ based upon the size and complexity of the employer Page 7

8 Decentralized Agencies Batch Monthly: submit a file with new enrollments and data changes for existing members Online Manually update changes in myvrs Navigator as required by the agency s internal policies and procedures Page 8

9 Official Systems of Authority myvrs Navigator Human Resource System Payroll System Page 9

10 Reconciliation Steps The myvrs Navigator precertification process requires two parts Review the Snapshot Reconcile Payroll Information Review changes Ensure changes are accurate Contributions Benefit plan withholdings Page 10

11 Part 1 Generate the Snapshot Agencies can drill down through the myvrs Navigator application to review the data Option to download to excel and review all employees Option to review changes only The snapshot includes the totals for the plan(s) Agencies may participate in more than one plan; consider each plan (VRS & VaLORS) Page 11

12 Part 2 Consider payroll after gaining an understanding of HR and myvrs Navigator Payroll must be reconciled with myvrs Navigator Remember: myvrs Navigator processing frequency is monthly and payroll processing frequency varies Page 12

13 Contribution Confirmation: Payment VRS must receive the payment by the 10 th of the subsequent month Methods of Payment ACH Debit (preferred) ACH Credit CIPPS Payment is immediately scheduled following confirmation Generally ACH Credit has a longer processing time compared to ACH Debit Page 13

14 Contribution Confirmation: Concepts Receipt of the best data possible by the due date Does not mean perfect data Some member records require correction through data fix requests Employer should not hold confirmation until records are corrected Corrections will be retro-active to origination when completed Page 14

15 Access Role security was designed and established to accommodate organization of various size and complexity Only mandatory roles Primary Administrative Authority (PAA) VRS Administrator Security Administrator (SA) Page 15

16 Census Data Group 1 SSN, Name, Date of Birth, Gender Group 2 Organization Name, Employment Status, Start Date, End Date, Job Name Creditable Compensation, Service Credit, Contributions Page 16

17 CHANGES TO NCAA AGREED UPON PROCEDURES Page 17

18 NCAA Agreed Upon Procedures What Hasn t Changed Due January 15 th each year All Division I institutions, Division II institutions once every three years Page 18

19 NCAA Agreed Upon Procedures What Has Changed? New line items and new definitions for existing line items Additional information added to supplement the Schedule New reporting requirements (will show certain line item variance explanations in AUP report) Materiality thresholds Page 19

20 GENERAL ASSEMBLY SESSIONS Page 20

21 2015 General Assembly Session HB 1897 HB 1897 Requires a standardized reporting framework for Athletics revenues and expenses Requires institutions to maintain subsidy percentage below a certain level Page 21

22 Subsidy Percentage Subsidy Percentage represents the portion of institutional funding/student fees allocated for athletics as a percentage of total athletics revenue Page 22

23 What are the percentages? Page 23

24 When is this effective? We will begin to report on subsidy percentages for the fiscal year ended June 30, 2017 The NCAA Reporting Framework used to ensure consistent calculation is published on the APA website Financial Reporting Guidance.pdf Schedule Template Formatted.xlsx Page 24

25 NCAA Reporting Framework Page 25

26 When will we audit/report? No change for Division I institutions Division II institutions each year during financial statement Once out of every three years will be performed in Fall for reporting before January 15 th deadline Division III institutions each year during financial statement audit Page 26

27 2015 General Assembly Session IMPLEMENT JLARC RECOMMENDATIONS Effective Date Institutions are not required to follow all recommended guidance for FY15 Institutions should follow guidance for FY16 as a trial run for FY17 Page 27

28 2015 General Assembly Session, continued IMPLEMENT JLARC RECOMMENDATIONS a. The Boards of Visitors at each Virginia public four-year higher education institution, to the extent practicable, shall: 1. require their institutions to clearly list the amount of the athletic fee on their website's tuition and fees information page. The page should include a link to the State Council of Higher Education for Virginia's tuition and fee information. The boards should consider requiring institutions to list the major components of all mandatory fees, including the portion attributable to athletics, on a separate page attached to student invoices; 2. assess the feasibility and impact of raising additional revenue through campus recreation and fitness enterprises to reduce reliance on mandatory student fees. The assessments should address the feasibility and impact of raising additional revenue through charging for specialized programs and services, expanding membership, and/or charging all users of recreation facilities; Page 28

29 2015 General Assembly Session, continued 3. direct staff to perform a comprehensive review of the institution's organizational structure, including an analysis of spans of control and a review of staff activities and workload, and identify opportunities to streamline the organizational structure. Boards should further direct staff to implement the recommendations of the review to streamline their organizational structures where possible; 4. require periodic reports on average and median spans of control and the number of supervisors with six or fewer direct reports; 5. direct staff to revise human resource policies to eliminate unnecessary supervisory positions by developing standards that establish and promote broader spans of control. The new policies and standards should (i) set an overall target span of control for the institution, (ii) set a minimum number of direct reports per supervisor, with guidelines for exceptions, (iii) define the circumstances that necessitate the use of a supervisory position, (iv) prohibit the establishment of supervisory positions for the purpose of recruiting or retaining employees, and (v) establish a periodic review of departments where spans of control are unusually narrow; and, Page 29

30 2015 General Assembly Session, continued 6. direct institution staff to set and enforce policies to maximize standardization of purchases of commonly procured goods, including use of institution-wide contracts; 7. consider directing institution staff to provide an annual report on all institutional purchases, including small purchases, that are exceptions to the institutional policies for standardizing purchases; 8. participate in national faculty teaching load assessments by discipline and faculty type. Page 30

31 APA Follow-Up We will begin to review institutional progress with fiscal year 2016 audits (Summer/Fall 2016) Page 31

32 2016 General Assembly Session Commonwealth Data Point 2. The database shall contain the following for each of the 10 most recently ended fiscal years of the Commonwealth: b. The number of full-time state employees and a listing of the positions and salary of each such position, organized by agency; Page 32

33 2016 General Assembly Session, continued 4. The Auditor of Public Accounts shall incorporate in the database the following enhancements: a. Graphs, charts, or other visual displays of aggregated data showing (i) current state spending by expense category, (ii) year-to-year state spending, and (iii) other data deemed appropriate by the Auditor, including display of available line item expenditures; and b. Frequently asked questions and their responses Page 33

34 RESULTS OF FY2015 AUDITS Page 34

35 Statewide Audit Results Study of the Usage of Sub-recipient Schedule of Expenditures of Federal Awards 2015 State of Information Security in the Commonwealth of Virginia Review of the Commonwealth s Mobile Devices Review of Agency Performance Measures Single Audit Page 35

36 Study of the Usage of Sub-recipient Schedule of Expenditures of Federal Awards Commonwealth expends approximately $13.5 billion in federal funds annually. Approximately $2.5 billion is passed through to non-state entities creating a subrecipient relationship. Selected 15 of 37 agencies that reported disbursements to sub-recipients. Page 36

37 Results of testing Page 37

38 Analysis of Statewide Sub-recipients Pooled the disbursement to non-state subrecipients to determine which received over $500,000. (245) Searched Federal Audit Clearinghouse to determine if they had an audit completed. (225 audits were located) 20 did not have a Single Audit. Page 38

39 Issues Raised Of 225 single audits, 46 were reviewed by all agencies disbursing awards to the subrecipient. Remaining 179 were either not reviewed at all or by only some of the agencies that disbursed awards to the sub-recipient. Agencies do not have access to other agencies pass-through information so difficult to know if an entity should have a single audit Page 39

40 Recommendations Agencies work with DOA to update the Federal Grants Management requirements and set expectations for confirming that sub-recipients met their audit requirements. DOA develop statewide reports to identify which sub-recipients received more than $500,000 Consider adding CFDA numbers to Cardinal Page 40

41 Agencies / Findings Information Security Findings by Fiscal Year Agencies with findings Agencies without findings Total findings issued Fiscal Year Page 41

42 Agencies Tested Resulted in Finding Information Security Findings by Major Control Area % 100% 40 80% 30 60% % 20% 0% Resulted in Finding # Agencies Tested Page 42

43 Agencies Tested Resulted in Finding Findings by Major Infrastructure Application 18 70% % 50% 10 40% 8 30% 6 20% % Database Web Application Review Operating System VPN Security Firewall Mobile Device Security 0% Resulted in Finding # Agencies Tested Page 43

44 Review of the Commonwealth s Mobile Devices In January 2013, VITA issued the first comprehensive set of standards governing the management and use of mobile devices. 18 out of 24 agencies and institutions of higher education surveyed do not have adequate internal policies and procedures over mobile devices Page 44

45 Wireless Billed Services Verizon Sprint/Nextel AT&T US Cellular NTelos VENDOR $ 9,578,150 $11,395,510 1,076, , , , , ,566 USA Mobility Wireless, Inc. Grand Total 31,690 62, , ,228 $11,812,382 $12,774,440 Page 45

46 Internal Controls over Mobile Devices Entity Count of devices as of 12/2013 Assignment of devices Evaluation of need Safeguarding Monitoring Usage of mobile devices Acceptable Use Agreement Identification on devices CWM 34 N N N N N N N GMU 602 Y Y Y Y Y Y Y NSU 343 N N N N Y N N NVCC 181 Y Y Y Y Y Y Y UVA 144 Y Y Y N Y Y N VITA 357 N N N N N N N VSU 218 Y Y Y N Y Y Y VT 1,701 Y Y Y Y Y Y Y Legend: Y Adequate policies and procedures related to this control N Inadequate policies and procedures related to this controllated Page 46

47 USAGE EVALUATION AND COST ANALYSIS For Higher Ed institutions using pooled plans, VSU had 117,600 pool minutes available in a year and only used 21, % unused Commonwealth had $558,436 in overage charges, and VT was in the top 5 with $21,344 in overages None of the Higher Ed institutions had significant domestic/international roaming charges or significant unused devices Page 47

48 Full Priced Purchases of Mobile Devices Agency Name Total Cost Count of Devices NSU 2,499 4 GMU 1,099 3 VSU VT Non-Higher Ed 18, Grand total $23, Page 48

49 Capital Projects Cash Flow Requirements 2 nd Annual Report on cash flows requirements for projects in Chapter 806 Advisory Committee meets quarterly to evaluate capital projects Expenditures have stayed within the $250 million annual limit Found delays in obtaining planning funds from the Central Capital Planning Fund Page 49

50 Central Capital Planning Fund Funding Analysis Page 50

51 Page 51

52 Page 52

53 Review of Agency Performance Measures FY 2012 FY 2014 Key Measures Productivity Measures Other Agency Measures 1, Total Performance Measures 1, Page 53

54 Virginia s Performance Measurement Structure Page 54

55 Issue Highlighted in Report Measures developed by administration for inclusion in the Executive Agreements did not conform to DPB s guidelines for developing performance measures. Half did not conform to the guidelines Some could not be readily measured Page 55

56 Governance over Enterprise Applications Strengthen the governance over enterprise applications by establishing a Deputy Chief of Staff position with responsibility over governance along with a group of legislative representatives and executive branch data stewards to advise the Deputy in: establishing a Commonwealth strategic direction over enterprise applications, setting long-term goals, prioritizing system replacement and upgrade, and providing transparency of their choices via a six-year plan. Page 56

57 Review of eva and Cardinal Interface Efforts The current efforts to integrate the Cardinal finance module and eva procurement system are expected to cost $8 million and provide an interface for only roughly 11,000 transactions annually, resulting in a cost that outweighs the efficiency and transparency benefits it would add. Page 57

58 Projects Currently Under Way Travel Study Part 2 under way Comparative Report for Higher Education under way Financial Reporting Systems in the Commonwealth - under way; issue date in the fall Voyager Gas Card Study - put on hold and will try to include in the next work plan Page 58

59 2015 Single Audit: 110 Total Findings IT System Security Configuration Controls IT Access Controls Federal Award Findings and Questioned Costs - Not IT Risk Management and Contingency Planning Retirement System Member Data Financial Reporting IT Information Security Program IT Third-Party Providers IT Security General Controls IT End-of-Life Technology Statement of Economic Interests IT Physical Access Controls IT Information Security Officer Independence Payroll IT Change Management IT Audit Plans Application Controls Systems Security Revenues Procurement Other Inventory Fixed Assets and Leases Page 59

60 2015 Single Audit: 69 IT Findings IT System Security Configuration Controls IT Access Controls IT Risk Management and Contingency Planning IT Information Security Program IT Third-Party Providers IT Security General Controls IT End-of-Life Technology IT Physical Access Controls IT Information Security Officer Independence IT Change Management IT Audit Plans Page 60

61 Single Audit Results for Higher Ed - Summary # of Institutions Subject of Finding # Findings 2 IT System Security Configuration Controls 4 1 Access Controls 1 5 Federal Award Findings and Questioned Costs (no f/s impact) 2 Retirement System Member Data 2 1 Inventory 1 1 Procurement 1 9 Page 61

62 Completed 2015 Audits for Higher Education College of William & Mary and Richard Bland College Norfolk State University University of Virginia and Medical Center Virginia Commonwealth University Virginia Polytechnic Institute and State University Virginia State University Page 62

63 2015 Audit Results for Higher Ed - Details IT Issues # Findings System Security Configuration Controls 5 Access Controls 4 Information Security Program Controls 3 IT Server Maintenance and Management Controls 1 IT Asset Surplus and Sanitization Controls 1 Page 63

64 2015 Audit Results for Higher Ed - Details Federal Issues # Findings Return of Aid 3 Enrollment Reporting 2 Reconciliation of Federal Accounts 2 Disbursing Aid 2 Foundation Reimbursement for Employee Time 1 Page 64

65 2015 Audit Results for Higher Ed - Details Other Issues # Findings Retirement System Member Data 4 Procurement and Accounts Payable 4 Personnel and Payroll 3 Asset Inventory 2 Financial Reporting 1 Financial Analysis 1 Page 65

66 UPCOMING CHANGES TO AUDITS OF SFA/R&D Page 66

67 Change to Audit Approach for Student Financial Aid Under Uniform Guidance (CFR 200), we had to rethink how we determine major programs Financial aid will become a major program once every 3 years assuming it remains a low risk type A program Page 67

68 Coverage Agency Number Agency Name Approximate Percent of Coverage 207 UVA 8.4% 208 VT 8.8% 212 VSU 3.7% 213 NSU 3.3% 216 JMU 5.9% 217 RU 3.8% 221 ODU 8.6% 236 VCU 14.5% 247 GMU 10.3% 280 NVCC 6.5% 295 TCC 5.2% Total 79.2% Page 68

69 Remaining Institutions Audits will coincide with five-year and tenyear reaffirmation of accreditation in accordance with timelines published by the Southern Association of Colleges and Schools Commission on Colleges (SACSCOC) Page 69

70 Track A Institutions that do not issue graduate degrees. The ten year reaffirmation for these schools occurs in June of the reaffirmation year. The five year reaffirmation for these schools occurs in December. Audit work will be timed to include financial aid coverage in the audit used for the review Page 70

71 Track B Institutions that issue graduate degrees and include all four-year institutions except VMI and UVA-Wise Ten year reaffirmation for Track B institutions occurs in December of the calendar year, five year in June. Audit work will be timed to include financial aid coverage in the audit used for the review Page 71

72 Billings For the 11 institutions included in the Single Audit, the billings will be done in the Spring after issuance of the single audit report First year for all in cycle is FY2018 so billings in spring 2019 For institutions with financial aid work to support reaccreditation, the bill will not include the central single audit allocation. Page 72

73 Research and Development R&D will be a major program every 3 years starting in 2017 First billing with new cycle will be Spring 2018 Page 73

74 UPCOMING CHANGES FOR FIDUCIARY ACTIVITIES Page 74

75 Fiduciary Activities The Exposure Draft proposes that a government would be considered to control assets that may be associated with a fiduciary activity if the government holds the assets. To be the assets of a fiduciary activity, the GASB is proposing that they cannot come solely from a government s own-source revenue. Page 75

76 Fiduciary Activities, continued The government would be engaged in a fiduciary activity if those assets meet at least one of these four criteria: assets are administered through a trust assets are for people who qualify as beneficiaries for reasons other than being the government s residents or service recipients assets are for entities that are neither a part of the government s financial reporting entity nor recipients of its services Page 76

77 Fiduciary Activities, continued assets come from a pass-through grant for a program in which the government does not have administrative or direct financial involvement Three fund types would be used only to report assets held in trusts: Pension (and other employee benefit) trust funds Investment trust funds Private-purpose trust funds Page 77

78 Fiduciary Activities, continued Proposing that funds not held in trust would be reported as a new type of fiduciary fund custodial funds. Custodial funds also would include what governments are now reporting as agency funds. Agency funds report resources held temporarily before being passed along to their intended recipients Page 78

79 Custodial Funds If assets meet the proposed definitions and criteria, a government would be required to report them in fiduciary fund financial statements. However, based on cost-benefit considerations, the GASB has proposed an exception related to custodial funds for business-type activities (BTAs) such as public colleges and universities and utilities. Page 79

80 Custodial Funds Exception If a BTA has assets and corresponding liabilities that it would be required to report in a custodial fund, but those assets are expected to be held for 3 months or less, the BTA may report the assets and liabilities in its own SNP instead of in a fiduciary fund. Report significant additions to and deductions from those assets as operating cash inflows and outflows in the statement of cash flows. Page 80

81 Questions? Page 81