AGENDA ECU Board of Trustees Audit Committee Meeting Medenhall Student Center April 15, I. Approval of February 25, 2010 Minutes Action

AGENDA ECU Board of Trustees Audit Committee Meeting Medenhall Student Center April 15, 2010 I. Approval of February 25, 2010 Minutes Action II. Enterprise Risk Management Report Mr. Tim Information Wiseman III. BSOM Compliance Office Report Mr. Ken Information Deville IV. Internal Audit Report Ms. Stacie Tronto a. Revised 2009/2010 Audit Plan Action b. Revised Audit Committee Charter Action c. Dashboard/ Metrics Update Information d. External Audits Information e. UNC FIT Monitoring Visit Results Information f. Administrative Items Information V. Other Business

Minutes from ECU BOT Audit Committee February 25, 2010 East Carolina Heart Institute Conference Room Committee members present: Joel Butler-Chair, Ken Chalk, Carol Mabe, Bob Greczyn Others present: Steve Ballard, Philip Rogers, Chris Locklear, Donna Payne, Stacie Tronto, Tim Wiseman, John Chinn, Joan Kavuru, Beth Wood, Lynne Sanders, and Ray Whitby Chairman Butler convened the meeting at 8:35 a.m. and read the conflict of interest provisions as required by the State Government Ethics Act. Mr. Butler asked if anyone would like to declare a conflict of interest. Hearing none, he asked for the approval of the minutes for the February 25, 2010 Audit Committee meeting. The minutes of the February 25, 2010 were approved with no changes. Dr. Steve Ballard updated the Committee on the status of the University Policy Manual. He introduced Philip Rogers and Chris Locklear as the co-chairs of the University Policy Committee, which is overseeing the implementation of the University Policy Manual. Dr. Ballard provided background information on the policy infrastructure and the framework the University is utilizing to implement the appropriate infrastructure. Mr. Butler introduced three special guests from the North Carolina Office of the State Auditor. The Honorable Beth Wood, Ms. Lynne Sanders, and Mr. Ray Whitby were invited to the Committee meeting to provide comments regarding the ECU Financial Audit for 2009. Ms. Wood made opening remarks and Mr. Whitby reported on the outcome of the financial audit for 2009. There were no instances of significant deficiencies with regard to the financial audit for 2009. Mr. Whitby was very complimentary of the cooperation received from ECU staff. Ms Sanders explained the elements of a fiscal control audit. Fiscal control audits are internal control and/or compliance reviews that do not take into account materiality. The State Auditor s Office identifies topics that would be of value to the University. Mr. Butler thanked the guests for taking time out of their busy schedule to attend ECU s Audit Committee meeting. Ms. Tronto provided a report on Internal Audit. The Audit Committee bylaws and charter were presented to the Committee for discussion to include risk management in the bylaws and charter. Ms. Tronto informed Mr. Butler that an Audit Committee vote was not needed for the change that Board Chairman David Brody would need to approve the change. Mr. Butler will confer with Board Chairman David Brody regarding the change to the bylaws. Ms. Tronto will update the Audit Committee Charter and the change will be approved at the next meeting. Ms. Tronto presented current dashboard metrics regarding the completion of the annual audit plan and management s corrective actions. As of February 2, 2010, 35% of the audit plan has been completed; 33% is in progress,

and management has satisfactorily resolved 94% of audit observations. As required by UNC policy regarding associated entities, Ms. Tronto reported on the external audits of the East Carolina University Alumni Association, the East Carolina University Educational Foundation, and the East Carolina University Medical & Health Sciences Foundation. Ms. Tronto updated the Committee on the establishment of the UNC FIT Internal Audit Advisory Team, which was established to provide feedback from an internal audit perspective regarding UNC FIT. Ms. Joan Kavuru updated the Committee on the activities of the Brody School of Medicine Compliance Office. During this transition period while searching for a Chief Compliance Officer, Mr. Ken Deville is serving as the Interim Compliance Officer. They have added two coder positions and are forging ahead with the compliance plan. Dr. Nick Benson provided an update on the search for the Chief Compliance Officer. The person selected for the position had to decline due to a family matter and the search committee is starting a new search. Mr. Tim Wiseman reported on the activities of Enterprise Risk Management. Dr. Ballard spoke to the ERM Committee in March and Mr. Ken Chalk will speak at the next ERM Committee meeting. Mr. Wiseman stated he will be developing a playbook for the ERM Committee explaining what the expectations are of each committee member. Mr. Wiseman reported that he will be reviewing benchmarks at other universities regarding ERM and plans to visit Texas A&M and attend an ERM Summit. Mr. John Chinn provided an update on the Conflict of Interest policy and forms. The forms and policy have been approved and an online version will be implemented next year. Under other business, Ms. Donna Payne announced two position changes in the University Attorney s office. Ms. Kitty Wetherington has returned to the University and Dr. Greg Hassler will be taking a faculty position. With there being no further business, the Audit Committee meeting was adjourned at 10:00am. Respectfully submitted by Stacie Tronto

Enterprise Risk Management Risk Survey March 2010 Instructions to participants: Thank you for taking the time to complete this brief survey. It is important that we receive responses from all enterprise risk management committee members and other selected participants. Please return the completed survey to Mr. Tim Wiseman (or Ms. Kim Walters), NLT Tuesday, March 30, 2010 so that the results can be compiled for the April ERMC meeting. The completed surveys can be emailed back to wisemanw@ecu.edu or waltersk@ecu.edu. They may also be faxed to our attention at 737 1596. *** Survey *** Name Department Position Date Completed 1. Of the major risk categories (Strategic, Operational, Financial, Compliance, and Reputational), which category do you consider the most prominent and applicable to your current position at ECU? 2. What do you feel is the #1 enterprise risk concern in your primary risk category (identified in question #1 above) area? 3. Why is this your #1 concern (for example: frequency or likelihood of occurrence, inadequate monitoring/controls, high consequence/cost of incident, other)? 4. Thinking about ECU as an enterprise, what is your biggest risk concern other than the issue identified in Question #2, from any of the five risk categories? 5. Related to your answer to Question #4, why did you choose this risk area/issue (for example: frequency or likelihood of occurrence, inadequate monitoring/controls, high consequence/cost of incident, other)? 6. Many of our risks are a result of flawed or outdated processes. If ECU was to address one single process or subprocess in a dedicated business process review to effect change/improvement, what process would you nominate?

East Carolina University Office of Internal Audit Annual Engagement Plan By Type FY 2009-2010 As of 03/20/10 Project Budget Budgeted Revised %age Actual %age Current Risk # of Description Number Status Hours Bud Hrs of Total Hours of Total Variance Status Ranking Obs Operational Audits: EAGLE Assessment CYP 800 0 0% Cancelled High Dining A10036 CYP 700 700 8% 2 0% 698 In Progress High Housing CYP 700 700 8% Pending High UNC FIT Financial Aid A10017 BF 1000 445 5% 472 8% (27) In Progress High UNC FIT Contracts and Grants A10037 BF 1000 440 5% 274 5% 167 In Progress High UNC FIT Payroll BF 700 0 0% Pending High UNC FIT Purchase to Pay BF 700 0 0% Pending High UNC FIT General Acctg., & Fin Reporting A09019 WIP 60 60 1% 84 1% (24) Completed High 0 Graduate School A09013 WIP 200 200 2% 364 6% (164) Completed High 5 Continuing Studies A09026 WIP 300 300 4% 111 2% 189 In Progress High Total Operational Audit Hours 6160 2845 33% 1306 23% 839 5 Compliance Audits: Title IX - Athletics A09025 WIP 400 725 8% 899 16% (174) In Progress High Total Compliance Audit Hours 400 725 8% 899 16% (174) 0 Information Technology Audits: Disaster Recovery 2009 CYP 100 100 1% Pending High 2nd Follow-Up State IT Audit L10021 CYP 100 100 1% 68 1% 32 Completed High 1 ITCS Log Review Processes and Privileged User Acct CYP 240 240 3% Pending High University's Mobile Computing Practices CYP 120 120 1% Pending High Total Information Technology Audit Hours 560 560 7% 68 1% 32 1 Special Reviews: Special Reviews - Pending (1000) CYP 280 180 2% Pending Use of Resources - Dental Clinic L10018 CYP-B 100 150 2% 207 4% (57) Completed High 8 Nephrology - Misuse of State Time L10020 CYP-B 100 100 1% 163 3% (63) In Progress Low Reporting Misuse L10014 CYP-B 40 40 0% 5 0% 36 In Progress Low Nursing - Misuse of State Time L10012 CYP-B 100 100 1% 294 5% (194) Completed High 4 ECU PD Alleged Liability Issue L10010 CYP-B 20 20 0% 102 2% (82) Completed Low 1 ECU PD Compromised Security L10011 CYP-B 20 20 0% 13 0% 7 In Progress Medium BSOM Grant Issue L10003 CYP-B 100 100 1% 215 4% (115) Completed High 4 Recreation and Leisure Studies L10001 CYP 200 200 2% 294 5% (94) Completed Medium 6 International Affairs Issue L09004 WIP 100 100 1% 51 1% 49 Completed High 2 Athletics Procard L10033 CYP-B 100 150 2% 161 3% (11) In Progress High Review of Employee Entry/Exit Processes L08052 WIP 40 40 0% 0 0% 40 In Progress High Math Grant L10045 CYP-B 40 40 0% 41 1% (1) In Progress Low OAP Resource Use L10046 CYP-B 100 100 1% 35 1% 66 In Progress High 2nd Follow-Up OSA 2006-07 Reportable Conditions L09028 WIP 40 40 0% 50 1% (10) Completed High 0 Total Special Review Audit Hours 1380 1380 16% 1628 29% (428) 25 Follow-Up Reviews: University Policies and Training (L08031) BF 40 40 0% Pending High Maritime Studies (L08030) F10030 BF 40 40 0% 78 1% (38) Completed Low 0 Readmission of Student (L08020) BF 40 40 0% Pending High EAGLE (L08060) F10050 AYP 0 80 1% 15 0% 65 In Process High O/S 06/07 Audit - 2nd FU Radiation Onc. (N07015) F10042 CYP 40 40 0% 3 0% 37 In Process High O/S 07/08 Audit - 2nd FU Stud Life MC (L07035) F10006 CYP 20 20 0% 65 1% (45) Completed Low 0 O/S 07/08 Audit - 2nd SOA Issue/Keys (L07007) F10009 CYP 40 40 0% 25 0% 15 Completed Low 1 Fundraising Events (L08008) F10029 CYP 10 10 0% 4 0% 7 Completed Low 0 Moving Expenses (L07055) F10049 CYP 40 40 0% In Progress Low CHSC Employee Expenses (L08011) F10052 CYP 40 40 0% 7 0% 33 Completed Low 0 Petty Cash Controls (L09005.2) F10016 CYP 40 40 0% 11 0% 30 Completed High 0 Accounts Payable (A07020) F10023 CYP 100 100 1% 7 0% 94 In Progress High Chemistry Payroll & Admin (L08021) F10025 CYP 40 40 0% 36 1% 5 Completed Low 1 Chemistry Purchases & Inventory (L08058) F10026 CYP 40 40 0% 92 2% (52) Completed Low 0 University Cashier's Office (A08010) F10032 CYP 20 20 0% 23 0% (3) Completed High 0 REAP Expenses Review (L09014) F10031 CYP 100 100 1% 147 3% (47) Completed Medium 1 Biology Research (L08036) F10048 CYP 20 20 0% 8 0% 12 Completed Medium 0 ECU PD (L09041) F10047 CYP 10 10 0% 4 0% 6 Completed High 0 O/S 06/07 Audit - Friends of Joyner (L05039) F09043 WIP 20 20 0% 23 0% (3) Completed Low 0 Total Follow-Up Review Audit Hours 700 780 9% 545 10% 115 3 Budget Status: BF = Brought Forward From Previous Year's Plan AYP = Added to Current Year Plan CYP = Current Year Plan CYP-B = Current Year Plan (Budgeted under Special Reviews - Pending) WIP = Work-In-Progress Page 1 OF 2

East Carolina University Board of Trustees Audit Committee Charter Background All constituent institutions of the University of North Carolina (UNC) are required by State law to have their financial audit conducted by the North Carolina Office of the State Auditor. Historically, the Office of the State Auditor has not performed non-audit services, including those prohibited by the Sarbanes-Oxley Act. The Office of the State Auditor determines staff assignments for individual audits, including rotation of Audit Managers for each audit client. Purpose To assist the East Carolina University Board of Trustees in fulfilling its oversight responsibilities for (1) the integrity of the University s financial statements, (2) the University s compliance with legal, regulatory, and ethical requirements, (3) the performance of the University s internal audit function, and (4) the University s compliance with the Best Financial Practices Guidelines adopted by the UNC Board of Governors in November of 2005. The Audit Committee has jurisdiction over internal audit, enterprise risk management, compliance, conflicts of interest, and ethics. Organization The Audit Committee shall be a standing committee of the ECU Board of Trustees. Each Committee member must be independent of management and free of any relationship that would impair such independence. If practicable, at least one member of the Committee should be a financial expert. A financial expert is someone who has an understanding of generally accepted accounting principles and financial statements; experience in applying such principles; experience in preparing, auditing, analyzing, or evaluating financial information; experience with internal controls and procedures for financial reporting; and an understanding of the audit committee function. If feasible, the role of financial expert will be rotated on an annual basis. Meetings The audit committee shall meet at least four times a year and hold additional meetings as circumstances require. The Committee will invite representatives of management, auditors, legal counsel, and others to attend meetings and provide pertinent information as necessary. The Committee will receive reports regarding internal audit, enterprise risk management, compliance, conflicts of interest, and ethics. It will also hold private meetings with the Director of Internal Audit if deemed necessary. Meeting agendas will be prepared and provided in advance to members, along with appropriate briefing materials. Minutes of the meetings will be prepared.

Duties and Responsibilities The following shall be the principal duties and responsibilities of this Committee: Per UNC-BOG: Meet at least quarterly during the year. Review the results of the annual financial audit with the North Carolina State Auditor or his designated representative. Discuss the results of any other audit performed and report/management letter (i.e. information system audits, investigative audits, etc.) issued by the North Carolina State Auditor with either the State Auditor or his staff, the Director of Internal Audit, or appropriate campus official. For any audit finding contained within a report or management letter issued by the State Auditor, review the institution s corrective action plan and receive a report once corrective action has taken place. Discuss the results of any audit performed by independent auditors and, if there were audit findings, review the institution s corrective action plan and receive a report once corrective action has taken place. Review all audits and management letters of University Associated Entities as defined in section 600.2.5.2[R] of the UNC Policy Manual. Receive quarterly reports from the Director of Internal Audit that, at a minimum, reports material (significant) reportable conditions, the corrective action plan for these conditions and a report once these conditions have been corrected. The Director of Internal Audit reports to the Chancellor with a clear, recognized reporting relationship to the chair of the BOT Audit Committee. Receive, review, and approve the annual audit plan for the internal audit department. Ensure that all internal audits were conducted in accordance with professional standards. Receive and review an annual summary of audits performed by the internal audit department. Ensure the Director of Internal Audit forwards copies of both the approved audit plan and summary of internal audit results to UNC General Administration in the prescribed format. Other: Review and concur in the appointment, replacement, or dismissal of the Director of Internal Audit and the compensation package. Meet privately with the Director of Internal Audit as deemed necessary. Review and assure the internal audit function has appropriate budget and staff resources. Review and accept internal audit reports when issued. Periodically review and revise the internal audit charter as needed.

Resolve disagreements between internal audit and management concerning audit findings and recommendations. The Committee, with the assistance of the Director of Internal Audit should periodically review and assess the adequacy of the Audit Committee Charter. Approved by ECU BOT Audit Committee September 09, 2008

Dashboard/Metrics Update As of 03/20/10 Completion of 2009-10 Audit Plan: Goal =? Status of Audit Plan Number of Audits % of Total Plan Completed 24 50% In Process 19 40% Pending** 5 10% Total 48 100% **For purposes of reporting, the total for pending audits does not match the approved audit plan as three audits are included in the 2009/2010 audit plan but will be deferred until later. These audits/projects include: UNC FIT Purchase to Pay UNC FIT Payroll Quality Assurance Assessment Productivity Ratios: Goal = 70% Direct Hours 72% Indirect Hours 28% Management s Corrective Actions: Goal = 90% Completed Outstanding % Complete % Outstanding Observations by Division: Academic Affairs 15 0 100% 0% Administration and Finance 10 1 91% 9% Chancellor 2 0 100% 0% Health Sciences 1 0 100% 0% Research & Graduate Studies 3 0 100% 0% Student Life 1 0 100% 0% University Advancement 2 0 100% 0% Total Observations 34 1 Total Percentages 97% 3%