Florida Polytechnic University Audit and Compliance Committee Board of Trustees March 15, 2017

Transcription

1 Page 59 AGENDA ITEM: IX Florida Polytechnic University Audit and Compliance Committee Board of Trustees March 15, 2017 Subject: Report of Internal Auditor Proposed Committee Action Recommend approval of the Report of Internal Auditor to the Board of Trustees. Background Information Larry Burke, Internal Auditor, will provide the committee with an internal audit report on Workday Implementation and the Anti-Hazing Contract. Please note that Sunera has officially changed their company name to Focal Point Data Risk, LLC. Sunera was approved to conduct the internal audit by the Board of Trustees on September 9, Supporting Documentation: 1. Internal Audit Memo: Workday Implementation Review 2. Internal Audit Memo: Anti-Hazing Contract Review Prepared by: Mark Mroczkowski, CFO and Vice President

2 Page 60 Internal Audit Memo Workday Implementation Review The following was performed based on our agreed upon procedures as this was not a financial audit. OBJECTIVE Management requested an internal audit review of the planned Workday HCM, Financials and Payroll implementation for Florida Polytechnic University ( University ), including the critical business processes and planned procedures. PROCEDURES Internal Audit performed the following procedures: 1. Interviewed key personnel from the University project team and Sierra-Cedar Inc. (the implementation partner) to gain an understanding of the planned business process procedures and configurations. 2. Obtained access to Workday and reviewed current system configurations and process flows for each critical business process demonstrated by the project team. Determined whether the planned Workday configurations and process flows are aligned correctly to support the critical business processes. 3. Identified key risks in the planned configurations of Workday thus far in the project. RESULTS We interviewed keyed personnel from the project team, including a representative from Sierra- Cedar Inc., System Administration, IT Security, Human Resources, Payroll, Procurement, Project Management, Accounting, and Grants/Awards. This team demonstrated key Workday configurations within the testing environment in conference room pilot. We were also giving Workday access and inspected the corresponding workflows within the system. We reviewed the configurations for each demonstrated functional area, and considered business process risks associated with each area. The following are observations and recommendations resulted from our review:

3 Page 61 Process Configuration Recommendation HR/ Payroll: Terminations Workday is configured to alert key personnel (HR, IT Security, Budget Managers, Benefits, Payroll) upon termination of an individual. These University team members have specific procedures to perform related to the termination; all procedures must be complete prior to the final payout to the terminated employee. The current configurations do not require sequential performance of such procedures, and do not alert Payroll that all necessary procedures have been performed. The final payout for a terminated employee is dependent upon completion of a series of tasks. Each task is required before Payroll performs the final payout. We recommend a sequential workflow be utilized within Workday, with an alert to Payroll upon completion of all activities. Projects: Approvals New construction projects are routed by the system to the Project Manager for approval, then to Construction Accounting for asset and budget creation. The current system configuration does not require a separate reviewer for any projects created by the Project Manager. To prevent the same individual from approving their own project configure a workflow based on the project creator s title. Procurement: Contracts Procurement contracts with vendors can be entered and tracked within Workday. The system has fields for contract expiration, and alerts can be configured to warn Procurement of upcoming expirations. While these fields can be utilized, they are not required fields. Contraction Expirations and alerts should be required by the system to allow for better monitoring and timely renewal of contracts, without disruption of suppler goods or services.

4 Page 62 Process Configuration Recommendation Employee Expenses: Requirements University employee expenses must first be authorized within the system via a Spend Authorization prior to the actual expense. After the spend authorization is approved, the employee completes their transaction and enters the expense within Workday. The screens within Workday link to various external websites with Florida State governance. There is currently no plan to monitor external links within Workday. A plan should be created for regular maintenance of any external links to ensure employees have access to the current state guidelines. Employee Expenses: Spend Authorization Approval In addition, spend authorizations are routed to multiple people for approval, including the Budget Manager, Project Coordinator, Project Manager, Principal Investigator, Award Contract Specialist, Manager, Cost Center Manager, Accounting Manager, Provost, Controller, and President. Thresholds should be configured into workflows to route to the appropriate agency head who oversees the corresponding fund for approval. Spend requests should be routed to only appropriate approvers based on dollar value, rather than all parties for every request. Awards/Grants: Entry Workday has been configured for the Award Contract Specialist to enter all awards, including grants. The system allows the Specialist to enter restrictions on the award, however, those restrictions are not currently configured to limit or impact budgets etc. tied to the award. The project team should leverage the functionality of the restrictions entered into Workday; the system should be configured to reference those restrictions and apply them to related schedules, budgets, purchases, etc. CONCLUSION After review of the Workday configurations and interviews with key personnel, internal audit noted that the current configurations and planned activities will support the University s critical business processes. The configurations will mitigate key business risks and support the University s control environment. We recommend an additional review of the final configuration closer to the go-live date. July 5, 2016

5 Page 63 Distribution List: Mark Mroczkowski Don Wilson, Chair ) Tom O Malley, Vice Chair (tom@boiloil.net) Richard Hallion (trusteehalliom@aol.com) Larry Burke, Sunera Partner Joyce Block, Sunera Partner APPENDIX A Interviewees/Inquiries The following University personnel demonstrated Workday configurations for this engagement: Personnel Jackye Maxey Jolene Scaglione Angela Debose Shelley Wells DeAnn Doll Jeanne Viviani David Calhoun John Irvine Derek Horton Arlene Gallagher David O Brien Shannon Medley Title Director Special Projects ERP Engagement Manager Associate Director System Analyst & Mgmt Director HR Associate Director HR Contracts and Grants Manager Director of Campus Development & Facilities Analyst, Financial Reporting University Controller Business Administrative Specialist Director of Procurement Payroll & Tax Manager

6 Page 64 Internal Audit Memo Anti-Hazing Contract Review OBJECTIVE Management requested an assessment of the Anti-Hazing contract awarded by Florida Polytechnic University ( University ) to Hazing Solutions in order to determine if the contract was appropriate based on University purchasing guidelines. PROCEDURES Internal Audit identified the people and processes associated with awarding and monitoring of the Hazing Solutions ( Vendor ) contract and performed the following: 1. Interviewed key personnel from the University and Vendor to determine how the contract was awarded and the selection criteria considered. 2. Determined if conflicts of interest existed or were disclosed. 3. Determined whether policies and procedures governing the University Contracting and Purchasing Department activities were followed. 4. Inspected invoices and other supporting documents related to the contract to determine if payments and terms are aligned with terms outlined and agreed upon. 5. Evaluated that the Vendor delivered services that meet the contract specifications. RESULTS 1. On 03/14/2016, internal audit met with Rick Maxey (University Government Relations Director) to discuss the contract awarded to the Vendor, Educational Management Services (dba Hazing Solutions). Additionally, we inquired with David O Brien (University Director of Procurement) regarding the contract. Based on our discussions, we determined the following: a. Mr. Maxey stated that he was the main Director involved with the procurement of the Hazing Solutions contract with the assistance of Kim Kennedy (University Executive Assistant). Mr. Maxey first heard about Hazing Solutions through Eva Parker (Former COO, University) during the 2014 legislative session. Hazing Solutions was considered for an anti-hazing course contract through a competitive bid process for UCF in When he learned that there were funds for an online anti-hazing course appropriated for the 2015 budget year, he performed an online search for companies that provided this service and

7 Page 65 determined that Hazing Solutions aligned with the University requirements for an anti-hazing course. b. There were three companies considered for the services based on a document obtained from Mr. O Brien. Per section 4.1 in the University s Purchasing Manual, training and education services are not subject to the competitive solicitation process. On 07/20/2015, four University employees had a conference call with various members of the Hazing Solutions organization to discuss their approach for the services. Per Mr. O Brien, after fair consideration and comparison to other companies, the contract was awarded to Hazing Solutions and fully executed on 08/31/ Based on our inquiry with Mr. Maxey, there were no disclosed conflicts of interest. Additionally, we subsequently performed social media searches to determine if any parties involved in the contract execution were acquainted and did not discover any conflicts of interest. 3. We determined that for the execution of this contract, policies and procedures governing the University Contracting and Purchasing Department activities were followed. 4. We inspected two invoices related to the contract and determined that Hazing Solutions was appropriately billing the University for the amount agreed upon in the contract on the correct dates. At the time of the contract review, only two payments had been remitted by the University, which agreed to the timeline agreed upon in the contract. 5. Mr. Maxey further stated that while the state budget appropriation was for the development of an anti-hazing course, there was no stipulation that required State of Florida universities to implement the program, nor was there a requirement for students to complete the course. However, individual universities can create specific rules regarding the required completion of this course for their students. Mr. Maxey stated that the course has been fully implemented at five State of Florida universities at the time of the discussion (FL Poly, FGCU, FIU, UWF, and New College of Florida). CONCLUSION After review of the contract and through discussions with integral personnel that assisted in the procurement of Hazing Solutions, it appears the contract was awarded within the guidelines of the University s purchasing department.

8 Page 66 APPENDIX A Interviewees/Inquiries The following University personnel were interviewed for this engagement: Personnel Rick Maxey David O Brien Kim Kennedy Title Director Government Relations Director of Purchasing Executive Assistant References The following documents were inspected: 1. Independent Contractor Agreement between Florida Polytechnic University and Educational Management Services 2. Purchasing Manual o Section 4.1, A-10 Training and education services are exempt from the competitive sealed bid requirements 3. Implementation of Specific Appropriation 137 in the GAA for the State of Florida (Purchasing Review of Companies)