University of California Report to The Regents For the Year Ended June 30, 2004

Transcription

1

2 PricewaterhouseCoopers LLP Suite 1600 Ten Almaden Blvd. San Jose CA Telephone (408) Facsimile (408) September 30, 2004 To The Regents of the University of California We have recently completed the audit of the financial statements of the University of California (the University ) and reported on them, as well as on the separately issued financial statements of related entities, including the University s five medical centers and Retirement System funds. In planning and performing our audits of the various financial statements of the University, we considered the University s internal control structure in order to determine our auditing procedures for the purpose of expressing our opinion on the financial statements. As part of our audit, we made a study and evaluation of the University s system of internal controls to the extent we considered necessary to evaluate the system as required by auditing standards generally accepted in the United States of America. Although our audit was not designed to provide assurance on the internal control structure and its operation, we noted certain matters that we are submitting for your consideration designed to help the University make improvements and achieve operational efficiencies. As in prior years, we issued separate letters with our comments and recommendations to each of the campus Chancellors and laboratory Directors. Comments relative to the national laboratories have been issued under separate cover. The comments contained in this letter are summaries of those comments which generally represent common themes across the campuses and medical centers, or are significant. Management at the campuses and medical centers has responded and, where appropriate, are taking corrective actions to our comments. The full text of all our comments is contained in separately issued letters and available under separate cover. Our comments reflect our desire to be of continuing assistance to the University. We look forward to discussing these matters with you at the November 2004 Regents meeting. Please contact Michael Schini at (408) if you have any questions regarding this report. This letter is intended solely for the information and use of The Regents Committee on Audit, management and others within the University. Very truly yours,

3 Table of Contents Page No. CURRENT YEAR COMMENTS 1. Improve Controls over Use of Spreadsheets Campus 1 2. Improve User Access Administration Certain Campuses and Medical Centers 2 3. Improve Procedures over the Recording of Unusual Gifts University-wide 3 4. Consider Improving Procedures over the Recording of Unrecorded Liabilities 4 Certain Campuses and Medical Centers APPENDIX A. Status of Prior Years Comments 6-7

4 CURRENT YEAR COMMENTS CAMPUS 1. Improve Controls Over Use of Spreadsheets Observation During the course of our audit procedures at one campus, we noted an error in a spreadsheet which resulted in the campus posting an adjustment of approximately $1 million. While we know that many organizations rely on spreadsheets as a key tool in their financial reporting and operational processes, there needs to be a balance between their ease of use and flexibility, and the importance of reliable information for management s use. Recommendation We have recommended that management consider the processes and controls over the use of spreadsheets. The following steps may assist in this assessment of this process: Inventory spreadsheets Evaluate the use and complexity of spreadsheets Determine the necessary level of controls for key spreadsheets Evaluate existing as is controls for each spreadsheet including consideration of existing supervisory reviews Develop action plans for remediating control deficiencies Management Response Management will perform an evaluation to ensure the campus has appropriate processes and controls over the use of financial and analytical spreadsheets. 1

5 2. Improve User Access Administration Observation During the course of reviewing certain IT systems at a number of campuses and medical centers, we noted several instances where terminated users still had system access. In addition, we noted that some new system users did not have new user access forms as evidence of access approval, yet they still had system access. If changes in employee status are not consistently acted upon, there is an increased risk that unauthorized activity may occur. Not having a timely and reliable process in place to ensure prompt removal of user access increases the risk of unauthorized access to sensitive systems. Unauthorized or unintended access can increase the potential risk of malicious or inadvertent behavior which may have an adverse financial impact. Recommendation We have recommended to certain of the campuses and medical centers that they take steps to improve their user access administration procedures. Management should ensure changes in employees status are consistently communicated to all individuals and operators responsible for updating system access and security control lists. Management Response Each of the impacted campuses and medical centers has agreed to implement actions to address the risks identified above. 2

6 3. Improve Procedures Over the Recording of Unusual Gifts Observation As the UCSF Controller's Office was reviewing the value of a land contribution for its Mission Bay project as part of the year-end closing process, UCSF management determined that a related contribution of land made in 1999 had not been properly valued. The UCSF Controller's Office worked in conjunction with UCOP Corporate Accounting, the UCOP Real Estate Group, the UCSF Development Office and the UCSF Budget Office to review the history of these land transactions and confirm the appropriate value and financial reporting treatment for the year ended June 30, In the event of purchases, sales, or gifts of real estate, we understand that two communications are sent from UCOP to the campus - the initial communication comes directly from the Real Estate Group as the transactions occur throughout the year, followed by a secondary communication from the UCOP accounting department to the local capital asset accountant at the campus that summarizes the transactions twice each year. As with donations of real estate, other gifts-in-kind are received during the year and must be properly valued and recorded on each campus. Recommendation We have recommended that UCOP reinforce the process with campuses to ensure that appropriate actions are taken at a local level to record gifts-in-kind on an accurate and timely basis. In addition management at UCSF should review the current local procedures in place to ensure that unusual gifts, such as land, are recorded in the appropriate period at the appropriate value Management s Response Effective with the June 30, 2005 year, UCOP Corporate Accounting will add a specific step to the fiscal closing process for the campuses to consider whether all gifts-in-kind have been properly valued and recorded in the campus financial statements. 3

7 4. Review Procedures over the Recording of Unrecorded Liabilities Observation While we noted that procedures exist at all campuses and medical centers to identify unrecorded liabilities up to the closing of the general ledger, extended procedures beyond that date to identify any unrecorded liabilities may not occur at certain campuses and medical centers. Without a methodology to account for these items, accounts payable balances may be understated on the financial statements. We recommend that the existing methodology used at campuses and medical centers be reviewed. Recommendation We recommend that these campuses review their methodology to record accruals for unrecorded liabilities that have not yet been identified as of the date of the closing of the general ledger. Management s Response Each of the campuses and medical centers will review their existing procedures and amend them as necessary with the objective of capturing additional accruals in connection with the year end closing. 4

8 APPENDIX 5

9 Appendix A STATUS OF PRIOR YEARS COMMENTS Management takes the responsibility for tracking the implementation status of prior year management letter comments. We are informing you of management s progress in implementing the prior year recommendations. COMMENTS ORIGINATIING IN FY03 University-wide Consider use of Build-up Certifications Medical Centers Third Party Settlement Accounting Documentation Standards and Consultation with Legal Counsel Consider Performing an Independent Physical Inventory of Capital Assets at Certain Medical Centers National Laboratories DOE Reporting Reconciliation of DOE Trial Balance at the Lawrence Berkeley Laboratory Manual Journal Entries at the National Laboratories Reconciliation of Inventory Accounts at the Los Alamos Laboratory Campus Reconciliation of Payroll and Benefits Accounts at the Berkeley Campus COMMENT ORIGINATING IN FY02: Medical Centers Continue Monitoring Health Insurance Portability And Accountability Act Regulation Modifications COMMENTS ORIGINATING IN FY01: Medical Centers Continue Efforts To Ensure The Medical Centers Compliance With HIPAA 6

10 Appendix A COMMENTS ORIGINATING IN FY00: University-Wide Professional Fee Billing and Corporate Compliance Program Research Compliance Program In Progress Medical Centers Assess HIPAA Readiness at Each Medical Center 7