INTERNAL AUDIT OFFICE

Transcription

1 A&I 2/20/14 Discussion Item 1 INTERNAL AUDIT OFFICE February 12, 2014 To: Members of the Audit and Insurance Committee John Hardin, Chair Sonny Beck Vanessa Castagna Fr: P. L. Fish, Director of Audits Re: The projects planned for 2014 cover a wide array of risks and opportunities. The plan is intended to maximize limited internal audit resources and provide reasonable coverage that aids the Board of Trustees, leaders, and managers in discharging governance, executive, and management responsibilities. The enclosed plan provides a summary of the anticipated use of internal audit resources during It is aligned with the University s enterprise risk management initiatives. Enclosure c: Chairman Tom Spurgeon Vice Chairman Mike Berghoff President Mitch Daniels Treasurer Al Diaz Provost Tim Sands Assistant Treasurer Jim Almond Corporate Secretary Janice Indrutz Legal Counsel Steve Schultz Freehafer Hall of Administrative Services 401 S. Grant St. West Lafayette, IN (765) Fax: 9765)

2 The purpose of this report is to provide information about the 2014 planned audit activity. This report, in conjunction with the 2013 Calendar Year Annual Report, fulfills the annual reporting requirements of the Bylaws of the Trustees of Purdue University. AUDIT PLAN DEVELOPMENT Risk drivers considered in the development of the audit plan included: new technologies strategic changes data integrity and security unexpected operating results research and intellectual property major changes in operations or systems human resources potential risk of financial loss size and complexity of operations major changes in programs, controls, or staff increased regulatory scrutiny and accountability operations subject to a high level of public scrutiny Other factors: o validation of the most significant processes, activities, and functions that impact each campus, college, or operational area o identification of risks that have the highest potential to prevent achievement of objectives o assessment of the effectiveness of the management control structure to mitigate identified risks o assessment of the effectiveness of services supporting the University s strategic direction including functions such as human resources, information technology, and contract development o evaluation of the risk of fraud and awareness of fraud referral processes The scope of the audits may be adjusted to address significant changes that occur throughout the year. The plan is designed with flexibility to facilitate unanticipated strategic or operational initiatives. AUDIT RESOURCE ALLOCATION Planned Allocation of Audit Resources Estimated Project Hours Percent of Total Audits (Planned) 10,035 75% Audits (Unplanned) 1,980 15% Client Research 425 3% Non-Client Contact 948 7% Total 13, % Total audit coverage (planned and unplanned) is estimated at 90%. Fifteen percent (15%) of total projected audit resources have been reserved for unplanned audits. This will allow for flexibility in addressing emerging risks, anonymous allegations, and requests by governance bodies, management, and others. Approximately three percent (3%) of staff total resources are budgeted for client research. This category includes providing risk or control input to various University areas, determining the impact of regulations or standards, researching specific information at management s request, and overseeing the anonymous reporting program. Non-client contact, seven percent (7%), consists of office support, business continuity planning, and professional development. Strategic, regulatory, technological, and emerging trends in higher education dramatically affect what is audited. Emerging expectations for alignment of internal audit and risk oversight exist. Trends in the profession of internal auditing include globalization, talent and organizational issues, and technological advancement. Information provided by the Institute of Internal Auditors (IIA), 1

3 the Association of College and University Auditors (ACUA), the American Institute of Certified Public Accountants (AICPA), the Association of Certified Fraud Examiners (ACFE), and the Information Systems Audit and Control Association (ISACA) also aid staff in gaining knowledge of current trends and issues impacting higher education. Seventy-three (73) audits totaling 9,620 audit hours are planned, as well as twelve (12) follow-up audits from the prior year totaling 415 audit hours. When the follow-up work occurs during the same year of the audit, these hours are incorporated with the audit. The following reflects the plan by campus/area. Planned Direct Audit Hours by Campus/Area Planned Audit Hours Planned Number Calumet Calumet Follow-up 85 2 Fort Wayne 1,375 9 Fort Wayne Follow-up North Central North Central Follow-up 25 1 West Lafayette 6, West Lafayette Follow-up Related Organizations External Coordination Internal Audit coordinates and provides a single point of contact for external audits. We also assist management in coordinating responses pertaining to these audits. The 2014 risk categories mirror those nine (9) shown in Purdue s enterprise risk management initiatives, higher education risk categories. The risk assessment impact measures were also considered. Higher Education Risk Categories Risk Assessment Impact Measures Reputation Strategic (not aligned with the strategic plan) Safety (loss of life) Interruption (in mission critical activities) Fiscal (incurred cost and lost opportunity) Because audits generally cover multiple risk categories, the sixty-four (64) campus audits have been classified accordingly. The general audit description and associated numbers of audits are shown within brackets [ ]. Athletics, Safety and Facilities, 2.2% [Athletic Camps(1)] 2

4 3 Internal Audit Office Athletics, 3.9% [Ticket Sales (3), Operations (1)] Academic and Student, Financial, Regulatory, 6.6% [Residency (1), Operations (Clinics)(2)] Academic and Student, Financial, 3.6% [Bad Debt Analysis (1), Continuing Studies (1), and Loan Fund (1)] Academic and Student, Information Technology, and Regulatory, 3.6% [HIPAA Security Rule (2)] Academic and Student, Information Technology, 13.0% [Student System Application (4), Academic Infrastructure (1)] Academic and Student, Regulatory, Research, 1.3% [Outside Activity (1)] Academic and Student, Regulatory, 3.0% [Eligibility Documentation (1), FERPA (1)] Academic and Student, 5.4% [Credit (1), Contracts (2), Scholarships (1)] Engagement, 1.1% [Cooperative Extension Services (1)] Financial, Human Resources, Information Technology, 1.3% [Time Keeping System (2)] Financial, Human Resources, 0.8% [Leave (1)] Financial, Information Technology, 1.6% [Housing System (1)] Financial, Regulatory, 5.9% [Debt (1), Contracts(2)] Financial, 12.7% [Financial Reporting (1), Cash Controls (2) Inventory (1), Investment (1) Procurement (3), Travel (1)] Human Resources, Regulatory, 1.0% [Health Reform (1)] Human Resources, Safety and Facilities, 0.5% [Background (1)] Information Technology, 26.2% [Backup and Recovery (4), Change Control (1), Configuration Management (1), Emerging Technologies (1), Identity and Access Management (1), Production Readiness (1), Security Logging (1) Storage Management (1), Technology Infrastructure (3)] Regulatory, Research, 2.4% [Export Controls (1), Restricted Expenditures (1)] Regulatory, Safety and Facilities, 0.1% [Operations(1)] Safety and Facilities, 3.8% [Camps (1), Construction (1), Operations (1)] The Internal Audit Office communicates its audit plan with external auditors to ensure that broader coverage is achieved through the internal and external audit plans. The audit plan is based on the following staffing: Director of Audits Peg Fish, MS in Management, CIA Information Systems Audit Manager Robert Oxender, MS in Computer and Information Science, CISA, CISSP, CPA Associate Auditor Data and Information Technology Josh Gillam, CISA (pending experience) Audit Manager Jeff Tatum, CIA Auditor Susan Cearing, CSSA Associate Auditor Alex Quinn, CPA (pending experience) Principal Auditor, Special Projects Wendi Johnston, CRISC Senior Auditor Deb Martin, CPA, CFE, CGMA Three (3) high-risk audit areas were identified but not included in the 2014 plan based on existing resources. During 2014, an effort will be made to utilize external services in support of this coverage. These include:

5 Information Systems Application Controls Financial System Information Systems Application Controls Human Resources System Network INITIATIVES, GOALS, AND PRIORITIES Initiatives for 2014 include continued alignment with risk oversight, dynamic change in the riskcentric audit approach, and facilitating the University s enterprise risk management program. Monitoring of the anonymous reporting program and coordination of the University s external audits are also part of audit s function. Goals 1. Create and promote a university-wide risk and control infrastructure consciousness which ensures integrity in the University s operating environment. 2. Initiate activities which result in added value for the University Priorities a) identify waste, fraud, and abuse via various mechanisms including the anonymous reporting program b) facilitate the University s enterprise risk management program c) communicate, train, and educate a) maintain a state of the art audit framework which assures audit effectiveness b) continue with a risk-centric audit approach c) quantify cost savings, where possible d) identify opportunities to improve effectiveness and efficiencies 3. Deliver customer/stakeholder value and satisfaction. a) maintain a flexible audit approach b) ensure that the audit plan is aligned with strategic initiatives c) communicate promptly with customers and/or stakeholders 4. Employ technological tools and techniques. a) utilize data mining techniques b) track audit status and progress c) recognize organizational trends 5. Identify alternative workforce strategies appropriate for the complexities of higher education Risks and Challenges in Meeting Goals 1. Maintaining staffing expertise given rapidly changing higher education landscape including regulations, technologies, and strategic direction a) benchmark internal audit workforce strategies in higher education and other business sectors, where possible b) ensure that continuing professional education opportunities meet career objectives and the needs of internal audit c) benchmark salaries d) implement rapid development strategies Strategies to Meet or Mitigate a) continuing professional education b) co-sourcing/partnering strategies c) alternative workforce strategies d) compliance with auditing standards 2. Technology a) data mining tools b) audit software 3. Space a) space utilization b) remote connectivity 4