Office of Internal Auditing

Transcription

1 Office of Internal Auditing

2 FY 2017 Annual Report Page Intentionally Blank

3 CONTENTS Executive Summary... 4 Introduction... 5 Personnel/Proficiency/Professional Development... 6 Resources - Allocation... 7 FY18 Goals and a Vision for the Road Ahead... 8 FY17 Project Details... 9 Outstanding Issues & Follow Up... 9 Ethics Hotline & Investigations Quality Assurance & Improvement Mandatory Disclosures... 13

4 EXECUTIVE SUMMARY The Office of Internal Auditing s (OIA) activities for the year are summarized as follows. Special thanks to the President s Office and the Board of Trustees Audit and Compliance Committee for their support to our unit. Projects Issued four (4) internal audit reports. Completed one (1) quality assurance review. Completed one (1) consulting review. Launched an awareness campaign and communicated the UNF Ethics Hotline. Follow Up The department actively followed up on outstanding audit recommendations. Management is remediating risks in a timely manner. Other Items Audit personnel passed job related certification examinations! Audit personnel served in leadership roles to The Institute of Internal Auditors and the Association of College and University Auditors. Personnel The University hired the director of internal audit on August 29, Further, the senior internal auditor positon was filled October 24, The Office was fully staffed with a director, IT internal auditor, senior internal auditor and office manager by November Projects Personnel Statistics Authorized Audit FTE 4 Total # Staff 4 The following table shows the number of recommendations issued per audit. Five (5) reportable items remained in progress to remediate at the end of the fiscal year. Recommendations Issued Audit Critical Notable Osprey Opportunity /Minor Total Distance Learning Fee Audit Performance Based Funding DAVID AUD - COEHS Dean's Office 7 7 Total University of North Florida Office of Internal Auditing 4

5 INTRODUCTION This report is the Office of Internal Auditing s Annual Report to the Board of Trustees (the Board) for the 2017 fiscal year. Contained herein is information regarding the Office of Internal Auditing personnel such as education and professional development, financial resources, audit engagements, open items follow up, and performance measurements. The Office of Internal Auditing assists the Board by providing services designed to evaluate the organization s risk mitigation policies, procedures and practices. In order to perform the role effectively, organizational independence from management is required. As a result, the OIA reports functionally to the Board via the Audit and Compliance Committee and administratively to the University President. Internal Auditing s support role is best expressed by the following definition from The Institute of Internal Auditors: University of North Florida Office of Internal Auditing 5

6 PERSONNEL/PROFICIENCY/PROFESSIONAL DEVELOPMENT The University of North Florida has numerous operational functions that span a multitude of industries and disciplines. Therefore, it is essential that the Office of Internal Auditing contains a group of professionals with diverse backgrounds and experiences. Diane Scott Director Julia Hann The department is made up of individuals with experiences in a variety of industries. Personnel also maintain several professional designations including: -Certified Public Accountant -Certified Internal Auditor -Certified Information Systems Auditor -Certified Information Systems Security Professional Senior Auditor Robb Hartman Professional designations require continuous professional training. Professional development ensures staff are adequately trained, provides excellent networking opportunities and allows personnel to stay current of industry trends. IT Auditor Khareem Gordon -Certified Fraud Examiner -Masters of Business Administration -Masters of Accountancy University of North Florida Office of Internal Auditing 6

7 Professional development enables us to provide our clients the best service possible. Ultimately, professional development enables OIA to provide its clients with the best service possible. The department s goal is to provide at least 40 hours of training per employee per year. This goal was achieved during the 2017 fiscal year. It is important to ensure training and professional development is directly related to, and applicable in, a higher education environment. As a result, we attend training provided by relevant reputable organizations. We also encourage personnel to take an active role in professional organizations. During the year, personnel; Served as board members for the Association of College and University Auditors Volunteered for committees in professional organizations. Volunteered at training events. RESOURCES ALLOCATION The Office of Internal Auditing (OIA) had an FY17 budget of $269,313. The majority of funding is allocated to salaries and wages. Approximately 7.9% of funding is allocated to operating expenses such as equipment, copying, telephone, supplies, contracted hotline provider, training and travel. University of North Florida Office of Internal Auditing 7

8 FY18 G o a l s a n d a V i s i o n f o r t h e R o a d Ah e a d As OIA became fully staffed in FY17, the office focused on creating consistent audit practices which align with The Institute of Internal Auditing Professional Practices Framework. As OIA moves forward, it is essential to reassess prior year s goals, establish new goals, and reaffirm the vision and mission of OIA. Mission The Office of Internal Auditing s mission is to provide an independent, objective assurance and consulting activity that will add value and improve UNF s operations. Vision The Office of Internal Auditing s vision is to be a respected advisor and positive change agent to assist management in maintaining consistent practices for secure operational effectiveness. In doing so, Internal Audit will seek on-going relationships throughout campus to be a go-to consultant in higher education best practices. Follow-Up to FY17 Goals 1. Complete a Quality Assurance Review (peer review). [Complete] 2. Establish consistent audit and consulting protocols in order to increase audit productivity. [On-going] 3. Establish a marketing and awareness plan for the hotline to help promote UNF s ethical culture. [Complete] FY18 Goals 1. Implement remediation plans from the FY17 Quality Assurance Review. 2. Create internal control awareness tools and resources for departments. 3. Help foster a strategic process to risk management within OIA and university-wide. University of North Florida Office of Internal Auditing 8

9 FY17 Project Details During the year, OIA released four (4) audit reports. Additional details of each audit are described below. Fieldwork for the Brooks College of Health and Student Health Services was completed in FY17, but audit report preparation was carried forward to FY18. Audits Distance Learning Fees # The Distance Learning Fee audit objectives were to determine if funds collected were complete and accurate and if expenditures complied with state statutes while also being reasonable and utilized for distance learning purposes. Performance Based Funding # At the request of the Florida Board of Governors (BOG), OIA conducted an audit of the University s processes to ensure the completeness, accuracy and timeliness of data submissions to the BOG. Performance funding is based on data submitted to the BOG. As such, the methods and controls applied by University management to ensure integrity of the process were subject to several key audit procedures. Driver and Vehicle Information Database (DAVID) # At the request of the Florida Department of Highway Safety and Motor Vehicles (FLHSMV), an audit was conducted to submit an attestation confirming the appropriate use of DAVID. The objectives were to ensure adequate controls over personal data in DAVID. The audit also assessed the effectiveness of controls to ensure confidentiality and privacy of data is maintained and only accessed by authorized users. OIA further determined if any instances of data misuse. College of Education and Human Services, Dean s Office Departmental Checkup # This was the first of a series of departmental checkups from the FY17-FY18 audit plan. The purpose of a departmental checkup is to assess the unit s adequacy of internal controls, safeguarding of departmental assets, compliance to campus policies and procedures, efficient use of resources, and integrity of financial information. University of North Florida Office of Internal Auditing 9

10 OUTSTANDING ISSUES & FOLLOW UP Standards for the Professional Practice of Internal Auditing, promulgated by The Institute of Internal Auditors, state, The chief audit executive must establish and maintain a system to monitor the disposition of results communicated to management. Additionally, The chief audit executive must establish a follow-up process to monitor and ensure that management actions have been effectively implemented or that senior management has accepted the risk of not taking action. The Office of Internal Auditing s audit reports include control issues along with management action plans and the estimated time for remediation. Reports issued by the external auditors, including the Office of Auditor General, also contain issues and recommendations for which university management must provide corrective action plans. The OIA monitors audit issues via an in-house developed application. Issues are closed once corrective controls are implemented or management accepts risks. OIA provides a status update of outstanding issues to the UNF Board of Trustees, Audit and Compliance Committee each quarter. Specifically; 14 internal and 13 external reportable audit recommendations were tracked in FY17. Out of the 27 recommendations; 5 internal and 3 external reportable recommendations have corrective action in progress and will be carried forward for follow-up in FY18. University of North Florida Office of Internal Auditing 10

11 ETHICS HOTLINE & INVESTIGATIONS The National Association of College and University Business Officers (NACUBO) provided whistleblowing guidelines in its Advisory Report titled, The Sarbanes- Oxley Act (SOX) of 2002: Recommendations for Higher Education. NACUBO recommends that institutions publicize the complaint mechanism and have it periodically reviewed by the audit committee. Also, Colleges and universities should also consider establishing hotlines, anonymous voic , and anonymous or secure suggestion drop boxes to facilitate the complaint process. Regardless of the specific mechanisms selected, there should be a process for communicating with employees, receiving information, and addressing identified concerns. The Office of Internal Auditing maintains the anonymous reporting mechanism on behalf of the University. The current reporting mechanism is a third party contracted service which administers an internet form and phone number allowing users to anonymously submit allegations of noncompliance, fraud, waste or abuse. Issues are reviewed by a triage work group consisting of Internal Audit, Legal, Compliance, Human Resources and Title IX. The nature of the reported issue may constitute the corresponding office to take lead in an investigation. The committee appropriately reviews issues and conducts due diligence. During the year, OIA engaged in a hotline campaign, branding the hotline as the UNF Ethics Hotline. In partnership with the Chief Compliance Officer, OIA distributed posters to all departments and spoke to leadership groups. The hotline received 10 correspondences, and OIA took lead for follow-up on four of the issues reported. In addition to issues reported to the hotline, there are also circumstances when information is reported directly to OIA. Out of five issues reported directly to OIA, one warranted an investigation. The fieldwork and reporting on this investigation will be carried forward to FY18. University of North Florida Office of Internal Auditing 11

12 QUALITY ASSURANCE & IMPROVEMENT Standards for the Professional Practice of Internal Auditing, promulgated by The Institute of Internal Auditors, state that, The chief audit executive must develop and maintain a quality assurance and improvement program. Overall, the program should be designed to enable an evaluation of the internal audit activity s conformance to standards and allow an assessment of the efficiency and effectiveness of the internal audit activity. In response to this requirement, OIA had developed performance measurements designed as a basis for evaluating the department s performance. The measurements include goals for personnel, productivity, communication, quality and effectiveness. On the horizon, OIA will review past performance measures and reassess for fiscal year 2018 in order to synchronize the department s services with UNF s strategic priorities. Performance Measurement Summary Measurement Goal/Criteria Personnel Measurements Target Range Achieved Number of Staff Certifications / department 3 or more 7 Professional Development Hours/ department 120 hours or more 120 hrs. Productivity Measurements Number of Audits completed per year 5 to 7 audits 4 audits Percentage of University Budget Reviewed 5% or more 5% Number of Departments Engaged 10 or more 16 depts. Communications Audit Status Updates with Board of Trustees 4 to 6 per year 4 Number of VP Updates Meetings / year 40 or more 61 Quality and Effectiveness Client Satisfaction Score, % Agree with Services 75% or more 100% University of North Florida Office of Internal Auditing 12

13 MANDATORY DISCLOSURES As mentioned previously, the Office of Internal Auditing s activities are governed by standards promulgated by The Institute of Internal Auditors. These standards require the reporting of specific items to an organization s Board and Senior Management. The following is a list of required disclosures not previously addressed in the body of this document. Organizational Independence As required by the standard, the Office of Internal Auditing (OIA) must confirm to the board, at least annually, the organizational independence of the internal audit activity. UNF s OIA reports administratively to the President s Office and functionally to the Audit and Compliance Committee (ACC). Reporting to the ACC helps promote the independence necessary for the OIA to adequately perform its job function. Impairments to Independence or Objectivity If independence or objectivity is impaired in fact or appearance, the details of the impairment must be disclosed. There were no impairments to independence or objectivity for any engagements performed during the 2017 fiscal year. Disclosure of Partial Conformance Occasionally circumstances require the completion of projects/engagements in a manner that is not consistent with applicable standards. When this occurs, OIA must disclose the partially conforms and the impact to Senior Management and the Board. During the 2017 fiscal year, there were no instances in which individual projects were performed in a manner that did not comply with applicable standards. However, OIA did receive a partially conforms for The IIA required Quality Assurance Review (QAR). A QAR is a review of the audit function from a third party. Resolution of Management s Acceptance of Risks Each audit engagement can potentially produce items that may pose risks to university operations. Some items will require management s attention while others may be situations in which management decides to accept the risk associated with continuing the current practice. This is normal in limited circumstances and is often due to cost/benefit constraints. The OIA is required to disclose (to Senior Management and the Board) any situations in which it is believed university personnel has accepted a level of residual risk that may not adequately reduce/mitigate the risk of loss. There have been no such instances during the 2017 fiscal year. University of North Florida Office of Internal Auditing 13

14 Contact the Office of Internal Auditing WEBSITE MAIL 1 UNF Drive Hicks Hall, Suite 2340 Jacksonville, Florida PHONE UNF Ethics Hotline