Is your institution in control?

Internal Control, Standard Operating Procedures and the Policy Process

T. Michael Ford, Special Assistant to the VP&CFOKathleen McNeely, Associate Vice President Finance

Indiana University

NACUBO 2008 2

Overview of Auditing Changes

• Sarbanes-Oxley– Does not apply to higher education

• SAS 112 Communicating Internal Control Related Matters – Significant deficiency

– Material weakness defined

– Requires written communication to management and those charged with governance

NACUBO 2008 3

Overview of Auditing Changes

• Risk Assessment Standards (SAS 104-111)– Represents ongoing efforts to develop stronger

and more definitive auditing standards

– Goals of standards are to enhance auditor performance and improve audit effectiveness

– Effective for audits of financial statements for periods beginning on or after Dec. 15, 2006

– Requires an evaluation of the design and implementation of controls (per COSO)

NACUBO 2008 4

Overview of Auditing Changes

NACUBO 2008 5

Indiana University

• Policies can originate from a multitude of initiators

• VP & CFO Financial Policies Committee

• Two tracks: “Fast Track” and Normal

• Policy Review

• VP & CFO Final Review and Approval

• Policies available on website

NACUBO 2008 6

This is Policy

• What is a policy?– States an institutional position– Describes mandates, community beliefs and

boundaries– Should include why and who

• What is a Procedure?– Tells us how– Often includes who, what, when and where– The customary or standard practice way of

handling situations

NACUBO 2008 7

This is Policy

• Why Are Policies and Procedures Important?– Establish responsibilities and accountability

– Help ensure compliance and reduce institutional risk

NACUBO 2008 8

This is Policy

• Provide clarification and guidance to the community

• May be needed to establish and/or defend a legal basis for action

• Provide consistency across units– How transactions are processed

– How financial resources are expended

NACUBO 2008 9

Well Written Policies:

• Enhance understanding

• Improve controls

• Reduce risk

• Increase efficiency & effectiveness

• Help meet new demands for compliance

NACUBO 2008 10

An Overview

NACUBO 2008 11

The Association of College &University Policy Administrators

Mission:The mission of the group is to explore both the "policy process" on college and university campuses as well as to discuss specific policy issues. The mission will be fulfilled through periodic meetings, special events, outreach activities, and electronic communications among the membership.

Members:See the Members Directory on the ACUPA web site. http://process.umn.edu/acupa/

NACUBO 2008 12

The Association of College &University Policy Administrators

NACUBO 2008 13

Indiana University’sInternal Control Response

NACUBO 2008

• Internal control discussions at Board of Trustee level

• Internal control assessment

• Policy review and change

• New policies implemented

• Sub-certification process developed

14

Board Discussions

NACUBO 2008

• In 2002, Board of Trustees had discussions on value of internal control assessment – prior to Sarbanes-Oxley

• Board educated on Sarbanes-Oxley

• Findings on assessment presented to Board of Trustees

• Detailed discussions on SAS 112

• Current discussions on Risk Assessment Standards

15

Internal Control Assessment

• Accounts Payable

• Accounts Receivable

• Auxiliary Accounting

• Capital Asset Management

• Cash Control

• Construction Accounting

• Debt Accounting

• Endowment Accounting

• Financial Systems & Operations

• Internal Audit

• Investment Accounting

• Payroll

• Plant Accounting

• Purchasing

• Student Loans

• Financial Reporting

NACUBO 2008 16

Policy

NACUBO 2008

• Role of Fiscal Officer, Account Manager & Account Supervisor - revised December 2002

• Internal Control, December 2004– The Board of Trustees and the President of Indiana University

are committed to a solid structure of internal controls. The university considers internal controls to be crucial in providing reasonable assurance regarding the safeguarding of university assets and the achievement of operational, financial reporting and compliance objectives.

– The trustees, president, university and campus administrators, deans, department chairs, and directors are responsible for setting a tone of accountability, high ethical standards and business conduct expectations.

17

Policy

NACUBO 2008

• Fiscal Misconduct, revised March 2005– Revision separated fiscal misconduct from fraud

• Fraud, March 2005– First time fraud language used in a policy

• Financial Sub-certification – July 2006– Took 18 months of due process before final policy completed

and implemented

• Whistleblower Policy – April 2007– Underscores protection and encourages reporting

– Supports Indiana Code 20-12-1-8

• Segregation of Payroll Duties– Revised 2004 to include auditing and verification of payroll

18

Financial Sub-Certification

NACUBO 2008

• Internal Control Policy implemented in December 2004

• Internal Control Workshops

• Sub-certification implemented FY 2007

• Policy discussions were difficult– Fiscal officers are afraid of added responsibility

– Deans feel this is a gotcha and that it is beyond their responsibility

– Some campus climates more accommodating than others

19

Financial Sub-Certification

NACUBO 2008

• Policy requires unit leaders and fiscal officers to sign certification letter

• Certification letter has 10 certifications that originated from representation letter VPCFO makes to external auditors

• Certification letters go out each year in July and are required to be returned before September

• Board of Trustees is VERY supportive of this initiative

20

Indiana University:Successes and Benefits

• Got senior executive buy-in and invited all appropriate departments to “the party”

• Everyone knows how policy process works and where the “buck stops” in terms of policy development and issuance

• Fostered positive interaction between university (central) administration and campus staff

NACUBO 2008 21

Indiana University:Successes and Benefits

• With website access, no longer any paper, postage or binder expenses – “paperless”!

• Serves as model for other policy efforts in institution

• Policies are taken very seriously because “everyone knows” where they are!

NACUBO 2008 22

Indiana University:Successes and Benefits

• Serve to ensure the accuracy of transactions and proper access and use of fund accounting policies by staff

• Core accounting policies were previously developed (57 policies):– What is allowable/not allowable

– What is reasonable or not

– What is appropriate or not

NACUBO 2008 23

Indiana University:Successes and Benefits

• There are currently 123 financial policies accessible to internal and external viewers at www.indiana.edu/~vpcfo/policies

NACUBO 2008 24