NACUBO 2017 Student Financial Services Conference Understanding Audits NACUBO 2017 Student Financial Services Conference Presented by: Lissa Perrone, MBA – Director, Business Affairs, Oregon State University Julee Otter, CIA, CFE, CRMA, CCEP – Senior Audit Manager, Office of Audit Services, Oregon State University LISSA – brief background on OSU - public land grant Founded 1868 # of students $ of research Overview and will leave time for questions at the end

JULEE

Objectives Types of audits you may encounter and who will perform the reviews Typical audit process Best practices to effectively manage the audit Proactive measures to prevent or reduce the impact of an audit Common audit findings in student finance

Types of Audits Compliance Financial Statement Operational Fraud investigations Information technology Objective 1

Compliance Audits Who audits Governmental audit agencies Federal & state External auditors Internal auditors Objectives of the review Award terms Federal regulations Uniform Guidance Single audit Regulatory requirements & laws IRS, EPA, OSHA

Financial Statement Audits Who audits Governmental audit agencies Federal & state External auditors Objectives of the review Validity Completeness Authorization Accuracy Classification Accounting Cutoff

Operational Audits Who audits Internal auditors Objectives of the review Economy Efficiency Effectiveness

Investigative Audits Who audits Internal auditors Governmental audit agencies Federal & state Objectives of the review Determination of facts Objectivity Confidentiality

Information Technology Audits Who audits External auditors Internal auditors Governmental audit agencies Federal & state Objectives of the review Data integrity Data security Business processing Change controls Business continuity

Beware of the audit in disguise! Reviews Analysis Site visit Engagement

Audit Process Planning Fieldwork Summarization and reporting Follow up Objective 2

Planning Auditors are coming… …send help!!! Contact university audit liaison: Internal Audit, Business Affairs, Sponsored Programs? Preliminary survey – data collection period Entrance conference

Entrance Conference Demonstrate a positive attitude Confirm objective(s), areas to be tested, and testing period Identify staffing requirements Obtain the timelines/deadlines Establish contacts Discuss reporting process and follow up

Fieldwork Review documentation in order to anticipate questions. Ensure documents are available upon the auditors’ arrival. Respond to subsequent requests ASAP. Full access to files and original documents may be required. Unless fraud, only copies should be retained by the auditors. Maintain a list of the records provided the auditor.

Summarization and Reporting Keep informed of issues throughout the audit Ask for time to review findings Ensure exit conference is held Confirm who gets the auditors’ report Provide management responses Agree or disagree Action Plan Target date(s) for implementation

Follow Up Confirmation that agreed upon actions have been implemented to address audit findings May be a separate review or part of audit procedures for annual audits Results reported to senior leadership and the board Repeat findings or failure to implement action plans not a good thing! Be proactive! Consult with your auditors!

Tips on Interacting with Auditors Designate a “point person” Be positive, professional, and confident, honest Listen carefully to questions and understand the question before answering Only answer the question – keep answers simple and direct Objective 3

More Tips Do not react to threats Do not answer hypothetical questions Do not agree or disagree with opinions Do not sign anything on behalf of the university

Even MORE Tips Don’t be offended by WHY questions. “Why isn’t…” “Why did…” Usually, the auditor is asking your help in understanding the situation. Recognize they may be experts. They may have worked in the specialty area prior to becoming an auditor. Realize they may not be subject experts. This may be their first audit, so be patient.

Proactive Measures to Help Ensure Good Audit Results Review your internal controls Perform a self audit Monitor recent audit reviews and findings Objective 4

Definition of Internal Controls Control environment Risk assessment Control activities Information and communication Monitoring

How Do you Prevent Disastrous Audit Results? INTERNAL CONTROLS If internal controls are functioning properly, the risk of financial irregularities, non-compliance issues, misstated financial statements, and ineffective and inefficient operations are reduced. Management is responsible for the internal controls in your operation.

How can managers help ensure effective internal controls? Maintain adequate policies and procedures Communicate these policies and procedures Monitor compliance with policies and practices

Maintaining Policies and Procedures Ensure there are policies and procedures around the risks in the unit. Risks: may be financial, compliance, or operational Do staff know how to do their job and what is expected of them? Where can things go wrong? Are there procedures in place to prevent this from occurring?

Communicating Policies and Procedures Use appropriate channels: face-to- face, email, newsletters, meetings, etc. Include this topic in new employee orientation Continual communication is needed Let it be known compliance is important to you

Monitor Compliance Hmm… If I were an auditor, what would I look at? Monitor the high risk areas or compliance with policies and practices to make sure everything is going as planned.

Self Audit Control Self Assessment Guides Federal Student Aid (FSA) Assessments: https://ifap.ed.gov/qahome/fsaassessment.html Oregon State University – Office of Audit Services – Internal Control Resources: http://leadership.oregonstate.edu/audit/internal-control-resources Contact your institution’s internal auditor.

Recent Audits & Findings Department of Education Office of Inspector General Audit Reports: https://www2.ed.gov/about/offices/list/oig/areports.html Federal Student Aid (FSA) Program Reviews: https://studentaid.ed.gov/sa/about/data- center/school/program-reviews Department of Education Presentations – 2016 FSA Conference: http://fsaconferences.ed.gov/conferences/library/2016/20 16FSAConfSession33.ppt Google Alerts to keep up to date on interesting and related topics NACUBO – Bursars digest and searchable Professional organizations

Common Audit Finding Areas Return of funds (R2T4) Calculation errors, funds returned late Cash management Disbursed late, excess cash not returned to Ed. Over/Under awards Student credit balances Objective 5 LISSA

More Common Audit Findings Segregation of duties Data access e.g., Conflicts, failure to remove access Cash handling PCI Compliance (credit cards) Recordkeeping JULEE

Conclusion People fear audits because they don’t know what to expect or what the auditors are doing. Hopefully, you are better armed with knowledge about auditing which will in turn help you to be prepared for the next audit.

Questions? Thank You!

Speaker Contact Information Lissa Perrone, MBA Director, Business Affairs Oregon State University 100B Kerr Admin Building Corvallis, OR 97339-1086 T: 541.737.6127 Lissa.Perrone@oregonstate.edu Julee Otter, CIA, CFE, CRMA, CCEP Senior Audit Manager, Office of Audit Services Oregon State University 240 Kerr Admin Building Corvallis, OR 97331 T: 541.737.3457 Julee.Otter@oregonstate.edu oregonstate.edu/leadership/audit