1. Daisy Asiñas & Mahshid Parsi School of Medicine - 2006
INTERNAL AUDIT DEPARTMENT Internal Audit Services Departmental Compliance Audit Program (updated)
Daisy Asiñas & Mahshid Parsi
School of Medicine

2. …., and then a call from internal audit ….

3. Types of Internal Audit Services at Stanford
Compliance, Financial, Operational
Internal Control Consultations
IT Reviews
Risk and Control Self Assessment (RCSA)
Review of Allegations
Liasion with External Auditors such as PwC and Gov’t Auditors
Financial: Book Store Revenue, Shopping Center Rental agreements
Operational:
ICC- What type documentation would satisfy copying charges made to sponsored project in case of an audit?
IT reviews- Infrastructure and application controls for PS & Oracle
RCSA- Limited resources to address a specific problem. IAD plays a facilitator’s role and will come up with a report, which summarizes priority, responsible parties, and …
Rev of Alleg- missing cash in transportation
Liasion with..- Most recently in audits with DCAA, or A-133

4. Examples of Compliance Audits
Departmental Compliance Audit (full or partial scope)
Gift processing in Office of Develop or Dept.
Pcards
Travel audit
Human subjects research protocol review
Health and Safety
Faculty or staff conflict of interests & commitments
A-133 (on behalf of PwC)
-Note in each of the following audit, you may receive phone calls from us. In some you role or effort are more substantial than others. In some of these instances we may be reviewing a process, a function within central offices, but still we need to talk to you (or obtain documents) to complete our review.
A-133, A single Audit (entity’s financial statement and awards) for those entities that expend $500,000 or above in any given year from Federal awards.
SOM Stat- 28 Depts, over 800 Faculty members

5. Audit Program for Operating Unit Compliance Audits - Dual Purpose
Department/Unit Tool
Areas of Focus
Policies, Regulations
Websites
Internal Control – Self Assessment
Preparation for audit
Training
Management Oversight
Prioritize department risks
Easy to use
Audit Program
Opening Interview
Internal Controls
Areas IAD tests
How IAD tests
What IAD Measures against
Efficient
Effective
Consistency

6. Compliance Audit Program - Sections
GENERAL ADMINISTRATION
SPONSORED PROJECTS AND OTHER RESEARCH ISSUES
REVENUE
ACCOUNTS/EXPENDITURES
PAYROLL/HUMAN RESOURCES
INFRASTRUCTURE
RPH= Research Policy Handbook,
GM= Administrative Guide Memo
Total of 31 areas

7. Areas of Audit Findings - (Since 2000)7 1 10 12 5 2 4 3 9 6 5 7 6 4 3 9 14
17. Unapproved Effort Reduction
18. Faculty Bonuses
19. Staff Bonuses
20. NIH Cap
21. Allocations
22. Cost Transfers
23. Other Direct Charging
24. Unallowable Costs
25. IRB/APLAC
26. Indirect Rates
27. Other Sponsored Project
29. HR I-9
30. HR Overtime
31. HR Personnel Files
32. HR Perform./Appraisals
33. Other SU Policy
1. Property Control
2. Space Usage
3. Gift-Timeliness
4. Gift- Usage/Purpose
5. Gift- Forms/Sign./CoI
6. EH&S Training
7. EH&S Overall Controls
8. EH&S Other
9. CoC/I
10. Overdrafts
11. Early Accounts
12. Certifications
13. Effort Charging/Reporting
14. SU-18's & OTL Issues
15. Software Licenses
16. P-Card
Effort Charging/Reporting – Section 11 Page 15, Labor Charging
Transfers Section 24, Page 25

8. Recent Governmental Enforcement
3/06 - University of Rochester: Unpaid OT. $9.5 Million settlement.
1/06 - University of Connecticut: Extra Compensation & Cost Sharing. $2.5 Million settlement.
5/05 - Mayo Clinic: Allocation & Cost Transfers. $6.5 Million settlement.
6/05 - Cornell University: Grant money used to support patients care at affiliate hospital. $4.4 Million settlement.
4/05 - University of Alabama-Birmingham. Effort reporting. $3.4 Million
6/04 - Harvard University and an affiliated teaching hospital: Effort reporting, equipment, HR issues. $3.3 Million settlement
3/04 - John Hopkins University: Effort reporting. $2.6 Million settlement.
2/03 - Northwestern University: Effort reporting. $5.5 Million settlement
Go over:
Mayo Clinic - for allocation and cost transfer
University of Alabama - for Effort Charging

9. Where do you turn in Compliance Audit Program?
A single allocation methodology (number of FTEs) is used to allocate phone toll, photocopying, professional services, and lab supplies charges.
3 PI salaries in excess of the NIH salary cap were not recorded to an unallowable expenditure type.
A subcontract invoice for $67,400 was charged to a NIH grant. The invoice was not sufficiently detailed, and the justification was presented as “expenses were budgeted”.
A NIH grant was awarded with 25% PI’s effort. The PI recorded only 17% of his salary to this grant.
Allocation- Section 11 page14, d and e
NIH - Section 11, Page 16, l
Subcontractor- Section 11, Page 15, g
PI Effort- Section 11 (Labor Charging) page 15, K

10. Departmental Compliance Audit Program
Questions?