2017 Administration and Finance Conference Lines of Defense Model Scott Lawlor, Senior Internal Auditor, Office of University Audit

Understanding the Lines of Defense Model Internal controls are a set of systems and processes that help to ensure that the University achieves its: Operational goals Internal and external financial reporting goals Legal and regulatory compliance goals In order to achieve these goals, we need to have in place an effective model across the institution and this is the Lines of Defense Model

Lines of Defense Model

Lines of Defense Model Board of Trustees, Audit and Risk Committees & Executive Management Perform an essential role in the Lines of Defense model Ensures model is reflected in the University’s risk management and control processes Responsible and accountable for: Setting objectives Defining strategies to achieve those objectives Establishing governance structures and processes to best manage the risks in accomplishing those objectives Implementing an Enterprise Risk Management function Provides active support and guidance when implementing the model

Lines of Defense Model 1st Line of Defense - Business Operations: Departmental, Operational and Functional Management Maintain effective internal controls within a defined area; risks are owned Execute risk and control procedures on a day-to-day basis Identify, assess, control and mitigate risks Guide the development and implementation of internal policies and procedures Ensure activities are consistent with goals and objectives Managerial and Supervisory review

Lines of Defense Model 2nd Line of Defense - Oversight Functions: Risk Assurance Functions (Academic and Medical) Ensure Business Operation controls are properly designed, in place and operating as intended. Typically include: Internal Control Assurance Processes Controllership for financial risks and reporting Provide guidance and training on the risk management process Monitor the adequacy and effectiveness of internal control, accuracy of reporting, compliance and timely remediation of deficiencies Program Audits of grants and contributions Management oversight committees (IT, HR, Program) Report risk-related information organization-wide

Lines of Defense Model 3rd Line of Defense - Independent and Objective Assurance: Internal Audit Act in accordance with recognized audit standards Perform duties independently and objectively Active and effective reporting line to the Governing Body Ethics, Investigations, Whistleblower, etc. Key is independence and reporting lines Must report internally to the Governing Body Utilize “best practices” approach based on assessing risks to focus audits Flexible process to adapt to the specific of each engagement

Lines of Defense Model Key Takeaways Not a standalone solution to effective risk management, but rather a component of the overall process. Enhances the University’s risk management strategy with greater efficiency and effectiveness Model needs to be supported by an active, ongoing initiative and an appropriate organizational mandate Appropriate leadership, accountability, clearly articulated objectives and active performance measures Oversight by both Executive Management, the Board of Trustees and Audit/Risk Committees Continuous fine tuning and improvements must be implemented