The University of Oklahoma Internal Audit

Internal Audit – Who We Are Mission Assist management and staff in the effective discharge of their responsibilities by providing them and the Board with independent and objective analysis, appraisals and recommendations about the adequacy and effectiveness of internal controls, the safeguarding of assets, compliance with applicable laws, regulations and university policies and the achievement of management’s objectives. Regents’ Policy Manual – Section 3.5.2 Defines the purpose and responsibilities of Internal Audit Authorized by the Board and the President and gives Internal Audit the authority to conduct audits Oklahoma law provides that the University of Oklahoma Board of Regents (‘the Board’) shall establish an internal audit function that employs a sufficient number of internal auditors to meet the Board’s fiduciary responsibilities.

Internal Audit reports functionally to the University of Oklahoma Board of Regents and administratively to the President of the University of Oklahoma. We assist all levels of administration in the achievement of university goals and objectives by striving to provide a positive impact on the efficiency and effectiveness of administrative functions.

Where we audit OU Norman Campus OU Health Sciences Center – OKC Campus OU Schusterman Center - Tulsa Campus Cameron University (Lawton, OK) Rogers State University (Claremore, OK) International Locations Centers, institutes, stations, camps, projects, etc. International Study Centers Arezzo, Italy OU in Puebla OU in Rio

Risk Risk is an uncertain event or set of circumstances which will affect the achievement of objectives if they occur. Strategic Operational Compliance Reputational Fraud, Waste, or Abuse Financial Control Environment Quality Strategic: Strategic risks are mostly external factors beyond your control. Lose ground to competitors as they improve and innovate. The potential for economic conditions to affect your strategy. Operational: The chance of a loss due to the day-to-day operations of an organization The failure to adhere to internal policies. Compliance: The potential losses and legal penalties due to failure to comply with laws or regulations. Workplace health and safety - accidents or repetitive strain injuries Reputational: Chance of a loss due to damage or a decline in your reputation. Security incident in which an attacker publishes private customer information. Fraud, waste, or abuse: Expense reimbursement fraud Payroll fraud Financial statement fraud Cash larceny Financial: is risk directly related to money Budget risk: the potential for the estimates or assumptions built into a budget to turn out to be inaccurate. Control Environment Quality: Integrity and ethical values are not important to those at the top Talking point Conduct organizational level risk analysis Develop the Annual Audit Plan Audit Plan approved by Board of Regents annually in June

Audit Project Lifecycle Audit Observation Monitoring Audit Planning Audit Fieldwork Audit Reporting Audit Observation Monitoring Entrance notification and meeting Obtain understanding of audit area through research and client interaction Research applicable standards and common practice Assess & quantify risks Create risk-based audit plan Obtain necessary data/documentation to engage review Document and test existing controls Develop observations and recommendations Validate observations with client Collaboratively develop remediation plans Monitor and validate remediation plans Report to leadership and Board Committees status of outstanding observations

OU Staff Handbook: Section 5 OU Staff Handbook: Section 5.34 Fraud Prevention, Reporting, and Whistleblower Protection Policy The University prohibits fraudulent and dishonest behavior in the conduct of University business. It is the policy of the University to prevent, deter, and detect dishonest and fraudulent activities and consistently investigate suspected fraud. Fraud is defined as the intentional, false representation or concealment of a material fact for the purpose of inducing another to act upon it. Fraud Triangle Motivation to commit the fraud Management usually perpetrates fraud differently from non-management For non-management a motivation could be that their spouse lost a job and bills are piling up. Managers are often motivated to commit fraud because of the way they are compensated. Better performance might mean a higher raise at the end of the year. Recognizing the opportunity Weak internal controls, No separation of duties Indifferent management (they don’t enforce the controls set in place). Ineffective monitoring of management (might happen in small companies with few managers). How does the individual rationalize the fraud I’m just borrowing the money - this rationalization usually goes into a snowball effect and eventually there is no way the stolen money will be paid back. I was wronged (being passed up for a promotion) – that rationalization leads the employee to feel that taking home company assets is their right.

Report Fraud All University employees have a duty to report instances of suspected fraud. University employees are prohibited from taking any retaliatory action against an individual for good faith reporting, or causing to be reported, suspected fraud. If you become aware of issues of potential fraud or related misconduct, please report it. Call: (405) 325-3412 to speak directly with the Chief Audit Executive or report through the 24-Hour Reporting Hotline Any person who has been subjected to retaliation in violation of this policy should notify any of the responsible offices: Internal Audit, Legal Counsel, the University President, or the Board of Regents. If confirmed, retaliation in violation of this policy shall result in appropriate disciplinary action, up to and including termination.

24-Hour Reporting Hotline: 844-428-6531 Website: www. ou. ethicspoint 24-Hour Reporting Hotline: 844-428-6531 Website: www.ou.ethicspoint.com Report anonymously Equal opportunity, Title IX, discrimination or harassment Campus climate and bias Financial matters involving suspected fraud or misuse of University resources Conflicts of interest Public or environmental health and safety Research or scientific misconduct Human resource issues Student conduct

How we can help Policy awareness Best practice guidance Improved internal controls Internal Audit website resources

Key points of contact Charles Wright Chief Audit Executive: cwright@ou.edu, 405-325-3412 Carolyn Clink Audit Director: carolync@ou.edu, 405-325-0743 www.ou.edu/audit