Daisy Asiñas & Mahshid Parsi School of Medicine - 2006 INTERNAL AUDIT DEPARTMENT Internal Audit Services Departmental Compliance Audit Program (updated) Daisy Asiñas & Mahshid Parsi School of Medicine - 2006

…., and then a call from internal audit ….

Types of Internal Audit Services at Stanford Compliance, Financial, Operational Internal Control Consultations IT Reviews Risk and Control Self Assessment (RCSA) Review of Allegations Liasion with External Auditors such as PwC and Gov’t Auditors Financial: Book Store Revenue, Shopping Center Rental agreements Operational: ICC- What type documentation would satisfy copying charges made to sponsored project in case of an audit? IT reviews- Infrastructure and application controls for PS & Oracle RCSA- Limited resources to address a specific problem. IAD plays a facilitator’s role and will come up with a report, which summarizes priority, responsible parties, and … Rev of Alleg- missing cash in transportation Liasion with..- Most recently in audits with DCAA, or A-133

Examples of Compliance Audits Departmental Compliance Audit (full or partial scope) Gift processing in Office of Develop or Dept. Pcards Travel audit Human subjects research protocol review Health and Safety Faculty or staff conflict of interests & commitments A-133 (on behalf of PwC) -Note in each of the following audit, you may receive phone calls from us. In some you role or effort are more substantial than others. In some of these instances we may be reviewing a process, a function within central offices, but still we need to talk to you (or obtain documents) to complete our review. A-133, A single Audit (entity’s financial statement and awards) for those entities that expend $500,000 or above in any given year from Federal awards. SOM Stat- 28 Depts, over 800 Faculty members

Audit Program for Operating Unit Compliance Audits - Dual Purpose Department/Unit Tool Areas of Focus Policies, Regulations Websites Internal Control – Self Assessment Preparation for audit Training Management Oversight Prioritize department risks Easy to use Audit Program Opening Interview Internal Controls Areas IAD tests How IAD tests What IAD Measures against Efficient Effective Consistency

Compliance Audit Program - Sections GENERAL ADMINISTRATION SPONSORED PROJECTS AND OTHER RESEARCH ISSUES REVENUE ACCOUNTS/EXPENDITURES PAYROLL/HUMAN RESOURCES INFRASTRUCTURE RPH= Research Policy Handbook, GM= Administrative Guide Memo http://www.stanford.edu/dept/internal-audit/docs/compliance99.shtml Total of 31 areas

Areas of Audit Findings - (Since 2000) 7 1 10 12 5 2 4 3 9 6 5 7 6 4 3 9 14 17. Unapproved Effort Reduction 18. Faculty Bonuses 19. Staff Bonuses 20. NIH Cap 21. Allocations 22. Cost Transfers 23. Other Direct Charging 24. Unallowable Costs 25. IRB/APLAC 26. Indirect Rates 27. Other Sponsored Project 29. HR I-9 30. HR Overtime 31. HR Personnel Files 32. HR Perform./Appraisals 33. Other SU Policy 1. Property Control 2. Space Usage 3. Gift-Timeliness 4. Gift- Usage/Purpose 5. Gift- Forms/Sign./CoI 6. EH&S Training 7. EH&S Overall Controls 8. EH&S Other 9. CoC/I 10. Overdrafts 11. Early Accounts 12. Certifications 13. Effort Charging/Reporting 14. SU-18's & OTL Issues 15. Software Licenses 16. P-Card Effort Charging/Reporting – Section 11 Page 15, Labor Charging Transfers Section 24, Page 25

Recent Governmental Enforcement 3/06 - University of Rochester: Unpaid OT. $9.5 Million settlement. 1/06 - University of Connecticut: Extra Compensation & Cost Sharing. $2.5 Million settlement. 5/05 - Mayo Clinic: Allocation & Cost Transfers. $6.5 Million settlement. 6/05 - Cornell University: Grant money used to support patients care at affiliate hospital. $4.4 Million settlement. 4/05 - University of Alabama-Birmingham. Effort reporting. $3.4 Million 6/04 - Harvard University and an affiliated teaching hospital: Effort reporting, equipment, HR issues. $3.3 Million settlement 3/04 - John Hopkins University: Effort reporting. $2.6 Million settlement. 2/03 - Northwestern University: Effort reporting. $5.5 Million settlement Go over: Mayo Clinic - for allocation and cost transfer University of Alabama - for Effort Charging

Where do you turn in Compliance Audit Program? A single allocation methodology (number of FTEs) is used to allocate phone toll, photocopying, professional services, and lab supplies charges. 3 PI salaries in excess of the NIH salary cap were not recorded to an unallowable expenditure type. A subcontract invoice for $67,400 was charged to a NIH grant. The invoice was not sufficiently detailed, and the justification was presented as “expenses were budgeted”. A NIH grant was awarded with 25% PI’s effort. The PI recorded only 17% of his salary to this grant. Allocation- Section 11 page14, d and e NIH - Section 11, Page 16, l Subcontractor- Section 11, Page 15, g PI Effort- Section 11 (Labor Charging) page 15, K

Departmental Compliance Audit Program Questions?