Business Operations Meeting “Audit Updates” David Cutri, CPA, CISA, CIA (Dave) Director of Internal Audit The University of Toledo The University of Toledo Medical Center November 17, 2010

Upcoming Accounts Payable Audit Internal Controls/Risk Assessment/Risk Management Training Departmental “Field” Audits Internal Audit Website (“20 Questions for Internal Audit”) FY2011 Internal Audit Plan Agenda 2

Profit Recovery Systems, Inc. [PRS], based in Lyndhurst, Ohio has been engaged to perform a review of our accounts payable disbursement transactions for the period July 1, 2007 through June 30, PRS will be analyzing data from our accounts payable system to identify duplicate payments, overpayments, and other recovery opportunities. PRS will also be requesting certain account information from our suppliers and reconciling that information to transactional information from our accounts payable system. PRS will be performing most of their work offsite and they will be corresponding directly with our suppliers primarily by phone and fax. Upcoming Accounts Payable Audit 3

PRS will be representing themselves as members of The University of Toledo internal audit staff, and any fax correspondence they send to our suppliers will be on The University of Toledo letterhead. The primary PRS auditors working on this project are Jim Fenker, Neal Morrison, and Gary Butzback. If you receive inquiries from any of our suppliers as to the work PRS is performing, please confirm that their work is fully authorized and encourage our suppliers to provide whatever information is requested. If you have any questions about this project, please contact David Cutri (Director of Internal Audit, (419) )). Upcoming Accounts Payable Audit (continued) 4

Scope of Training To encompass internal control, risk management, and risk assessment topics Refining course content to be considered for UT certificate-level training. Also considering delivery to departments on a scheduled/as requested basis. Departmental Audits Scope being refined – will address issues such as A/P, procurement, p-card compliance, records management, IT compliance, etc. Open to other areas of interest/concern from Business Operations. Departmental audits will commence after internal control training has been sufficiently “rolled out”. Internal Control Training/Departmental Audits 5

Internal Audit Website 6

How can I benefit from an internal audit? Who gets copies of the audit report? What about confidentiality? Can anyone see the auditor’s report? What can I do to help Internal Audit achieve its mission? Will I get in trouble should issues be identified during an internal audit? Why did I get selected to be audited? Does it mean I’m in trouble? Can I prepare for an internal audit? How? Who can request an internal audit at UT? Do you ever follow up on findings raised during previous internal audits? I understand that Internal Audit will help me manage the risks in the area. So what exactly is a “business risk”? What is the purpose of the UT Athletics Compliance function? “20 Questions for Internal Audit” (hard copy being routed) 7

Shouldn’t the UT Internal Audit and Compliance functions be separate? In what ways can they collaborate? What are the “lines of business” within UT Internal Audit? What is a Control Self-Assessment? How does it differ from an audit? What performance measures does UT Internal Audit have in place to measure its success? What is the process for communicating audit results and issuing a UT audit report? What does UT Internal Audit do to ensure that it is not perceived as “the police”? Does UT Internal Audit ever get audited? If so, by whom? What qualifications are required to become an internal auditor? What is the difference between internal auditors and external auditors? Don’t they look at the same stuff? What is the Anonymous Reporting Line? When could I/should I use it? “20 Questions for Internal Audit” (hard copy being routed) 8

FY2011 Internal Audit Plan (in progress) 9 Internal Audits – Academic EnterpriseIntercollegiate Athletics  Research Expenditures  Outside Income (barter agreements, etc.)  Student Financial Aid (eligibility)  NCAA Football Attendance  Commercial Contract Audit (Ottawa House)  Rocket Sports Properties  Student Affairs/Customer Service  Team Travel Internal Audits – Clinical EnterpriseCompliance Projects – Academic Enterprise  Collections and Cash Management Procedures  Anonymous Reporting Line  Pharmacy Accounting for Drugs and Equipment  Continuous Controls Monitoring  Charge Capture/Charge Master  Higher Learning Commission (HLC) Assessment  Leasing Activities  “Red Flags” Procedures Internal Audits – Support FunctionsCompliance Projectors – Clinical Enterprise  Financial Reporting and Accounting Closing (CSA)  Access to Clinical Informatics Systems  Purchase Card and Purchasing Process Redesign  Clinic Recordkeeping/Documentation (ICD-10)  Accounts Payable  Joint Commission Procedural Compliance  Time and Reporting System  Compliance and Privacy Update Information Technology  Banner 8 (new systems development)  People-Admin (new systems development)  Commercial Contract Audit (digital campus)  IT General Controls