Is your institution in control? Internal Control, Standard Operating Procedures and the Policy Process T. Michael Ford, Special Assistant to the VP&CFO Kathleen McNeely, Associate Vice President Finance Indiana University NACUBO 20082

Overview of Auditing Changes Sarbanes-Oxley –Does not apply to higher education SAS 112 Communicating Internal Control Related Matters –Significant deficiency –Material weakness defined –Requires written communication to management and those charged with governance NACUBO

Overview of Auditing Changes Risk Assessment Standards (SAS ) –Represents ongoing efforts to develop stronger and more definitive auditing standards –Goals of standards are to enhance auditor performance and improve audit effectiveness –Effective for audits of financial statements for periods beginning on or after Dec. 15, 2006 –Requires an evaluation of the design and implementation of controls (per COSO) NACUBO

Overview of Auditing Changes NACUBO

Indiana University Policies can originate from a multitude of initiators VP & CFO Financial Policies Committee Two tracks: Fast Track and Normal Policy Review VP & CFO Final Review and Approval Policies available on website NACUBO

This is Policy What is a policy? –States an institutional position –Describes mandates, community beliefs and boundaries –Should include why and who What is a Procedure? –Tells us how –Often includes who, what, when and where –The customary or standard practice way of handling situations NACUBO

This is Policy Why Are Policies and Procedures Important? –Establish responsibilities and accountability –Help ensure compliance and reduce institutional risk NACUBO

This is Policy Provide clarification and guidance to the community May be needed to establish and/or defend a legal basis for action Provide consistency across units –How transactions are processed –How financial resources are expended NACUBO

Well Written Policies: Enhance understanding Improve controls Reduce risk Increase efficiency & effectiveness Help meet new demands for compliance NACUBO

An Overview NACUBO

The Association of College & University Policy Administrators Mission: The mission of the group is to explore both the "policy process" on college and university campuses as well as to discuss specific policy issues. The mission will be fulfilled through periodic meetings, special events, outreach activities, and electronic communications among the membership. Members: See the Members Directory on the ACUPA web site. NACUBO

The Association of College & University Policy Administrators NACUBO

Indiana Universitys Internal Control Response NACUBO 2008 Internal control discussions at Board of Trustee level Internal control assessment Policy review and change New policies implemented Sub-certification process developed 14

Board Discussions NACUBO 2008 In 2002, Board of Trustees had discussions on value of internal control assessment – prior to Sarbanes-Oxley Board educated on Sarbanes-Oxley Findings on assessment presented to Board of Trustees Detailed discussions on SAS 112 Current discussions on Risk Assessment Standards 15

Internal Control Assessment Accounts Payable Accounts Receivable Auxiliary Accounting Capital Asset Management Cash Control Construction Accounting Debt Accounting Endowment Accounting Financial Systems & Operations Internal Audit Investment Accounting Payroll Plant Accounting Purchasing Student Loans Financial Reporting NACUBO

Policy NACUBO 2008 Role of Fiscal Officer, Account Manager & Account Supervisor - revised December 2002 Internal Control, December 2004 –The Board of Trustees and the President of Indiana University are committed to a solid structure of internal controls. The university considers internal controls to be crucial in providing reasonable assurance regarding the safeguarding of university assets and the achievement of operational, financial reporting and compliance objectives. –The trustees, president, university and campus administrators, deans, department chairs, and directors are responsible for setting a tone of accountability, high ethical standards and business conduct expectations. 17

Policy NACUBO 2008 Fiscal Misconduct, revised March 2005 –Revision separated fiscal misconduct from fraud Fraud, March 2005 –First time fraud language used in a policy Financial Sub-certification – July 2006 –Took 18 months of due process before final policy completed and implemented Whistleblower Policy – April 2007 –Underscores protection and encourages reporting –Supports Indiana Code Segregation of Payroll Duties –Revised 2004 to include auditing and verification of payroll 18

Financial Sub-Certification NACUBO 2008 Internal Control Policy implemented in December 2004 Internal Control Workshops Sub-certification implemented FY 2007 Policy discussions were difficult –Fiscal officers are afraid of added responsibility –Deans feel this is a gotcha and that it is beyond their responsibility –Some campus climates more accommodating than others 19

Financial Sub-Certification NACUBO 2008 Policy requires unit leaders and fiscal officers to sign certification letter Certification letter has 10 certifications that originated from representation letter VPCFO makes to external auditors Certification letters go out each year in July and are required to be returned before September Board of Trustees is VERY supportive of this initiative 20

Indiana University: Successes and Benefits Got senior executive buy-in and invited all appropriate departments to the party Everyone knows how policy process works and where the buck stops in terms of policy development and issuance Fostered positive interaction between university (central) administration and campus staff NACUBO

Indiana University: Successes and Benefits With website access, no longer any paper, postage or binder expenses – paperless! Serves as model for other policy efforts in institution Policies are taken very seriously because everyone knows where they are! NACUBO

Indiana University: Successes and Benefits Serve to ensure the accuracy of transactions and proper access and use of fund accounting policies by staff Core accounting policies were previously developed (57 policies): –What is allowable/not allowable –What is reasonable or not –What is appropriate or not NACUBO

Indiana University: Successes and Benefits There are currently 123 financial policies accessible to internal and external viewers at NACUBO