Internal Control Update FY 2011 Unit Certification Results and FY 2012 Plans April 10, 2012 BAG Meeting

FY 2011 Unit Certification Results “Yes” Response: 1 st Year – Gap analysis completed and plans in place for addressing control gaps within the next 12 months On-Going – Unit has completed annual gap analysis and proper controls are in place 2 FY2007 FY2008 FY2009 FY2010FY2011FY2010FY2011FY2010FY2011FY2010FY2011FY2010FY2011 FY2009

3 FY 2011 Unit Certification Results All Other Categories Overall Total Internal Controls Trend of “Yes” Responses 3 (1 Process) (7 Processes) Internal Controls – Processes that require units to perform annual gap analysis of key controls All Other – Attestation topics such as Stewardship, Financial Results, IT Security and other key risk related topics

Compliance Hotline Available in Wolverine Access 44

FY 2012 Internal Control Plans 5 New for FY 2012 Compliance Hotline – Increasing awareness: “I am promoting the University Compliance Hotline within my unit by ensuring Compliance Hotline posters are prominently displayed and have sent a communication to my unit on the process for reporting incidents or concerns at U-M” Unit Administered Financial Aid – tools available on website Data driven insight to improve controls and accountability On-Going Financial Related Processes Minor updates (changes highlighted in red) – tools available on website Human Subject Incentive Payments (HSIP) and Employee Travel and Expense (Concur) – “have proper controls in place” MReports Added additional MReports Internal Control access role: ‒ Everything including Employment reports (current) ‒ Everything except Employment reports (new access option) On-Line Sub-Certification and Gap Analysis functionality available in MReports (FY2012 Gap Analysis updates in progress) 5

Recent Audit Findings 6 “University Audits reviewed the gap analysis for credit cards and determined that TBD department was not included in the self assessment process. TBD department is logistically separate from the main unit and was inadvertently not included in the annual process.” “In prior years, annual certifications were signed as fully compliant without performing the underlying assessment and detecting existing internal control gaps that are highlighted as part of this report.” TBD Department’s gap analysis was completed by only one individual who did not have complete knowledge of processes within all areas of the department. As a result, some procedures were not accurately described and existing control weaknesses were not identified.” “TBD unit prepares the internal controls certification centrally. Individual departments do not provide input or participate in the process. University Audits identified multiple scenarios where the control environment within a particular department did not match the overall controls documented in the unit-wide certification.” 6

FY 2012 Unit Certification Timeline Roll-out control matrixes and FY2012 plans to units –Confirm internal control data/metrics Units complete gap analysis Distribute internal control data/metrics to certifying Deans/VPs Issue FY2012 Certification Requests Signed Unit Certification Forms due Present FY2012 Unit Certification Results to Audit Committee Jan – Jun Apr - Jun Jan – Sept July - Aug Early Sept End Sept November EventTiming 7 7