2. FODS - January 9, 2008 Dennis W. Reedy Indianapolis, Indiana January 9, 2008 Fiscal Officers Development Series Office of the Treasurer Treasury Operations

3. FODS - January 9, 2008 Mission Statement The Office of the Treasurer  Manages the working capital of the university and provides for safe and prudent investment of all university cash reserves;  Provides for the capital financing needs of the university through access to the public debt markets;  Manages treasury-related accounting, compliance, due diligence and reporting functions.  Conducts all banking related business of the university and provides various financially related services to the departments and campuses; and

4. FODS - January 9, 2008 Treasury Operations Organizational Chart Position Descriptions Treasurer MaryFrances McCourt Managing Director Treasury Operations Dennis Reedy Banking Security Coordinator (PT) Diane Thrasher Manager, LAN Josh Welsh Manager Revenue Processing Melody Amato Associate Director Cheryl Shifflett Manager Banking Support David Newsom Associate Director Ruth Harpool Banking Relations Banking/Cash Operations Credit/Debit Card Admin. Treasury Mgt Consulting Revenue Processing Revenue Processing Reviews Money Movement LAN support Webmaster Database Administration Electronic Payments Cr. Cards/ACH PCI DSS Compliance Revenue Processing Cash Concentration Banking Oper/Adm Money Movement Analysis Review Banking Research RFPs Senior Manager e-Business Support Kim Stuart Cr. Cards Research Money Movement VP & Chief Financial Officer Neil Theobald Security & Records Administrative Cashiering Lockboxes/ATMs Revenue Processing

5. FODS - January 9, 2008 What are the Core Principles/Responsibilities of Treasury Operations?  Review all revenue processing activities in conjunction with Policy VI-120  Conduct all transactions in a secure manner.  Ensure all disbursements are funded in a timely manner.  Maximize earnings on bank and investment balances.  Obtain in-coming funds as quickly as possible.  Enhance interest earnings by the timely transfer of liquidity funds to higher-earning investment vehicles.  Maximize the longevity of investments.  Minimize all bank and service provider fees.

6. FODS - January 9, 2008 Core Principles/Responsibilities, continued Core Principles/Responsibilities, continued  Provide secure custody of all financial assets.  Improve and expand the quality and level of financial services provided to IU.  Provide operational support for all Revenue Processing activities at IU.  Switch to and encourage electronic transactions rather than paper whenever possible.

7. FODS - January 9, 2008 No Oops Factor…….

8. FODS - January 9, 2008 How and why do these responsibilities effect you as Fiscal Officers?

9. FODS - January 9, 2008 Your campus/school/department owns most of the receivables/financial assets that we are managing Tuition Accounts Receivable Contracts and Grants Financial Aid Auxiliary Revenues Treasury works with FMS to process transactions on your behalf or safeguard and invest your funds until you decide to disburse them.

10. FODS - January 9, 2008 How Indiana University processes its revenues MUST continually evolve due to the ever changing business environment we operate in.

11. FODS - January 9, 2008 Two Key Objectives PAY AND BE PAID ELECTRONICALLY and PROCESS INFORMATION NOT PAPER

12. FODS - January 9, 2008 Revenue Processing at Indiana University  Over 800,000 credit card transactions each year  ~100,000 lockbox transactions annually  Over 450,000 checks processed annually  Billions of dollars flow into and out of IU’s bank accounts annually  Over 500 units and 900 IU employees process revenue Revenue processing is “Big Business” at IU.

13. FODS - January 9, 2008 Revenue Processing, continued 2006 internal audit found: Poor internal and operational controls Lack of consistency in how revenues are processed Lack of “Best Practices” Exposure to fraud and processing risk Lack of designated responsibility for revenue processing activities No over-arching policy on revenue processing

14. FODS - January 9, 2008 Revenue Processing, continued  Policy VI-120 was approved in July 2006  The Office of the Treasurer is the owner of this policy  What are the objectives for VI-120?  Exercise operational authority over the acceptance and deposit of all payments received by Indiana University  Strengthen internal controls  Deliver consistency in payment types across similar revenue processes  Maintain the highest level of available operational controls to reduce the possibility of fraud, loss of assets and/or loss of sensitive university data  Improve processing efficiencies  Capitalize on the core competency of the Office of the Treasurer relative to banking services, working capital management, credit card processing, electronic payment options and developing technology  Implement “best in Class” revenue processing procedures  Educate and train

15. FODS - January 9, 2008 What Revenues Are Subject to VI-120? ALL funds that are deposited into an Indiana University bank account to subject to this policy.

16. FODS - January 9, 2008 Who Is Covered By VI-120 All staff who process revenues are subject to this policy.

17. FODS - January 9, 2008 How Will Policy VI-120 Impact You As A Fiscal Officer?  The Office of the Treasurer working with Campus Administration has begun conducting reviews of all revenue processing activities at Indiana University as required by Policy VI-120  A Revenue Processing Review (RPR) will eventually be conducted for almost every revenue generating business unit operating within the IU system  Mandatory training  Background checks (pending)

18. FODS - January 9, 2008 Movement From Paper to Electronic Transactions  Over 2/3 of IU’s funds are received electronically  State appropriations  Contract and grant funding  Credit card payments (~ 800,000 transactions in 2007)  Bond proceeds  Financial Aid  ACH payments (Tuition, Student Loans, Child Care)  We are disbursing more funds electronically  Direct Deposit of pay, ACH Payments to vendor. Purchasing Cards, IU Paycard

19. FODS - January 9, 2008 Promote Off-Site Collection  The University’s goal is to minimize the number and dollar amount of payments processed by Departments. Processing payments at the departmental level:  Is expensive in terms of administrative time and lost earnings (Note: Cash is IU’s most expensive type of payment to process)  It exposes the University to a higher risk of monetary theft, data theft/breach and fraud  Typically does not take advantage of the available linkages (e.g. G/L interface)

20. FODS - January 9, 2008 Off-Site Collection of Receivables/ On-Site Conversion/Remote Capture  Lockboxes  Tuition  Student loan payments  Joint gift payments  IUPUI Office of Student Scholarships  International Honors  Cobra payments (HR)  FMS Accounts Receivable  Slavic Language and Lit  Licensing and Trademarks  WEB Payments (ACH and Credit Card)  e-Business activities  NelNet (tuition)  IU Pay  Remote Check Capture/Deposit  IUB Sponsored Research  Bradford Woods  IUB Radio & TV  IUPUI Bursar  IUB Administration  On-site check conversion (POP- Point of Purchase)  Admissions  Bursars  IUPUI Parking  IUPUI Child Care

21. FODS - January 9, 2008 Stating the Obvious  Payment processing and its related banking and vendor services are expensive.  Our operations are decentralized (and even global). This adds a great deal more complexity and risk to our operations.  Smaller staffs and budgets are realities that we all have to live with. This creates internal control challenges.  The banking environment in which we process financial transactions is changing.

22. FODS - January 9, 2008 Indianapolis: A Market in Transition Merchants Bank

23. Disbursements: Electronic & Paper JPMorgan Chase Common Fund REPO INDIANA UNIVERSITY Treasury Operations January 2008 Ameriana Monroe Bank Regions ACH Debits Cr Card Settlements Joint Gift Office Bradford Woods KO Newcastle/EA Deposits (non electronic) Lockboxes Remote Capture Money Market Fund Bank Common Trust Deposits (non electronic) Lockboxes Remote Capture Foreign Drafts MMF Disbursements: Check Northern Trust Banking Fifth Third Deposits: Electronic Western Asset Core Plus Separately Managed Acct Merganser Core Separately Managed Acct. Reams Core Plus Separately Managed Acct Concentration Account Depository Account Investment Account Trust Account Northern Trust Custody Debit only account US Bank Bond Proceeds Credit Cards US Bank Credit Cards Aberdeen Core Plus Separately Managed Account Indiana University Foundation FODS - January 9, 2008  REPO

24. FODS - January 9, 2008 All bank and liquidity accounts are monitored on a daily basis.

25. FODS - January 9, 2008 What are two other major factors driving how we set up and administer our financial and revenue processing functions?

26. FODS - January 9, 2008 FRAUD PREVENTION AND DATA SECURITY

27. FODS - January 9, 2008 We operate in an environment that puts us a risk for both monetary fraud and data theft. Protecting IU (i.e., you, your campuses and departments) from these risks is always of the utmost importance

28. FODS - January 9, 2008  Fraud is a Growth Industry  Paper Checks  Check stock  Payee Positive Pay/Debit blocks  Prompt bank reconciliations  Safeguarding sensitive data  Revolving Funds  Reduce number of banking accounts  Standardize Check Stock  Prompt bank reconciliations  Debits blocks  Positive pay or Reverse Positive Pay  Use of a Paycard  Electronic transactions  Debit blocks  Prompt bank reconciliations  Safeguarding sensitive data

29. FODS - January 9, 2008  Protecting IU from fraud is one of the most difficult challenges we all face.  The laws have changed. If IU suffers a fraud loss, it is very probable that the University will bear the entire loss.  Revolving Funds are more at risk than funds held in centrally managed accounts.

30. FODS - January 9, 2008 Protecting Sensitive Data  Bank account numbers  Credit and debit card numbers  Social security numbers  Passwords  Security codes  Driver’s license numbers

31. FODS - January 9, 2008 Where are You Storing Sensitive Data?  Your desktop PC  A departmental server  File cabinets  Desk drawers  Storage boxes  Off-site warehouse  Emails  Spreadsheets  ??????

32. FODS - January 9, 2008 Data Privacy and Security: The Law Three new Indiana State laws took effect July 1, 2006  Prohibit unauthorized disclosure of SSN  Require secure disposal of records with certain personal information  Require notice of security breaches Pay close attention in the March FODS session given by University Counsel

33. FODS - January 9, 2008 It Gets Worse… If you accept credit/debit cards you are subject to PCI DSS PCI DSS=Payment Card Industry Data Security Standards These are industry standards that we must comply with. They are contained in our contracts that permit us to accept VISA, MasterCard, Discover and American Express

34. FODS - January 9, 2008 Risks of Non Compliance  Large monetary fines assessed to department/IU  Costs associated with becoming compliant after a breach Estimate @ $182.00/per account compromised e.g.: a breach involving 5,000 accounts might cost $910,000.00 (not including fines and penalties)  Loss of merchant status-for department  Loss of merchant status-for IU  Loss of faith in IU name: The biggest cost of ALL.

35. FODS - January 9, 2008 How Do We Comply with PCI DSS?  Remember it is against IU Policy VI-110 to store credit/debit card numbers on any computer, server or database. Exceptions can be approved by Treasury, but are done only on a case by case basis.  If you are currently storing credit/debit please contact my office ASAP at pmtcards@indiana.edu.pmtcards@indiana.edu

36. FODS - January 9, 2008 PCI DSS Compliance, continued  Don’t transmit cardholder data insecurely (email, unsecured fax, campus mail).  Store credit card receipts for only two years (in a secure location).  Destroy receipts so that account information is unreadable and cannot be reconstructed.  Attend training.  Visit the Office of the Treasure website (http://www.indiana.edu/~iutreas) for compliance advice.http://www.indiana.edu/~iutreas  Report suspected or known security breaches immediately!!!!!!!!!!!!

37. FODS - January 9, 2008 Key Points  Provide Treasury with as much notice as possible when planning a major disbursement or if you are expecting a large receipt of funds.  Departments must have the approval of their campus Vice Chancellor for Business or their appropriate Vice President AND the Office of the Treasurer prior to initiating revenue processing activities. See Policies VI-120 and VI-450.  Remind everyone that ALL revenues and the methods and staff used to process them fall under Policy VI-120, Revenue Processing and must be coordinated and approved through Treasury.  Remember that all bank accounts must be approved by Treasury and that only Treasury can open or close a bank account or make an investment.

38. FODS - January 9, 2008 Attend Training Attend and encourage your colleagues to attend training sessions conducted by the Office of the Treasurer  Annual e-Business and Banking Seminar  Periodic Revenue Processing training sessions will be conducted on each campus. Please go to the Office of the Treasurer website to see a schedule of upcoming training sessions.  Utilize the web-based training available on the Office of the Treasurer website: http://www.indiana.edu/~iutreas/rpa- oncourse.htm http://www.indiana.edu/~iutreas/rpa- oncourse.htm  Treasury will try to accommodate any specific requests that departments may have for training  Remember: Training is mandatory for all individuals who process revenue per Policy VI-120.

39. FODS - January 9, 2008  VI-52Opening and Closing Bank Accounts  VI-110Accepting Electronic Payments  I-120Revenue Processing  I-450Establishing and Generating Revenue Activity Key Policies

40. FODS - January 9, 2008 What Can We Do For You?  Work with you to solve any banking, money transfer, credit card, receivables, payables or data security issues  Work with you to identify new processes, products or technologies that will enhance the Treasury-related components that are part of your staffs, departments or campus revenue processing activities, especially WEB initiated transactions  Provide operational and security-related support and advice on all Revenue Processing activities  We can send funds anywhere in the US within two days and can typically do same day transfers if needed.  We can arrange to make funds available at locations almost anywhere in the world (if given enough time)  Quarterly Treasury Newsletter (Contact our office if you would like to added to our email list to receive our newsletter: pmtcards@indiana.edu)pmtcards@indiana.edu  Periodic on campus and ongoing Web based Revenue Processing training sessions

41. FODS - January 9, 2008  When in doubt or have a question… CALL TREASURY

42. FODS - January 9, 2008 Treasury Operations Contacts Dennis W. ReedyPhone: 812.855.9466 Email: dreedy@indiana.edu Fax: 812.855.3863 Office of the Treasurer WEB site www.indiana.edu/~iutreas Money MovementPhone: 812.855.9268 Email: moneymov@indiana.edu Payment Cards (Credit/Debit Cards) Phone: 812.855.0586 Email: pmtcards@indiana.edu Revenue ProcessingPhone: 812 856.5516 Email: rprm@indiana.edu e-Business Phone: 812.855.0586 Email: pmtcards@indiana.edu

43. FODS - January 9, 2008 Your Comments and Questions