1. WHAT KEEPS YOU UP AT NIGHT? NCURA, Financial Research Administration, New Orleans, March 10 – 12, 2013 Nuala McGowan, Senior Manager for Compliance, Harvard University Michael Monaghan, Director of Financial, Operational & Compliance Audit, Harvard University

2. Agenda  Introductions  Risks and risk management  What do you worry about?  How should I think about risk?  What can I do about it? 2

3. Introductions Nuala Michael 3

4. Introductions Which of the following best describes your role? 1. Central Sponsored Research Administration Office 2. Department Grants Management 3. Department - other 4. Compliance Office 5. At wrong conference, I think 4

5. Introductions How many years of research administration experience do you have? 1. Less than 1 year 2. 1-3 years 3. 3-5 years 4. 5-10 years 5. 10-15 years 6. Too many to count / >15 5

6. Risks and Risk Management  What is risk?  Risk Management “The hole is not at my end of the boat so I don’t have to worry…” 6

7. What do you worry about? Effort Reporting Cost Sharing Extra Comp Cost Transfers Admin Expenses Conflict of Interest Recharge Centers Export Controls T&E Expenses Other? 7

8. The End Game - Residual Risk Heat Map Management Controls Low Risk High Risk WeakModerateStrong Strengthen ControlsAudit Controls MonitorSelf Assess Moderate Risk Risk 2 Risk 6 Risk 3 Risk 5 Risk 4 Risk 1 8

9. Risk Assessment - The Voting Process Three Elements: 1. Likelihood of occurrence 2. Impact of occurrence 3. Management control level - Inherent Risk Residual Risk 9

10. 10 Based on Risk Management Materials provided by KPMG/McGill University Risk Assessment Criteria LowMediumHigh IMPACT (1) Insignificant(2) Minor(3) Moderate(4) Major(5) Extreme Financial (Amounts are for guidance, could vary depending on context) <1% of annual expenditures <$1M 1% - 5% of annual expenditures $1M-$5M 5% - 10% of annual expenditures $5M-$10M 10% - 25% of annual expenditures $10M-$25M >25% of annual expenditures >$25M ReputationThe public is unaware of the event or does not view the event as being outside expectations of the School/University. The public would view the event as having minimal conflict with expectations of the School/University The public would view this event as a significant event that is in some conflict with regulatory requirements or expectations, but has been managed acceptably. The public would view as a major event that conflicts with regulatory requirements, ethical behavior or in conflict with the School/Univ’s mission The public would view the event as outrageously out of line with regulatory requirements, ethical behavior or in conflict with the School/Univ’s mission Management EffortAn event, the impact for which can be absorbed through normal activity An event, the consequences of, can be absorbed and minimal management effort is required. A significant event which takes a moderate level of effort to manage, but the impact can be minimized to a reasonable level. A critical event, which with proper management, can be endured A disaster with potential to lead to a rapid realignment of the School/University’s management and objectives, and the possibility of external supervision Operational Resources (Money, People, Facilities, Outside consultants, etc) The event does not require operational resources above normal levels Minor operational resources are required to absorb the event. The event requires a moderate level of operational resources to manage to an acceptable level. A critical event that requires significant operational resources to be endured. A disaster that requires extreme levels of management resources. LIKELIHOOD(1) Rare(2) Unlikely(3) Moderate(4) Likely(5) Almost Certain Odds of occurrence Less than once in 10 years Less than once every 2/3 years At least once per yearOccasionally during the year Frequently in one year MANAGEMENT CONTROLS (1) Weak(2) Weak/Mod(3) Moderate(4) Mod/Strong(5) Strong Most risk is not being mitigated Few risks are mitigated to an acceptable level Some risks are mitigated to an acceptable level Most risk is mitigated to an acceptable level Best Practice

11. Sample Question The risk of a power failure midway through the Super Bowl leading to a game delay and disruption to television scheduling on an international scale. Mean = Impact 1. Insignificant 2. Minor 3. Moderate 4. Major 5. Extreme 11

12. 1. Rare 2. Unlikely 3. Moderate 4. Likely 5. Almost Certain Likelihood Sample Question The risk of a power failure midway through the Super Bowl leading to a game delay and disruption to television scheduling on an international scale. Mean = 12

13. Mean = Management Controls 1. Weak 2. Weak/Mod 3. Moderate 4. Mod/Strong 5. Strong Sample Question The risk of a power failure midway through the Super Bowl leading to a game delay and disruption to television scheduling on an international scale. 13

14. Mean = Impact Effort Reporting The risk that salaries charged, or effort committed, to federal awards do not reflect the effort or activity actually expended on respective awards leading to disallowed costs, fines and penalties 1. Insignificant 2. Minor 3. Moderate 4. Major 5. Extreme 14

15. 1. Rare 2. Unlikely 3. Moderate 4. Likely 5. Almost Certain Likelihood Effort Reporting The risk that salaries charged, or effort committed, to federal awards do not reflect the effort or activity actually expended on respective awards leading to disallowed costs, fines and penalties Mean = 15

16. Mean = Management Controls 1. Weak 2. Weak/Mod 3. Moderate 4. Mod/Strong 5. Strong Effort Reporting The risk that salaries charged, or effort committed, to federal awards do not reflect the effort or activity actually expended on respective awards leading to disallowed costs, fines and penalties 16

17. Mean = Impact Cost Transfers The risk that unallowable or unallocable costs are transferred to a federal sponsored award leading to disallowed costs, additional audit scrutiny, fines and penalties 1. Insignificant 2. Minor 3. Moderate 4. Major 5. Extreme 17

18. 1. Rare 2. Unlikely 3. Moderate 4. Likely 5. Almost Certain Likelihood Cost Transfers The risk that unallowable or unallocable costs are transferred to a federal sponsored award leading to disallowed costs, additional audit scrutiny, fines and penalties Mean = 18

19. Mean = Management Controls 1. Weak 2. Weak/Mod 3. Moderate 4. Mod/Strong 5. Strong Cost Transfers The risk that unallowable or unallocable costs are transferred to a federal sponsored award leading to disallowed costs, additional audit scrutiny, fines and penalties 19

20. Recharge Centers The risk that rate schedules are based on inaccurate or incomplete financial information or are not consistently applied leading to the overbilling of federal awards and non-compliance with University policy and federal requirements Mean = Impact 1. Insignificant 2. Minor 3. Moderate 4. Major 5. Extreme 20

21. 1. Rare 2. Unlikely 3. Moderate 4. Likely 5. Almost Certain Likelihood Recharge Centers The risk that rate schedules are based on inaccurate or incomplete financial information or are not consistently applied leading to the overbilling of federal awards and non-compliance with University policy and federal requirements Mean = 21

22. Mean = Management Controls 1. Weak 2. Weak/Mod 3. Moderate 4. Mod/Strong 5. Strong Recharge Centers The risk that rate schedules are based on inaccurate or incomplete financial information or are not consistently applied leading to the overbilling of federal awards and non-compliance with University policy and federal requirements 22

23. Mean = Impact Administrative Expenses The risk that unallowable and / or unallocable administrative salaries and expenses are charged to federal awards leading to disallowed costs, fines and penalties 1. Insignificant 2. Minor 3. Moderate 4. Major 5. Extreme 23

24. 1. Rare 2. Unlikely 3. Moderate 4. Likely 5. Almost Certain Likelihood Administrative Expenses The risk that unallowable and / or unallocable administrative salaries and expenses are charged to federal awards leading to disallowed costs, fines and penalties Mean = 24

25. Mean = Management Controls 1. Weak 2. Weak/Mod 3. Moderate 4. Mod/Strong 5. Strong Administrative Expenses The risk that unallowable and / or unallocable administrative salaries and expenses are charged to federal awards leading to disallowed costs, fines and penalties 25

26. Mean = Impact Sponsor Reporting The risk that financial and / or technical reports are not submitted timely leading to funding / payment delays 1. Insignificant 2. Minor 3. Moderate 4. Major 5. Extreme 26

27. 1. Rare 2. Unlikely 3. Moderate 4. Likely 5. Almost Certain Likelihood Sponsor Reporting The risk that financial and / or technical reports are not submitted timely leading to funding / payment delays Mean = 27

28. Mean = Management Controls 1. Weak 2. Weak/Mod 3. Moderate 4. Mod/Strong 5. Strong Sponsor Reporting The risk that financial and / or technical reports are not submitted timely leading to funding / payment delays 28

29. Mean = Impact International Projects The risk that international sponsored research projects do not comply with University policies and sponsor and / or national requirements leading to regulatory non-compliance, potential funding losses and reputational damage 1. Insignificant 2. Minor 3. Moderate 4. Major 5. Extreme 29

30. 1. Rare 2. Unlikely 3. Moderate 4. Likely 5. Almost Certain Likelihood International Projects The risk that international sponsored research projects do not comply with University policies and sponsor and / or national requirements leading to regulatory non-compliance, potential funding losses and reputational damage Mean = 30

31. Mean = Management Controls 1. Weak 2. Weak/Mod 3. Moderate 4. Mod/Strong 5. Strong International Projects The risk that international sponsored research projects do not comply with University policies and sponsor and / or national requirements leading to regulatory non-compliance, potential funding losses and reputational damage 31

32. Mean = Impact Sub-recipient Monitoring The risk that subrecipients do not conduct research in compliance with laws, regulations and terms and conditions of awards and subawards and that project costs incurred are not reasonable and allowable 1. Insignificant 2. Minor 3. Moderate 4. Major 5. Extreme 32

33. 1. Rare 2. Unlikely 3. Moderate 4. Likely 5. Almost Certain Likelihood Sub-recipient Monitoring The risk that subrecipients do not conduct research in compliance with laws, regulations and terms and conditions of awards and subawards and that project costs incurred are not reasonable and allowable Mean = 33

34. Mean = Management Controls 1. Weak 2. Weak/Mod 3. Moderate 4. Mod/Strong 5. Strong Sub-recipient Monitoring The risk that subrecipients do not conduct research in compliance with laws, regulations and terms and conditions of awards and subawards and that project costs incurred are not reasonable and allowable 34

35. Mean = Impact Export Controls The risk that export-controlled information, materials or items are transferred overseas or to a foreign national without the required approvals / licenses leading to civil and criminal penalties and reputational damage 1. Insignificant 2. Minor 3. Moderate 4. Major 5. Extreme 35

36. 1. Rare 2. Unlikely 3. Moderate 4. Likely 5. Almost Certain Likelihood Export Controls The risk that export-controlled information, materials or items are transferred overseas or to a foreign national without the required approvals / licenses leading to civil and criminal penalties and reputational damage Mean = 36

37. Mean = Management Controls 1. Weak 2. Weak/Mod 3. Moderate 4. Mod/Strong 5. Strong Export Controls The risk that export-controlled information, materials or items are transferred overseas or to a foreign national without the required approvals / licenses leading to civil and criminal penalties and reputational damage 37

38. Mean = Impact Travel and Reimbursement Expenses The risk that unallowable or unallocable travel and reimbursement expenses are charged to a federal award leading to disallowed costs, additional audit scrutiny, fines and penalties 1. Insignificant 2. Minor 3. Moderate 4. Major 5. Extreme 38

39. 1. Rare 2. Unlikely 3. Moderate 4. Likely 5. Almost Certain Likelihood Travel and Reimbursement Expenses The risk that unallowable or unallocable travel and reimbursement expenses are charged to a federal award leading to disallowed costs, additional audit scrutiny, fines and penalties Mean = 39

40. Mean = Management Controls 1. Weak 2. Weak/Mod 3. Moderate 4. Mod/Strong 5. Strong Travel and Reimbursement Expenses The risk that unallowable or unallocable travel and reimbursement expenses are charged to a federal award leading to disallowed costs, additional audit scrutiny, fines and penalties 40

41. Mean = Impact Equipment Management The risk that equipment management policies and procedures and associated records do not comply with federal requirements leading to audit findings and additional federal scrutiny 1. Insignificant 2. Minor 3. Moderate 4. Major 5. Extreme 41

42. 1. Rare 2. Unlikely 3. Moderate 4. Likely 5. Almost Certain Likelihood Equipment Management The risk that equipment management policies and procedures and associated records do not comply with federal requirements leading to audit findings and additional federal scrutiny Mean = 42

43. Mean = Management Controls 1. Weak 2. Weak/Mod 3. Moderate 4. Mod/Strong 5. Strong Equipment Management The risk that equipment management policies and procedures and associated records do not comply with federal requirements leading to audit findings and additional federal scrutiny 43

44. Mean = Impact Cost Sharing The risk that cost sharing commitments are not fully accounted for and tracked leading to non- compliance with award terms and inflation of overhead costs 1. Insignificant 2. Minor 3. Moderate 4. Major 5. Extreme 44

45. 1. Rare 2. Unlikely 3. Moderate 4. Likely 5. Almost Certain Likelihood Cost Sharing The risk that cost sharing commitments are not fully accounted for and tracked leading to non- compliance with award terms and inflation of overhead costs Mean = 45

46. Mean = Management Controls 1. Weak 2. Weak/Mod 3. Moderate 4. Mod/Strong 5. Strong Cost Sharing The risk that cost sharing commitments are not fully accounted for and tracked leading to non- compliance with award terms and inflation of overhead costs 46

47. Mean = Impact Extra Compensation The risk of unauthorized and non-compliant extra compensation payments to faculty and research personnel charged to federal awards leading to disallowed costs and audit findings 1. Insignificant 2. Minor 3. Moderate 4. Major 5. Extreme 47

48. 1. Rare 2. Unlikely 3. Moderate 4. Likely 5. Almost Certain Likelihood Extra Compensation The risk of unauthorized and non-compliant extra compensation payments to faculty and research personnel charged to federal awards leading to disallowed costs and audit findings Mean = 48

49. Mean = Management Controls 1. Weak 2. Weak/Mod 3. Moderate 4. Mod/Strong 5. Strong Extra Compensation The risk of unauthorized and non-compliant extra compensation payments to faculty and research personnel charged to federal awards leading to disallowed costs and audit findings 49

50. Mean = Impact Conflict of Interests The risk that personal/family relationships and dealings with third parties are not fully disclosed or resolved leading to research integrity challenges and negative publicity 1. Insignificant 2. Minor 3. Moderate 4. Major 5. Extreme 50

51. 1. Rare 2. Unlikely 3. Moderate 4. Likely 5. Almost Certain Likelihood Conflict of Interests The risk that personal/family relationships and dealings with third parties are not fully disclosed or resolved leading to research integrity challenges and negative publicity Mean = 51

52. Mean = Management Controls 1. Weak 2. Weak/Mod 3. Moderate 4. Mod/Strong 5. Strong Conflict of Interests The risk that personal/family relationships and dealings with third parties are not fully disclosed or resolved leading to research integrity challenges and negative publicity 52

53. Mean = Impact Additional Risk One As needed 1. Insignificant 2. Minor 3. Moderate 4. Major 5. Extreme 53

54. 1. Rare 2. Unlikely 3. Moderate 4. Likely 5. Almost Certain Likelihood Additional Risk One As needed Mean = 54

55. Mean = Management Controls 1. Weak 2. Weak/Mod 3. Moderate 4. Mod/Strong 5. Strong Additional Risk One As needed 55

56. Mean = Impact Additional Risk Two As needed 1. Insignificant 2. Minor 3. Moderate 4. Major 5. Extreme 56

57. 1. Rare 2. Unlikely 3. Moderate 4. Likely 5. Almost Certain Likelihood Additional Risk Two As needed Mean = 57

58. Mean = Management Controls 1. Weak 2. Weak/Mod 3. Moderate 4. Mod/Strong 5. Strong Additional Risk Two As needed 58

59. What can I do about it?  Ensure Policies and Procedures are up to date and widely communicated / distributed  Continuous Monitoring  exception reporting / quarterly spot checks  Rigor in review and approval processes  Organizational structure / governance  support at the department and school level  Empower and support the sponsored community  know where to go when you have questions or need help  Training, Training, Training!!!  comprehensive training programs / small brownbags

60. Thank you! You can reach us at: Nuala McGowan 617 495 7681 nmcgowan@fas.harvard.edu Michael Monaghan 617 496 2165 Michael_monaghan@harvard.edu 60