2. Is your institution in control? Internal Control, Standard Operating Procedures and the Policy Process T. Michael Ford, Special Assistant to the VP&CFO Kathleen McNeely, Associate Vice President Finance Indiana University NACUBO 20082

3. Overview of Auditing Changes Sarbanes-Oxley –Does not apply to higher education SAS 112 Communicating Internal Control Related Matters –Significant deficiency –Material weakness defined –Requires written communication to management and those charged with governance NACUBO 2008 3

4. Overview of Auditing Changes Risk Assessment Standards (SAS 104-111) –Represents ongoing efforts to develop stronger and more definitive auditing standards –Goals of standards are to enhance auditor performance and improve audit effectiveness –Effective for audits of financial statements for periods beginning on or after Dec. 15, 2006 –Requires an evaluation of the design and implementation of controls (per COSO) NACUBO 2008 4

5. Overview of Auditing Changes NACUBO 2008 5

6. Indiana University Policies can originate from a multitude of initiators VP & CFO Financial Policies Committee Two tracks: Fast Track and Normal Policy Review VP & CFO Final Review and Approval Policies available on website NACUBO 2008 6

7. This is Policy What is a policy? –States an institutional position –Describes mandates, community beliefs and boundaries –Should include why and who What is a Procedure? –Tells us how –Often includes who, what, when and where –The customary or standard practice way of handling situations NACUBO 2008 7

8. This is Policy Why Are Policies and Procedures Important? –Establish responsibilities and accountability –Help ensure compliance and reduce institutional risk NACUBO 2008 8

9. This is Policy Provide clarification and guidance to the community May be needed to establish and/or defend a legal basis for action Provide consistency across units –How transactions are processed –How financial resources are expended NACUBO 2008 9

10. Well Written Policies: Enhance understanding Improve controls Reduce risk Increase efficiency & effectiveness Help meet new demands for compliance NACUBO 2008 10

11. An Overview NACUBO 2008 11

12. The Association of College & University Policy Administrators Mission: The mission of the group is to explore both the "policy process" on college and university campuses as well as to discuss specific policy issues. The mission will be fulfilled through periodic meetings, special events, outreach activities, and electronic communications among the membership. Members: See the Members Directory on the ACUPA web site. http://process.umn.edu/acupa/ http://process.umn.edu/acupa/ NACUBO 2008 12

13. The Association of College & University Policy Administrators NACUBO 2008 13

14. Indiana Universitys Internal Control Response NACUBO 2008 Internal control discussions at Board of Trustee level Internal control assessment Policy review and change New policies implemented Sub-certification process developed 14

15. Board Discussions NACUBO 2008 In 2002, Board of Trustees had discussions on value of internal control assessment – prior to Sarbanes-Oxley Board educated on Sarbanes-Oxley Findings on assessment presented to Board of Trustees Detailed discussions on SAS 112 Current discussions on Risk Assessment Standards 15

16. Internal Control Assessment Accounts Payable Accounts Receivable Auxiliary Accounting Capital Asset Management Cash Control Construction Accounting Debt Accounting Endowment Accounting Financial Systems & Operations Internal Audit Investment Accounting Payroll Plant Accounting Purchasing Student Loans Financial Reporting NACUBO 2008 16

17. Policy NACUBO 2008 Role of Fiscal Officer, Account Manager & Account Supervisor - revised December 2002 Internal Control, December 2004 –The Board of Trustees and the President of Indiana University are committed to a solid structure of internal controls. The university considers internal controls to be crucial in providing reasonable assurance regarding the safeguarding of university assets and the achievement of operational, financial reporting and compliance objectives. –The trustees, president, university and campus administrators, deans, department chairs, and directors are responsible for setting a tone of accountability, high ethical standards and business conduct expectations. 17

18. Policy NACUBO 2008 Fiscal Misconduct, revised March 2005 –Revision separated fiscal misconduct from fraud Fraud, March 2005 –First time fraud language used in a policy Financial Sub-certification – July 2006 –Took 18 months of due process before final policy completed and implemented Whistleblower Policy – April 2007 –Underscores protection and encourages reporting –Supports Indiana Code 20-12-1-8 Segregation of Payroll Duties –Revised 2004 to include auditing and verification of payroll 18

19. Financial Sub-Certification NACUBO 2008 Internal Control Policy implemented in December 2004 Internal Control Workshops Sub-certification implemented FY 2007 Policy discussions were difficult –Fiscal officers are afraid of added responsibility –Deans feel this is a gotcha and that it is beyond their responsibility –Some campus climates more accommodating than others 19

20. Financial Sub-Certification NACUBO 2008 Policy requires unit leaders and fiscal officers to sign certification letter Certification letter has 10 certifications that originated from representation letter VPCFO makes to external auditors Certification letters go out each year in July and are required to be returned before September Board of Trustees is VERY supportive of this initiative 20

21. Indiana University: Successes and Benefits Got senior executive buy-in and invited all appropriate departments to the party Everyone knows how policy process works and where the buck stops in terms of policy development and issuance Fostered positive interaction between university (central) administration and campus staff NACUBO 2008 21

22. Indiana University: Successes and Benefits With website access, no longer any paper, postage or binder expenses – paperless! Serves as model for other policy efforts in institution Policies are taken very seriously because everyone knows where they are! NACUBO 2008 22

23. Indiana University: Successes and Benefits Serve to ensure the accuracy of transactions and proper access and use of fund accounting policies by staff Core accounting policies were previously developed (57 policies): –What is allowable/not allowable –What is reasonable or not –What is appropriate or not NACUBO 2008 23

24. Indiana University: Successes and Benefits There are currently 123 financial policies accessible to internal and external viewers at www.indiana.edu/~vpcfo/policies www.indiana.edu/~vpcfo/policies NACUBO 200824