Transcript MSU Department of Internal Audit Presents: Internal Audit Processes and Procedures Thomas Luccock, Director.

MSU Department of Internal Audit
Presents:
Internal Audit Processes and Procedures
Thomas Luccock, Director
Presenters
•
•
•
•
Thomas Luccock
Jana Dean
Steve Kurncz
Jim Jesswein
0-2
Overview of Topics
•
•
•
•
•
•
•
Organization and Mission
Internal Controls
Risk Assessment
Typical Findings
Fraud Awareness and SAS 99
Information Technology Auditing
The Internal Audit Quiz Bowl
0-3
Organization Chart
Internal Audit
9.65 FTES
All GF
Thomas N. Luccock
Director
Executive Management
Amanda Vankoevering
Secretary III
.9 FTE
Greg Meehan
Student Employee
Jana Dean
Audit Manager
Steve Kurncz
Senior IT Auditor
Mike Chandel
IT Auditor
Amy Refior
Senior Auditor
.75 FTE
Jean M. Brown
Senior Auditor II
Rebecca Fedewa
Senior Auditor
James A. Jesswein
Senior Auditor
Vacant
Senior Auditor
0-4
Our Mission
“To assist University units in effectively
discharging their duties
while ensuring proper control over
University assets.“
0-5
Our Charter
•
•
•
•
•
•
•
•
•
Introduction
Purpose
Authority
Responsibility
Independence
Audit Scope
Special Investigations
Reporting
Audit Standards and Ethics
0-6
What is Internal Auditing?
Internal auditing is an independent, objective
assurance and consulting activity designed to
add value and improve an organization’s
operations. It helps an organization
accomplish its objectives by bringing a
systematic, disciplined approach to evaluate
and improve the effectiveness of risk
management, control, and governance
processes.
-Courtesy of the Institute of Internal Auditors
0-7
The IIA Standards
•
•
•
•
•
•
Independence
Professional Proficiency
Scope
Performance of Audit
Management
Code of Ethics
0-8
Internal Controls
• An integrated system to protect an entity’s
resources and assess risk.
• A system of checks and balances.
• An established way to prevent and detect
intentional and unintentional errors.
• Examples include segregation of duties,
reconciliation, and proper authorization.
• Controls can be preventive or detective.
0-9
Who is Responsible for Internal
Controls?
Management
Delegated to
operational
Areas
Everyone in the
Organization
0-10
Common Types of Internal Controls
Situation
Type of Control
Requiring Passwords to access functions
Preventive
Locking the office when the entire staff leaves
Preventive
The person who collects money does not
reconcile the fund ledgers
Preventive/ Detective
Supervisor review of reconciliations
Preventive/ Detective
Authorized signatures for DPVs and JVEs
Preventive
Petty cash fund locked in safe
Preventive
Procurement card statement approval by
supervisor
Detective
Required procurement card training
Preventive
0-11
Policy Statements
• MSU Manual of Business Procedures
http://ctlr.msu.edu/mbp/httoc.htm
Travel Reimbursement
Cash Handling Procedures
Cell Phone usage practices
It even covers flower purchasing
requirements…
• Departmental Policies
0-12
Procurement Card Policy
• Manual Available at
http://purchasing.msu.edu
• Key Concerns– Approval
– Documentation
– Appropriate Purchases
0-13
Regulatory Requirements
•
•
•
•
•
•
NCAA
/ EPA
Contracts and Grants
Financial Aid
A133
Record Retention
– http://www.msu.edu/unit/msuarhc/
0-14
Organizational Risk
• What is Risk?
-The potential or likelihood of an event
adversely impacting the assets of the
organization or the organization’s business
objectives.
-courtesy of Jefferson Wells
0-15
The Big Picture
Certain factors may impact the industry, organization, or
the auditable unit.
0-16
What is Risk Assessment?
• Its purpose:
– To identify the level of uncontrolled risk.
– To perform an independent appraisal of the
design of an organization’s system of
internal control.
– Includes all the work activities that provide
assurance that the auditable unit has
appropriate controls in place to
comprehensively, effectively, and efficiently
manage its risks.
0-17
How can risk assessment be used?
• To determine which areas within a given
business process should be reviewed.
• To design tests to verify the adequacy of the
identified controls.
• To support a cyclical approach to auditing.
0-18
Audit Tools used during a risk
assessment
•
•
•
•
•
•
Opening meeting
Internal control questionnaires and flowcharts
Regulatory requirements
Prior audit reports and correspondence
Observation of daily activities
Risk Survey – plan to circulate periodically
0-19
Risk Assessment Approach
• Quantifying Risk
-High
-Medium
-Low
• Degree of Control
-High
-Medium
-Low
Other risk assessment
methods utilize convenient
color coding.
0-20
Typical Findings
•
•
•
•
•
•
Deposits
Payroll
Reconciliation
Segregation of Duties
Procurement Cards
Travel Reimbursements
0-21
Fraud Awareness
SAS 99
• Requirements
• 24 Hour Hotline or web reporting
– Complete Anonymity
– 1-800-763-0764
– www.msu.edu/unit/intaudit
/hotline.html
Employee Responsibilities
0-22
Types of Fraud
Fraud
1. Misstatements arising from fraudulent
financial reporting (eg. falsification of
accounting records)
2. Misstatements arising from
misappropriation of assets (eg. theft of
assets or fraudulent expenditures).
0-23
Fraud Facts
•
According to the Association of Certified Fraud Examiners (ACFE), U.S.
businesses lose approximately 5% of their annual revenues to fraud.
•
Seventy five percent of companies surveyed by the KPMG reported
that they had experienced at least one instance of fraud during the
previous 12 months
•
The ACFE estimates that the median loss suffered by organizations
with fewer than 100 employees is $190,000 per fraud scheme. previous
version of the same study, completed in 2002, added that:
•
According to the ACFE, the median length of time between when a
fraud begins and when it is ultimately detected is 18 months.
•
In its 2006 Report to the Nation, the ACFE reports that frauds are more
likely to be detected by a tip than by other means such as internal
audits, external audits, or internal controls.
0-24
The Fraud Triangle
Opportunity
Pressure /
Rationalization
Motives
0-25
Pressures and Motives
• Financial pressures – rising debt/bills; spouse
loses job; poor credit
• Work Related Pressures – adverse
relationship with management; promotions,
compensation or other awards inconsistent
with expectations
• Vice pressures
• Other pressures
0-26
Opportunity
•
•
•
•
•
Lack or circumvention of internal controls
Past failure to discipline wrongdoers
Management apathy
Unwillingness or inability to detect fraud
Lack of an audit trail
0-27
Rationalization
•
•
•
•
•
The organization owes it to me.
I am only borrowing the money.
They can afford it.
I deserve more.
It’s for a good purpose.
0-28
Profile of an Embezzler
•
•
•
•
•
•
Tends to be a trusted employee
Works long hours; first in/last out
Skirts mandatory vacation policy
Opposes cross training
Likeable and generous
Personality may change, moodiness may set
in, when stress of embezzlement catches up
to them, or when they are about to be caught
• Evasive and usually good at lying
0-29
Fraud Red Flags
• Not separating functional responsibilities of
authorization, custodianship, and record
keeping. No one should be responsible for all
aspects of a function from the beginning to
the end of the process.
• Unrestricted access to assets or sensitive
data (e.g., cash, personnel records, etc.)
• Not recording transactions resulting in lack of
accountability
• Not reconciling assets with the appropriate
records
0-30
More Red Flags
• Unauthorized transactions
• Controls not implemented due to lack of
personnel or adequate training
• “Walk through” approvals
• Unimplemented Controls
• Living beyond one’s means
0-31
Prevention
• Senior management team sets the moral and ethical
compass for others to follow
• Management must clearly communicate zero
tolerance for fraud and reinforce the message on a
regular basis
• Strict ethical code at all levels
• Tighten computer security
• Actively seek out red flags
• Make staff accountable
• Utilize MSU’s prevention tools
• Learn and understand behavioral cues
• Use the hotline!!
0-32
What is an Information
Technology Audit?
Information Technology (IT) auditing is defined
as any audit that encompasses the review
and evaluation of all aspects (or any portion)
of automated information processing
systems, including related non-automated
processes, and the interfaces between them.
0-33
Risks
IT infrastructure risks
• Sensitive information
• Monetary transactions processes
• System access restrictions and enforcement
• Weak password policies
• Overall network security controls
0-34
IT Audit Scope
• University policies and guidelines
–
–
–
–
Disaster Recovery Planning and Implementation
Acceptable Use Policy
Data Security and Backup Procedures
Managing Sensitive Data / PCI DSS Compliance
• Industry standards
– Password Policies
– Security Planning and Implementation
– Departmental Acceptable Use Policies
0-35
Information Technology Process
• Scan of systems and associated network
• COBIT Standards - 'Control Objectives for
Information and related Technology‘
• IT Industry “Known Best Practices”
• Partnership with Libraries Computing and
Technology
• Employee Responsibilities
0-36
Typical IT Audit Findings
•
•
•
•
Data backup procedures
Disaster Recovery Plan
Access controls
Security practices
0-37
IT Audit Sensitive Data Focus
• Unit Managing Sensitive Data Procedures
and Policies
– Unit SSN and other sensitive data procedures and
policies
• Unit Payment Card Industry Data Security
Standard (PCI DSS) Compliance
– Unit policies regarding electronic and paper
storage of credit card data
– PCI DSS Compliance Questionnaire
– Unit vulnerability scanning
0-38
Internal Audit Website
0-39
Internal Audit Hotline
0-40
Internal Audit Comments
0-41
Internal Audit Website Resources
0-42
The Audit Bowl
0-43
Question I
Jane is such a dedicated worker, she never misses
work – no vacations, never calls in sick. Because
she is always here, we do not need to train
someone to be her back up.
What Control Weaknesses exist in the above situation?
A) Jane could be committing fraud that could not be
detected because no one ever does her job.
B) If something does happen and Jane is not available
to perform her duties, no one else is able to step in
because no one has been trained.
C) There are no control weaknesses.
D) Both a and b identify weaknesses.
0-44
Question II
Claire’s department sells small items off of their
departmental website. She accepts phone
orders for this merchandise and stores the
purchaser’s credit card number and
information in an Excel spreadsheet, on her
departmental share drive. Once a month
Claire logs into WebCredit and runs all of
the credit cards at once. Is Claire doing
anything wrong? If so, why?
0-45
Question III
Bob forgot his lunch money today so he borrowed from
the petty cash fund. Which statement best
describes if this is a control issue or if it is an
acceptable practice.
A) That’s ok as long as Bob put an IOU in the petty
cash fund.
B) That’s ok as long as Bob repays the next day or at
least before the fund is reconciled.
C) Borrowing from university money is never
acceptable and is considered a control violation.
D) This isn’t an issue as Bob always repays the money.
0-46
Question IV
Mary collects registration money, prepares the deposit, agrees
to the monthly fund ledger reports, and prepares the list of
participants. Which statement concerning this scenario is
true.
A) This makes sense because Mary is responsible for
handling the conference, so she should be responsible for
all areas.
B) This scenario lacks adequate segregation of duties.
Someone else should be involved in at least one of the
steps. The list of participants should be agreed to the fund
ledger report by someone other than Mary.
C) Mary knows everything that is going on with the conference
so it is more efficient to have her handle all the functions.
0-47
Question V
Charley is a student employee on campus. He knows
the rules dictate that he cannot work more than 29
hours in one week during the semester. He works 40
one week but will not work at all the second week.
So Charley records 20 hours per week instead of 40
for week one and 0 for the second week. Is this
acceptable? Why?
0-48
Question VI
Sarah is the business manager. She has several
employees that report to her and are responsible for
posting all money received on their subsidiary
system. Another employee prepares a deposit and
sends by courier to the Cashiers Office. Sarah
agrees the deposit ticket to the fund ledger each
month. What step is Sarah missing?
0-49
Question VII
Jim’s job is to enter mail-in conference registration
forms that his department receives (for a conference
they sponsor) into the AIS WebCredit system. After
Jim charges the customer he keeps these forms (with
full credit card numbers) in a locked cabinet for 3
years because he wants to provide them to the
internal auditors, if necessary, and be able to dispute
any chargeback claims? Is Jim following the
recommended procedures? If not , why?
0-50
Question VIII
Julie frequently takes University office supplies for
home use, such as pens, pencils, and paper. She
also uses the office copy machine to make personal
copies. Which statement is correct concerning this
scenario?
A) Because the items are low cost, this is not a
problem.
B) Because Julie is paid less than her co-workers, she
is entitled to these extra benefits.
C) It is not acceptable to use the University property
and supplies for personal use regardless of cost.
D) Julie has worked for the University for 20 years, and
frequently worked extra hours. The University owes
her.
0-51
Question IX
You see a co-worker put some cash received for a
conference in his bag. Later you are reconciling the
list of participants to the fund ledger and have a
difference. What should you do?
0-52
Question X
Abbie is responsible for depositing all checks with the
Cashier’s Office. It is late Friday afternoon and Abbie is
leaving for a 10 day vacation in the Bahamas. Her last
task for the day is to open the mail. In the mail, there is a
$10,000 check for the upcoming conference and the
Cashier’s Office is already closed. What should Abbie
do?
A) Lock the check in her desk drawer and deposit it when
she returns from vacation.
B) Take the check home with her so she is sure it is secure
and deposit it when she returns from vacation.
C) Give the check to Wanda, her backup, so she can make
sure it is secure and deposit it first thing Monday
morning.
0-53
Question XI
Scott has a university procurement card. Scott is very careful to
keep all receipts for each purchase and makes sure no one
has access to his card but him. Each month Scott agrees
his receipts to his statement. He attaches the receipts to
the statements and stores them in his desk in a file labeled
“Procurement Card”. What control step is Scott missing?
A) Scott should verify that sales tax was not charged to the
university.
B) Scott’s supervisor or a designated budget/business
administrator should review and approve the statement with
the receipts.
C) Scott should sign the statement as the cardholder.
D) All of the above
0-54
Question XII
Ben is a professor. A conference relating to his
research is being held in Orlando, Florida in May.
Ben talks to his Dean and receives verbal approval
for the trip. The Administrative Assistant registers
Ben for the conference and contacts Spartan Travel
to make the airline and hotel reservations. Ben now
feels he is all set for the trip. What step is Ben
missing?
0-55
Question XIII
Ben attended the conference and found it very useful.
He turns in the receipts for the hotel and meals, and
also the airline tickets to the Administrative Assistant
to process his travel voucher. What other document
should Ben include?
0-56
Question XIV
Jennifer is the Business Manager for a large department on
campus. Her secretary has just accepted a position in
another department. Jennifer knows the perfect
replacement who has the type of experience needed,
Suzie. Suzie is Jennifer’s younger sister. Suzie would
report directly to Jennifer. Which statement best
describes this situation?
A) Suzie is qualified then she should be hired for the
position.
B) If Suzie is a direct report to Jennifer then it appears to be
a conflict of interest. Someone could accuse Jennifer of
providing higher raises or other benefits to Suzie
because they are related.
C) Jennifer and Suzie would work great together since they
are sisters.
0-57
Question XV
The Administrative Assistant for a large department is filing last
years fund ledger documents and other departmental
documents. When she enters the storage room she finds it
almost full. She reviews the dates on the boxes and finds
many that are 10 years old. She decides she should throw
those out but thought she should get approval first. Who
should she contact to find out the record retention policy?
A)
B)
C)
D)
Internal Audit
Controller’s Office
University Archives
Both b and c
0-58
Summary
• The Internal Audit mission is defined by our
charter.
• Internal Controls are everyone’s
responsibility.
• Policies and procedures should be followed.
• Internal Audit constantly assesses risks.
• Fraud should be reported.
• Internal Audit is available for advice.
0-59
Audience Questions?
• Comments may be directed to our website at• www.msu.edu/~intaudit/comments.html
• (submissions may be made anonymously, if
so desired)
• Remember to tell your friends about the
Fraud Hotline at 1-800-763-0764 or
www.msu.edu/unit/intaudit/hotline.html
0-60
Methods of Reporting Fraud
• MSU Hotline – call center/web reporting
• Direct contact with Internal Audit/DPPS/HR
Key links:
IA website: www.msu.edu/~intaudit
Fiscal misconduct guidelines:
http://www.ctlr.msu.edu/mbp/fiscaLmisconduct.h
tml
0-61