MSU Department of Internal AuditPresents:

Internal Audit Processes and Procedures

Thomas Luccock, Director

0-2

Presenters• Thomas Luccock• Jana Dean• Steve Kurncz• Jim Jesswein

0-3

Overview of Topics• Organization and Mission• Internal Controls• Risk Assessment• Typical Findings• Fraud Awareness and SAS 99• Information Technology Auditing• The Internal Audit Quiz Bowl

0-4

Organization Chart

Thomas N. LuccockDirector

Executive Management

Amanda Vankoevering Secretary III

.9 FTE

Jean M. BrownSenior Auditor II

VacantSenior Auditor

Rebecca FedewaSenior Auditor

Amy RefiorSenior Auditor

.75 FTE

James A. JessweinSenior Auditor

Mike ChandelIT Auditor

Steve KurnczSenior IT Auditor

Internal Audit9.65 FTES

All GF

Jana DeanAudit Manager

Greg MeehanStudent Employee

0-5

Our Mission

“To assist University units in effectively discharging their duties

while ensuring proper control over University assets.“

0-6

Our Charter• Introduction• Purpose• Authority• Responsibility• Independence• Audit Scope• Special Investigations• Reporting• Audit Standards and Ethics

0-7

What is Internal Auditing?Internal auditing is an independent, objective

assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.

-Courtesy of the Institute of Internal Auditors

0-8

The IIA Standards• Independence• Professional Proficiency• Scope• Performance of Audit• Management• Code of Ethics

0-9

Internal Controls• An integrated system to protect an entity’s

resources and assess risk.• A system of checks and balances.• An established way to prevent and detect

intentional and unintentional errors.• Examples include segregation of duties,

reconciliation, and proper authorization.• Controls can be preventive or detective.

0-10

Who is Responsible for Internal Controls?

Management Delegated to operational

Areas

Everyone in the Organization

0-11

Common Types of Internal Controls

Situation Type of Control

Requiring Passwords to access functions Preventive

Locking the office when the entire staff leaves Preventive

The person who collects money does not reconcile the fund ledgers

Preventive/ Detective

Supervisor review of reconciliations Preventive/ Detective

Authorized signatures for DPVs and JVEs Preventive

Petty cash fund locked in safe Preventive

Procurement card statement approval by supervisor

Detective

Required procurement card training Preventive

0-12

Policy Statements• MSU Manual of Business Procedures

http://ctlr.msu.edu/mbp/httoc.htm

Travel Reimbursement

Cash Handling Procedures

Cell Phone usage practices

It even covers flower purchasing requirements…

• Departmental Policies

0-13

Procurement Card Policy• Manual Available at

http://purchasing.msu.edu• Key Concerns-

– Approval– Documentation– Appropriate Purchases

0-14

Regulatory Requirements• NCAA• / EPA• Contracts and Grants • Financial Aid• A133• Record Retention

– http://www.msu.edu/unit/msuarhc/

0-15

Organizational Risk• What is Risk?

-The potential or likelihood of an event adversely impacting the assets of the organization or the organization’s business objectives.

-courtesy of Jefferson Wells

0-16

The Big PictureCertain factors may impact the industry, organization, or

the auditable unit.

0-17

What is Risk Assessment?• Its purpose:

– To identify the level of uncontrolled risk.– To perform an independent appraisal of the

design of an organization’s system of internal control.

– Includes all the work activities that provide assurance that the auditable unit has appropriate controls in place to comprehensively, effectively, and efficiently manage its risks.

0-18

How can risk assessment be used?

• To determine which areas within a given business process should be reviewed.

• To design tests to verify the adequacy of the identified controls.

• To support a cyclical approach to auditing.

0-19

Audit Tools used during a risk assessment• Opening meeting• Internal control questionnaires and flowcharts• Regulatory requirements• Prior audit reports and correspondence• Observation of daily activities• Risk Survey – plan to circulate periodically

0-20

Risk Assessment Approach• Quantifying Risk

-High

-Medium

-Low• Degree of Control

-High

-Medium

-Low

Other risk assessment methods utilize convenient

color coding.

0-21

Typical Findings• Deposits• Payroll• Reconciliation• Segregation of Duties• Procurement Cards• Travel Reimbursements

0-22

Fraud AwarenessSAS 99• Requirements• 24 Hour Hotline or web reporting

– Complete Anonymity– 1-800-763-0764– www.msu.edu/unit/intaudit

/hotline.html

Employee Responsibilities

0-23

Types of Fraud

Fraud

1. Misstatements arising from fraudulent financial reporting (eg. falsification of accounting records)

2. Misstatements arising from misappropriation of assets (eg. theft of assets or fraudulent expenditures).

0-24

Fraud Facts

• According to the Association of Certified Fraud Examiners (ACFE), U.S. businesses lose approximately 5% of their annual revenues to fraud.

• Seventy five percent of companies surveyed by the KPMG reported that they had experienced at least one instance of fraud during the previous 12 months

• The ACFE estimates that the median loss suffered by organizations with fewer than 100 employees is $190,000 per fraud scheme. previous version of the same study, completed in 2002, added that:

• According to the ACFE, the median length of time between when a fraud begins and when it is ultimately detected is 18 months.

• In its 2006 Report to the Nation, the ACFE reports that frauds are more likely to be detected by a tip than by other means such as internal audits, external audits, or internal controls.

0-25

The Fraud Triangle

Opportunity

RationalizationPressure /

Motives

0-26

Pressures and Motives• Financial pressures – rising debt/bills; spouse

loses job; poor credit• Work Related Pressures – adverse

relationship with management; promotions, compensation or other awards inconsistent with expectations

• Vice pressures• Other pressures

0-27

Opportunity• Lack or circumvention of internal controls• Past failure to discipline wrongdoers• Management apathy• Unwillingness or inability to detect fraud• Lack of an audit trail

0-28

Rationalization• The organization owes it to me.• I am only borrowing the money.• They can afford it.• I deserve more.• It’s for a good purpose.

0-29

Profile of an Embezzler• Tends to be a trusted employee• Works long hours; first in/last out• Skirts mandatory vacation policy• Opposes cross training• Likeable and generous• Personality may change, moodiness may set

in, when stress of embezzlement catches up to them, or when they are about to be caught

• Evasive and usually good at lying

0-30

Fraud Red Flags• Not separating functional responsibilities of

authorization, custodianship, and record keeping. No one should be responsible for all aspects of a function from the beginning to the end of the process.

• Unrestricted access to assets or sensitive data (e.g., cash, personnel records, etc.)

• Not recording transactions resulting in lack of accountability

• Not reconciling assets with the appropriate records

0-31

More Red Flags• Unauthorized transactions• Controls not implemented due to lack of

personnel or adequate training• “Walk through” approvals• Unimplemented Controls• Living beyond one’s means

0-32

Prevention• Senior management team sets the moral and ethical

compass for others to follow• Management must clearly communicate zero

tolerance for fraud and reinforce the message on a regular basis

• Strict ethical code at all levels• Tighten computer security• Actively seek out red flags• Make staff accountable• Utilize MSU’s prevention tools• Learn and understand behavioral cues• Use the hotline!!

0-33

What is an Information Technology Audit?

Information Technology (IT) auditing is defined as any audit that encompasses the review and evaluation of all aspects (or any portion) of automated information processing systems, including related non-automated processes, and the interfaces between them.

0-34

Risks

IT infrastructure risks • Sensitive information• Monetary transactions processes• System access restrictions and enforcement• Weak password policies• Overall network security controls

0-35

IT Audit Scope• University policies and guidelines

– Disaster Recovery Planning and Implementation– Acceptable Use Policy– Data Security and Backup Procedures– Managing Sensitive Data / PCI DSS Compliance

• Industry standards– Password Policies– Security Planning and Implementation– Departmental Acceptable Use Policies

0-36

Information Technology Process

• Scan of systems and associated network• COBIT Standards - 'Control Objectives for

Information and related Technology‘• IT Industry “Known Best Practices”• Partnership with Libraries Computing and

Technology• Employee Responsibilities

0-37

Typical IT Audit Findings• Data backup procedures• Disaster Recovery Plan• Access controls• Security practices

0-38

IT Audit Sensitive Data Focus

• Unit Managing Sensitive Data Procedures and Policies– Unit SSN and other sensitive data procedures and

policies

• Unit Payment Card Industry Data Security Standard (PCI DSS) Compliance– Unit policies regarding electronic and paper

storage of credit card data– PCI DSS Compliance Questionnaire– Unit vulnerability scanning

0-39

Internal Audit Website

0-40

Internal Audit Hotline

0-41

Internal Audit Comments

0-42

Internal Audit Website Resources

0-43

The Audit Bowl

0-44

Question IJane is such a dedicated worker, she never misses

work – no vacations, never calls in sick. Because she is always here, we do not need to train someone to be her back up.

What Control Weaknesses exist in the above situation?A) Jane could be committing fraud that could not be

detected because no one ever does her job.B) If something does happen and Jane is not available

to perform her duties, no one else is able to step in because no one has been trained.

C) There are no control weaknesses.D) Both a and b identify weaknesses.

0-45

Question IIClaire’s department sells small items off of their

departmental website. She accepts phone orders for this merchandise and stores the purchaser’s credit card number and information in an Excel spreadsheet, on her departmental share drive. Once a month Claire logs into WebCredit and runs all of the credit cards at once. Is Claire doing anything wrong? If so, why?

0-46

Question IIIBob forgot his lunch money today so he borrowed from

the petty cash fund. Which statement best describes if this is a control issue or if it is an acceptable practice.

A) That’s ok as long as Bob put an IOU in the petty cash fund.

B) That’s ok as long as Bob repays the next day or at least before the fund is reconciled.

C) Borrowing from university money is never acceptable and is considered a control violation.

D) This isn’t an issue as Bob always repays the money.

0-47

Question IVMary collects registration money, prepares the deposit, agrees

to the monthly fund ledger reports, and prepares the list of participants. Which statement concerning this scenario is true.

A) This makes sense because Mary is responsible for handling the conference, so she should be responsible for all areas.

B) This scenario lacks adequate segregation of duties. Someone else should be involved in at least one of the steps. The list of participants should be agreed to the fund ledger report by someone other than Mary.

C) Mary knows everything that is going on with the conference so it is more efficient to have her handle all the functions.

0-48

Question VCharley is a student employee on campus. He knows

the rules dictate that he cannot work more than 29 hours in one week during the semester. He works 40 one week but will not work at all the second week. So Charley records 20 hours per week instead of 40 for week one and 0 for the second week. Is this acceptable? Why?

0-49

Question VISarah is the business manager. She has several

employees that report to her and are responsible for posting all money received on their subsidiary system. Another employee prepares a deposit and sends by courier to the Cashiers Office. Sarah agrees the deposit ticket to the fund ledger each month. What step is Sarah missing?

0-50

Question VIIJim’s job is to enter mail-in conference registration

forms that his department receives (for a conference they sponsor) into the AIS WebCredit system. After Jim charges the customer he keeps these forms (with full credit card numbers) in a locked cabinet for 3 years because he wants to provide them to the internal auditors, if necessary, and be able to dispute any chargeback claims? Is Jim following the recommended procedures? If not , why?

0-51

Question VIIIJulie frequently takes University office supplies for home

use, such as pens, pencils, and paper. She also uses the office copy machine to make personal copies. Which statement is correct concerning this scenario?

A) Because the items are low cost, this is not a problem.

B) Because Julie is paid less than her co-workers, she is entitled to these extra benefits.

C) It is not acceptable to use the University property and supplies for personal use regardless of cost.

D) Julie has worked for the University for 20 years, and frequently worked extra hours. The University owes her.

0-52

Question IXYou see a co-worker put some cash received for a

conference in his bag. Later you are reconciling the list of participants to the fund ledger and have a difference. What should you do?

0-53

Question X Abbie is responsible for depositing all checks with the

Cashier’s Office. It is late Friday afternoon and Abbie is leaving for a 10 day vacation in the Bahamas. Her last task for the day is to open the mail. In the mail, there is a $10,000 check for the upcoming conference and the Cashier’s Office is already closed. What should Abbie do?

A) Lock the check in her desk drawer and deposit it when she returns from vacation.

B) Take the check home with her so she is sure it is secure and deposit it when she returns from vacation.

C) Give the check to Wanda, her backup, so she can make sure it is secure and deposit it first thing Monday morning.

0-54

Question XIScott has a university procurement card. Scott is very careful to

keep all receipts for each purchase and makes sure no one has access to his card but him. Each month Scott agrees his receipts to his statement. He attaches the receipts to the statements and stores them in his desk in a file labeled “Procurement Card”. What control step is Scott missing?

A) Scott should verify that sales tax was not charged to the university.

B) Scott’s supervisor or a designated budget/business administrator should review and approve the statement with the receipts.

C) Scott should sign the statement as the cardholder.

D) All of the above

0-55

Question XII Ben is a professor. A conference relating to his

research is being held in Orlando, Florida in May. Ben talks to his Dean and receives verbal approval for the trip. The Administrative Assistant registers Ben for the conference and contacts Spartan Travel to make the airline and hotel reservations. Ben now feels he is all set for the trip. What step is Ben missing?

0-56

Question XIIIBen attended the conference and found it very useful.

He turns in the receipts for the hotel and meals, and also the airline tickets to the Administrative Assistant to process his travel voucher. What other document should Ben include?

0-57

Question XIVJennifer is the Business Manager for a large department on

campus. Her secretary has just accepted a position in another department. Jennifer knows the perfect replacement who has the type of experience needed, Suzie. Suzie is Jennifer’s younger sister. Suzie would report directly to Jennifer. Which statement best describes this situation?

A) Suzie is qualified then she should be hired for the position.

B) If Suzie is a direct report to Jennifer then it appears to be a conflict of interest. Someone could accuse Jennifer of providing higher raises or other benefits to Suzie because they are related.

C) Jennifer and Suzie would work great together since they are sisters.

0-58

Question XVThe Administrative Assistant for a large department is filing last

years fund ledger documents and other departmental documents. When she enters the storage room she finds it almost full. She reviews the dates on the boxes and finds many that are 10 years old. She decides she should throw those out but thought she should get approval first. Who should she contact to find out the record retention policy?

A) Internal Audit

B) Controller’s Office

C) University Archives

D) Both b and c

0-59

Summary• The Internal Audit mission is defined by our

charter.• Internal Controls are everyone’s

responsibility.• Policies and procedures should be followed.• Internal Audit constantly assesses risks.• Fraud should be reported.• Internal Audit is available for advice.

0-60

Audience Questions?• Comments may be directed to our website at- • www.msu.edu/~intaudit/comments.html• (submissions may be made anonymously, if

so desired)• Remember to tell your friends about the

Fraud Hotline at 1-800-763-0764 or www.msu.edu/unit/intaudit/hotline.html

0-61

Methods of Reporting Fraud• MSU Hotline – call center/web reporting• Direct contact with Internal Audit/DPPS/HR

Key links:

IA website: www.msu.edu/~intaudit

Fiscal misconduct guidelines:

http://www.ctlr.msu.edu/mbp/fiscaLmisconduct.html