Is your institution in control?

2. Is your institution in control? Internal Control, Standard Operating Procedures and the Policy Process T. Michael Ford, Special Assistant to the VP&CFO Kathleen McNeely, Associate Vice President Finance Indiana University

3. Overview of Auditing Changes • Sarbanes-Oxley • Does not apply to higher education • SAS 112 Communicating Internal Control Related Matters • Significant deficiency • Material weakness defined • Requires written communication to management and those charged with governance

4. Overview of Auditing Changes • Risk Assessment Standards (SAS 104-111) • Represents ongoing efforts to develop stronger and more definitive auditing standards • Goals of standards are to enhance auditor performance and improve audit effectiveness • Effective for audits of financial statements for periods beginning on or after Dec. 15, 2006 • Requires an evaluation of the design and implementation of controls (per COSO)

5. Overview of Auditing Changes

6. Indiana University • Policies can originate from a multitude of initiators • VP & CFO Financial Policies Committee • Two tracks: “Fast Track” and Normal • Policy Review • VP & CFO Final Review and Approval • Policies available on website

7. This is Policy • What is a policy? • States an institutional position • Describes mandates, community beliefs and boundaries • Should include why and who • What is a Procedure? • Tells us how • Often includes who, what, when and where • The customary or standard practice way of handling situations

8. This is Policy • Why Are Policies and Procedures Important? • Establish responsibilities and accountability • Help ensure compliance and reduce institutional risk

9. This is Policy • Provide clarification and guidance to the community • May be needed to establish and/or defend a legal basis for action • Provide consistency across units • How transactions are processed • How financial resources are expended

10. Well Written Policies: • Enhance understanding • Improve controls • Reduce risk • Increase efficiency & effectiveness • Help meet new demands for compliance

11. An Overview

12. The Association of College &University Policy Administrators Mission:The mission of the group is to explore both the "policy process" on college and university campuses as well as to discuss specific policy issues. The mission will be fulfilled through periodic meetings, special events, outreach activities, and electronic communications among the membership. Members:See the Members Directory on the ACUPA web site. http://process.umn.edu/acupa/

13. The Association of College &University Policy Administrators

14. Internal control discussions at Board of Trustee level Internal control assessment Policy review and change New policies implemented Sub-certification process developed Indiana University’sInternal Control Response

15. In 2002, Board of Trustees had discussions on value of internal control assessment – prior to Sarbanes-Oxley Board educated on Sarbanes-Oxley Findings on assessment presented to Board of Trustees Detailed discussions on SAS 112 Current discussions on Risk Assessment Standards Board Discussions

16. Internal Control Assessment Financial Systems & Operations Internal Audit Investment Accounting Payroll Plant Accounting Purchasing Student Loans Financial Reporting • Accounts Payable • Accounts Receivable • Auxiliary Accounting • Capital Asset Management • Cash Control • Construction Accounting • Debt Accounting • Endowment Accounting

17. Role of Fiscal Officer, Account Manager & Account Supervisor - revised December 2002 Internal Control, December 2004 The Board of Trustees and the President of Indiana University are committed to a solid structure of internal controls. The university considers internal controls to be crucial in providing reasonable assurance regarding the safeguarding of university assets and the achievement of operational, financial reporting and compliance objectives. The trustees, president, university and campus administrators, deans, department chairs, and directors are responsible for setting a tone of accountability, high ethical standards and business conduct expectations. Policy

18. Fiscal Misconduct, revised March 2005 Revision separated fiscal misconduct from fraud Fraud, March 2005 First time fraud language used in a policy Financial Sub-certification – July 2006 Took 18 months of due process before final policy completed and implemented Whistleblower Policy – April 2007 Underscores protection and encourages reporting Supports Indiana Code 20-12-1-8 Segregation of Payroll Duties Revised 2004 to include auditing and verification of payroll Policy

19. Internal Control Policy implemented in December 2004 Internal Control Workshops Sub-certification implemented FY 2007 Policy discussions were difficult Fiscal officers are afraid of added responsibility Deans feel this is a gotcha and that it is beyond their responsibility Some campus climates more accommodating than others Financial Sub-Certification

20. Policy requires unit leaders and fiscal officers to sign certification letter Certification letter has 10 certifications that originated from representation letter VPCFO makes to external auditors Certification letters go out each year in July and are required to be returned before September Board of Trustees is VERY supportive of this initiative Financial Sub-Certification

21. Indiana University:Successes and Benefits • Got senior executive buy-in and invited all appropriate departments to “the party” • Everyone knows how policy process works and where the “buck stops” in terms of policy development and issuance • Fostered positive interaction between university (central) administration and campus staff

22. Indiana University:Successes and Benefits • With website access, no longer any paper, postage or binder expenses – “paperless”! • Serves as model for other policy efforts in institution • Policies are taken very seriously because “everyone knows” where they are!

23. Indiana University:Successes and Benefits • Serve to ensure the accuracy of transactions and proper access and use of fund accounting policies by staff • Core accounting policies were previously developed (57 policies): • What is allowable/not allowable • What is reasonable or not • What is appropriate or not

24. Indiana University:Successes and Benefits There are currently 123 financial policies accessible to internal and external viewers at www.indiana.edu/~vpcfo/policies