Office of Student Affairs Service Center Implementation & Standardized Fiscal Processes

Office of Student Affairs

Service Center Implementation&

Standardized Fiscal Processes

Dan Allen, MBA, CFE, CISA

Student Affairs Controller and Director of Fiscal Support Services

PH: 688-3318

E-mail: [email protected]

Presenter:

Office of Student AffairsService Center & Standardized Fiscal Processes

Introduction

1-01

There have been MANY involved, directly or indirectly, with the analysis, planning, reviews, and participation in the various processes to streamline and strengthen our fiscal processes. We appreciate all of your assistance and your continued effort to make these implementations a success!

THANKS!!!


Introduction

• Student Affairs Leadership Group • Student Affairs Fiscal Council members• Student Affairs Buyers Council members• Student Affairs Human Resources members• Student Affairs Information Technology members• Student Affairs team members involved with designing, recommending, and presenting standardized fiscal processes and procedures• Everyone involved with the KPMG analysis and recommendations• University Controller’s Office• Internal Audit• Office of Human Resources• OSU Medical Center Controller’s Office• Business & Finance leadership• and many more . . .

1-02

Overview Objectives


Introduction

• Discuss why we are making changes to our fiscal support structure and fiscal processes. WHY

• Discuss how we created our service center model structure and how it is designed to operate. HOW

• Discuss our implementation actions for the service center model so that we are able to achieve the maximum benefits and to minimize negative impact on our staff and operations. WHAT

This is all a work in progress and your input is greatly appreciated!!

Please call me or e-mail me any thoughts you may have for structure and process improvements.

Dan Allen – 688-3318 or [email protected]

This overview is intended to provide the framework for our implementation of a new fiscal support structure (service center model) and our standardized fiscal processes. In this overview, we will . . .

1-03


Topics

WHY

Topic 1: Introduction

Topic 2: Strategic GoalsTopic 3: Background on Fiscal Structure and Fiscal Processes - KPMG Findings/Recommendations - Student Affairs Fiscal Process Workgroups - OSU Medical Center modelTopic 4: University Fiscal Structure and Process Analysis

Topic 5: Guiding Principles and Service Center Structure

Topic 6: Implementation ConceptsTopic 7: Internal Controls OverviewTopic 8: Risk Assessments and Control Activities OverviewTopic 9: Information Technology Support OverviewTopic 10: Monitoring and Communications Overview

Topic 11: Next Steps & Conclusion

HOW

WHAT

1-04

Strategic Goals


Topic 2: Strategic Goals

2-00

WHY

Topic Objectives

3-01

Office of Student AffairsService Center & Standardized Fiscal ProcessesBackground on Fiscal Structure and Processes

Discuss how fiscal structure and standardized fiscal processes relates to:

• The University’s Strategic Goals

• Our Student Affairs Strategic Goals

• Streamlining and Strengthening Core Processes is a key University focus

• Implementing Best Business Practices to meet Internal Control requirements, to Simplify Systems, and to Conserve Organizational Resources is a primary goal of Student Affairs

Strategic Goals:

To implement these two strategic goals requires • Fiscal organizational restructuring and • Standardization of fiscal processing


Strategic Goals

2-02


Strategic Goals

From President Gee’s Six Strategic Goals for the University

Simplify university systems and structures through an uncompromising focus on performance, transparency and accountability. The university must examine and modify its administrative practices, review its budget system, share resources and streamline services.

From report to the Board of Trustees Audit Committee (January 31, 2008)“Action Plan for Streamlining and Strengthening Core Processes” presented by Bill Shkurti

and Joe Alutto

Key to success is the implementation of the Service Center Concept. Objective is the implementation of Service Centers throughout the University within 18 months.

Student Affairs was recognized for our leadership in this initiative.

From VP of Student Affairs Goals for 2007-08

Best Business Practices: Organizational restructuring to meet internal control requirements, simplify systems, and conserve organizational resources.

2-03


Strategic Goals

To implement the Student Affairs strategic goals of

• Put Students First: Expand Learning Environments• Forge One University• Focus on Staff and Organizational Success• Community Engagement, and• Simplify Systems

Requires efficient fiscal support services (structure and processes) to

• Maximize resources to support all of our strategic goals.• Improve efficiency over time by

• Standardizing processes,• Eliminating duplicate processes and internal controls (bureaucracy),• Better aligning staff skills with functions,• Improving accuracy results in reduced re-work.

• Improve information for decision making, and• Improve operations by

• Improving transaction quality and service level, and • Reducing risks and increasing compliance.

2-04


Strategic Goals

What fiscal processes will be involved with the redesign of the fiscal structure and standardized fiscal processes?

2-05

A. Procurement/Payables Processes1. General Requisition/Purchase Order Process2. Blanket Purchase Order Process3. Petty Cash Process4. Procurement Card Process5. 100W Process6. Travel Requests and Travel Reimbursements7. Other Reimbursements, Refunds, and Non-PO Payments8. Accounts Payable (Student Affairs Satellite Accounts Payable)9. Accounts Payable (University Central Accounts Payable)

B. Accounting Processes1. Accounts Receivable (Initial Billing – Revenue Recognition)2. Accounts Receivable (Collection Process)3. Cash Receipts/Deposits4. Journal Entries

C. General Ledger Reconciliations

D. Payroll Processing (in the future)

Background on Fiscal Structure and Fiscal

Processes


Topic 3: Background on Fiscal Structure and Fiscal Processes

3-00

WHY

Topic Objectives


Background on Fiscal Structure and Fiscal Processes

3-01

• Discuss the historical background and changes to the fiscal support structure and processes

• Discuss the KPMG consultant’s findings and recommendations

• Discuss activities of our Student Affairs Fiscal Process Workgroups

• Discuss OSU Medical Center fiscal support structure

Background on Fiscal Structures and Fiscal Processes

CentralizedProcessing

(prior to 2000)

DecentralizedProcessing

(2000 to 2008)ServiceCenters (2008+)

1 23

Fiscal Processing Pendulum

3-02



Historical Background:

Fiscal support organizational structure and processes have been significantly affected by historical changes in the University’s operating environment.

• Prior to the PeopleSoft implementation in 1999/2000 (centralized): Departmental processing was done via paper and signature approvals. Large centralized University departments reviewed and approved paper

forms, and then entered data into a mainframe computer for processing. Departmental staff had no access to the computer. Separation of duties and appropriate transaction review outside the

department chain of command occurred as a natural growth of the process.

• Following the PeopleSoft implementation in 1999/2000 (decentralized): The opinion of the time was to decentralize to speed up processing. Many control features built into PeopleSoft had to be bypassed or

modified to achieve the decentralization desired. Individual departments greatly improved efficiency but significantly

decreased control.1 2



(prior to 2000)

1


3-03

Historical Background (continued):

• 2002-2004: Following Enron and other corporate scandals, the federal Sarbanes-

Oxley Act of 2002, and a major scandal at the University of Akron, State of Ohio Auditor, Betty Montgomery asked auditors to look closely at control policies.

The University’s Board of Trustees established an Audit Committee to review internal and external audit findings, and monitor the University’s response.

External audits identified shortcomings in the University’s decentralized organizational structure, leading to numerous recommendations about the need for compensating controls.

In an attempt to create standardized processes with built-in controls, the University responded in a process-by-process manner, with new policies on Pcards, cell phones, Internet connectivity, travel, purchasing, payroll, and others.

The University kicked-off a process requiring Deans and Vice Presidents to certify compliance with a set of 16 standard control points.


(prior to 2000)


(2000 to 2008)

1 2



3-04


• 2005-2008:

University accountability for controls, which in pre-PeopleSoft days rested heavily on centralized processing units, was delegated to the Dean/VP levels. All Dean, VP, and senior fiscal officer job descriptions were changed to include standard language about responsibility for assuring internal controls.

External audits have continued to include major findings about the lack of controls in the University’s decentralized operating environment. Many of these comments are repeated from previous years.

Student Affairs has been subject to an increasing number of internal audits. Since 2004, there have been 9 audits and 87 findings of control deficiencies, with 47 related to cash handling, 9 to reconciliations, 8 to expenditure policies, 5 to inventory control, 5 to Pcards, and 13 to miscellaneous items.

Student Affairs reviewed internal controls during 2005 and 2006, resulting in the completion of an assessment in 2006 identifying both strengths and weaknesses.


(prior to 2000)


(2000 to 2008)

1 2



3-05


• 2005-2008:

In December 2006, Student Affairs hired a consulting firm (KPMG) to provide further analysis and to provide recommendations for balancing internal controls with operational efficiencies.

In Spring 2007, the Audit Committee of the Board of Trustees hired PricewaterhouseCoopers for University-wide recommendations for improving internal controls and processing efficiencies. (discussed in Topic 4)


(prior to 2000)


(2000 to 2008)

1 2



3-06

Service CenterFiscal Processing

Concept

Student Affairs

Fiscal Processing Analysisand Direction


The following slides provide an overview of the fiscal processing analysis performed by Student Affairs, starting with the KPMG

analysis that began in December 2006.

3-07


KPMG Findings/Recommendations

KPMG Findings/Recommendations for Student Affairs – to balance internal controls with operational efficiencies:

KPMG Findings (Overview):

• Because of inconsistent fiscal processes, 72 different flowcharts were required to document 8 fiscal processes for 31 Student Affairs operations. No process was consistent among Student Affairs units.

• Over 400 Student Affairs full and part time staff are involved in the fiscal processes, resulting in approximately 118 staff time FTE (total annual staff time not number of staff) devoted to business and accounting processes. Given the 118 staff time FTE, the estimated cost of fiscal processing for Student Affairs is over $7.7M in annual salary, benefits, and other costs.

• “. . . the lack of standard processes and a compliance function to ensure the processes are followed and adequate controls are in place, hinders the ability of Student Affairs to meet the 16 control points.”


(prior to 2000)


(2000 to 2008)

1 2


3-08

KPMG Recommendations (Fiscal Organizational Structure):

The KPMG consulting report mirrors University external and Student Affairs internal audits, citing weaknesses in a decentralized structure creating an enhanced need for compensating controls. They recommended:

• Creating a “shared service” or “service center” model, which would change the reporting relationship of business staff currently assigned to operational units.

• KPMG’s recommendation is based on addressing the basic flaw with the decentralized structure. In a decentralized structure, the business manager (serving as the unit “controller”) reports to the director of the department. The director has the authority to overrule the business manager, creating risks that have to be mitigated.

• The “shared service” or “service center” model changes the accountability from multiple individual directors (as is now) to one VP-designated controller. The controller can use the supervisory authority provided in the organizational structure to assure that controls are implemented and sustained.




(prior to 2000)


(2000 to 2008)

1 2


3-09

KPMG Recommendations (Standardize Fiscal Processes):

KPMG determined that no one process was performed consistently across all Student Affairs units and 72 flowcharts were created to document the “as-is” processes.

KPMG pointed out the significant risks in the wide variability, and provided the following considerations:

1. The greater the differences in business processes, the higher the risks.

2. Higher risks leads to more controls.

3. The more controls that are used, the greater the opportunity for bureaucracy, inefficiency, and conflict.

4. Processes should be consistent across an organization.

5. Controls should be built into the processes.

6. Flexibility must be ensured to allow for effective operations in unique units.

7. Flexibility requires compensating controls (see #3). Therefore, exceptions to standard processes must be limited.




(prior to 2000)


(2000 to 2008)

1 2


3-10

KPMG identified that if ALL of the above recommendations are implemented, Student Affairs should • Achieve significant efficiency improvements in fiscal processing,• Achieve more streamlined and efficient processes and internal controls, and• Potentially return approximately $4M in annual benefits back to Student Affairs to be used for implementing our strategic initiatives.



KPMG Summary Recommendations:

KPMG identified that no one recommendation can stand alone and that Student Affairs should:

• Restructure fiscal organization to a more centralized structure

• Redesign and standardize the fiscal processes

• Maximize use of systems technologies

• Implement centralized controls monitoring processes, and

• Establish a centralized compliance and training group


(prior to 2000)


(2000 to 2008)

1 2


3-11


Fiscal Process Workgroups

Following the KPMG study . . .

Student Affairs Fiscal Process Workgroups (June-September 2007):

Student Affairs created four process workgroups (accounting, procurement,inventory, and payroll) to recommend

• Standardized fiscal processes, • Process-related internal controls, • Monitoring techniques, • Measurements (of success), • IT support requirements, and • Process fiscal support structure.

The workgroup members were identified by the AVPs to represent their operations.

The workgroups began by reviewing the KPMG-recommended processes and fiscal support structures and then provided their recommendations to a Student Affairs Steering Committee that was composed of the VP, AVPs, and central directors.

The recommended processes formed the foundation for our streamlined fiscal processes.


(prior to 2000)


(2000 to 2008)

1 2


3-12


Refined Fiscal Structure

Refined Fiscal Structure (July-December 2007):

In general, when addressing the process fiscal support structures, the workgroups recommended:

• Using a “hybrid” of the KPMG models (consensus was not achieved on fiscal structures).

• Continuing to process the transactions and approvals at the unit-level (as much as possible) for larger units.

• Shifting processing locations to Student Affairs central fiscal support services for smaller units that do not have adequate segregation of duties.

• Controls monitoring and fiscal process training should be provided by Student Affairs central fiscal support services.

Because consensus was not achieved, other fiscal models at OSU were researched. One fiscal structure that approximates the KPMG recommended models is the OSU Medical Center (OSUMC) model. The OSUMC service center model has been in successful operation for approximately 10 years.


(prior to 2000)


(2000 to 2008)

1 2


3-13



OSUMC Model Overview:

• A “hybrid” of the KPMG Shared Services/Service Center models.

• OSUMC has three centralized business support services: Finance, HR, and Purchasing. Each reports to a different administrator. The Finance group is also referred to as the Controller’s Office.

• Each of their eight business units has a Director and a Business Manager (referred to as the “CFO”). The Business Manager reports to the unit Director and has a dotted-line relationship to the Controller. In general, the Business Manager has unit-specific staff that perform analysis for labor, productivity, supplies, work directly with patients, draft budgets, and etc. as well as assist the Director in general business matters and decisions.

• Additionally, to provide accounting and other fiscal support, most of the eight hospital business units have three embedded (on-site) fiscal support staff members that report to the Controller and provide support to the hospital business units. The three embedded staff generally consist of a lead accountant, a senior accountant, and an accountant.

• The embedded staff assist the hospital business unit with all accounting activities, help coordinate payments with the hospital’s centralized Accounts Payable (part of the Controller’s Office), help coordinate purchases, help with inventory controls and management, cash handling, and additional financial reporting needs for the unit. These staff report directly to the OSUMC Controller’s Office and have a dotted line to the unit CFO/Business Manager.


(prior to 2000)


(2000 to 2008)

1 2


3-14



OSUMC Model Overview: OSUMC Central Administration

HR Finance Purchasing

Controller’s Office

• Accounting• Financial Reporting• Accounts Payable

BusinessUnit

Administrator

OpnsMgr

OpnsMgr

CFOBus. Mgr

UnitSupport

UnitSupport

UnitSupport

LeadAccountant

SeniorAccountant Accountant

OSUMC has 8 Business Units

EmbeddedFiscal Support

Embedded team reportsto the Controller’s Office(hard line relationship)

Embedded team workswith the Business Unit

(dotted line relationship)

Unit CFO works with the Controller’s

Office (dotted line relationship)

3-15



OSUMC Model Overview (continued):

• Segregation of duties is maintained by embedded accounting staff reviewing and entering transactions for the unit and reporting to the OSUMC Controller’s Office. The embedded accounting staff are expected to ensure compliance with policies/procedures and internal controls.

• Informal service level agreements exist between the Controller’s Office and the supported hospital units. The hospital units pay for the embedded fiscal support staff and participate in their performance reviews.

• The 26-member central Controller’s Office performs the accounts payable processing, higher-level accounting, controls monitoring, reconciliations, training, cost accounting, budget coordination, system support requirements, back-fills unit accounting staff, ensure pay equity for the unit accounting staff, and coordination with the University.

• The embedded accounting staff are highly focused on customer service (to hospital business units) and on identifying ways to improve the financial position of the hospital by analyzing costs, identifying potential new revenue sources, and providing net income enhancement ideas/recommendations to the unit CFO/Business Manager.

• The structure helps ensure fiscal process specialization, use of standardized fiscal processes, and implementation of effective and efficient internal controls.


(prior to 2000)


(2000 to 2008)

1 2


3-16

University Fiscal Structure and Process Analysis


Topic 4: University Fiscal Structure and Process Analysis

4-00

WHY

Topic Objectives

Office of Student AffairsService Center & Standardized Fiscal ProcessesUniversity Fiscal Structure and Process Analysis

4-01

• Discuss PricewaterhouseCoopers consultant’s findings and recommendations to the Audit Committee of the Board of Trustees)

• Discuss benefits of Service Center concept (as presented to the Audit Committee)

• Discuss timeline for the University’s implementation of the Service Center concept

University


ConceptFiscal Processing Analysis

and Direction

The following slides provide an overview of University-related fiscal processing analysis performed by PricewaterhouseCoopers for the Audit Committee of the Board of Trustees,

starting in Spring, 2007.

The PricewaterhouseCoopers analysis was augmented by other external reviews, such as from the external audit findings and recommendations.

4-02


In a report to the Audit Committee of the University’s Board of Trustees (BOT) for the January 31st, 2008 meeting, recommendations/findings from external reviews, identified the need to focus on:

• Higher degree of standardization and consistency• Formalized policies and procedures• Assessment and documentation of key controls• Improved training• Increased central monitoring and oversight with defined linkage to the

Enterprise Risk Management Program

The report identified the following:The “key to success” was the implementation of the “Service Center Concept”

The Service Center Concept is a business structure in which selected support functions such as fiscal and human resources processing are directed to a consolidated unit staffed by highly trained, skilled experts who specialize in those functions/processes.

The objective of the Service Center Concept is to create a structure that provides effective and efficient core business services by allowing employees and organizations to focus on what they do best.


(prior to 2000)


(2000 to 2008)

1 2


4-03


Improved Operations:• Eliminate non value-added processes• Narrow scope of support staff roles and responsibilities• Improve transaction quality and service level• Reduce risk and increased compliance

Improved Information:• Greater standardization of processes• Improved data quality for analysis• Greater flexibility and capacity for change• Improved capability for monitoring and oversight

Improved Efficiency Over Time:• Eliminate duplicate processes within organizations• Eliminate redundant staffing• Better align staff skills with functions• Better alignment of transactions and processing methods• Improved accuracy results in reduced re-work

Benefits of Service Center Concept (from the report to the Audit Committee):


(prior to 2000)


(2000 to 2008)

1 2


4-04


Current State Future State

Service Center Concept (from the report to the Audit Committee):

College/VP 1

College/VP 2

Dept D

Dept E

Dept F

College VP 3

Dept G

Dept H

Dept I

Dept J

Dept K

Central Purchasing

Dept A

Dept B

Dept C

College/VP 1

College/VP 2

Dept D

Dept E

Dept F

College/VP 3

Dept G

Dept H

Dept I

Dept J

Dept K

Central Purchasing

Service Center

Service Center

Service Center

Dept A

Dept B

Dept C


(prior to 2000)


(2000 to 2008)

1 2


4-05


Service Center Concept (from the report to the Audit Committee):

Incentives and rewards are being considered by the University for Units with proven track records andcentralized operations (service centers).

• Bill Shkurti and Joe Alutto will provide leadership with implementing service centers for their operations (Business & Finance and Office of Academic Affairs).• Office of Student Affairs was recognized for our leadership in analysis and moving toward service center model/concept. • Goal for the University is to have Service Centers in place within 18 months (by June 2009).


(prior to 2000)


(2000 to 2008)ServiceCenters(2008+)

1 23


4-06


University


Concept

Student Affairs

Fiscal Processing Analysisand Direction

Student Affairs and the University arrived at the same conclusions at essentially the same time, but followed different paths.

4-07


Guiding Principles and Service Center Structure


Topic 5: Guiding Principles and Service Center Structure

5-00

HOW

Topic Objectives

Office of Student AffairsService Center & Standardized Fiscal ProcessesGuiding Principles and Service Center Structure

5-01

• Discuss guiding principles used for designing the service center concept for Student Affairs

• Discuss the Unit’s fiscal support structure and responsibilities

• Discuss the embedded Student Affairs fiscal support services (SAFSS) structure and responsibilities

• Discuss the Student Affairs central fiscal support services structure and responsibilities

• Discuss considerations for determining the staffing requirements for the embedded SAFSS teams

• Discuss other important benefits of the service center implementation

How did Student Affairs develop its Service Center model?

By considering various findings, recommendations, and lessons learned, such as by:

• Considering external recommendations and best practices (KPMG, external audit, and PricewaterhouseCoopers)• Researching best practices within OSU (OSUMC model) • Considering recommendations from the Student Affairs workgroups• Considering audit findings and recommendations from Internal Audit

From these lessons learned, Guiding Principles emerged to form the basis for the Service Center model.

There are NO standard “Service Center” models. Each service center must be tailored to the unique circumstances for the University operation. Centralized

Processing(prior to 2000)



1 23


5-02


From lessons learned, the following are the guiding principles for the Student Affairs service center model and for standardized fiscal processes:

• The Office of Student Affairs will comply with University policies, procedures, and laws. Compliance is everyone’s responsibility.

• Fiscal processes will be standardized across the operations to maximize efficiencies, to balance internal controls and cost, to provide flexibility for implementing policy and procedure changes, and to facilitate business continuity initiatives.

• Fiscal processing costs, including staffing, IT support, training, and etc. are paid (directly or indirectly) by the operations for which the fiscal activities are provided.

• Fiscal processing centers (service centers) with embedded fiscal support services staff will be “pushed” forward to larger operations that have higher transaction volumes and needs.

• Segregation of duties is maintained with at least two people involved in every transaction.

• Financial data is independently reconciled in a timely manner.


(prior to 2000)



1 23


5-03


Principles (continued)

• Unit management will supervise their own unit fiscal staff and will review and approve all transactions for appropriateness.

• Transactions will be independently reviewed for policies and procedures compliance by knowledgeable fiscal support services staff.

• All financial transactions will be entered into PeopleSoft by trained and authorized fiscal support services staff. This helps ensure segregation of duties, authorization, compliance, accuracy, and efficiency. Unit staff will have inquiry/report access into PeopleSoft as needed.

• Approvers at all levels are held accountable for transactions approved.

• Unit and fiscal support services staff performing fiscal activities are appropriately trained.

• Controls will be centrally monitored and reported to senior management.

• Internal controls will be linked to the Enterprise Risk Management Program.

• Use of technology will be maximized for processing efficiencies, financial reporting, and controls monitoring.


(prior to 2000)



1 23


5-04


Units make own business decisions and manage resources.

Units are able to better focus on their primary mission; doing what they do best.

Once transactions are approved for appropriateness by Unit management, fiscal processing support is provided by Student Affairs fiscal support services operations that are focused on customer services and that specialize in

providing consistent, timely, and accurate fiscal processing, compliance with and monitoring internal controls, providing accurate fiscal reports, and seeking and recommending ways to best use fiscal resources through cost accounting and other data/information means.

As indicated by KPMG, the potential exists for the return of several million dollars in annual benefits back to Student affairs to be used for implementing our strategic initiatives. To achieve these benefits, requires that the service center be fully implemented with standardized fiscal processes, appropriate IT support, appropriate staffing and training, and centralized controls monitoring.


(prior to 2000)



1 23


The service center model that emerged provides the following advantages associated with simplifying systems and processes, improved efficiencies, and best business practices:

5-05


At the November 2007 Student Affairs Fiscal Council meeting, Bill Schwartz provided and discussed the below overview of the Student Affairs fiscal service center structure.

AVP

Director

Unit Business Manager/OfficeBusiness PlanningOperations/customer serviceRates, marketingReports to directorApprovals for appropriateness

“Embedded” Accounting/business staffAccounting/reconciliationsPeopleSoft processingTimekeeping/payrollReports dotted line to business manager, solid line to SABOProvides reports and information to support decision-makingApprovals for compliance

Student Affairs Business OfficeSupervise and train embedded staffEstablish SA-wide proceduresLiaison with University centralized officesMonitor complianceReviews exceptionsPayroll processingApproves high dollar transactions

Departmental Structure CentralizedProcessing

(prior to 2000)



1 23


It is assumed that for small units, the director performs the business manager functions.

5-06


The following slides provide an overview/build of the Student Affairs service center model being implemented for the Student Affairs Housing operations.

This first implementation will serve as the “pilot.” From this pilot, and from other future implementations, we will continuously refine the structure and processes.

Our intent is to create embedded fiscal support services teams for our larger units or to support several smaller operations. Units that do not have an embedded team providing direct fiscal support services will use the larger Student Affairs central fiscal support services operation for their fiscal support.

(Support staff and embedded SAFSS staff structure depends on transaction volume, and overall needs of the operation)


(prior to 2000)



1 23


5-07


Director

CFO(Bus Mgr)

(Support staff and structure depends on transaction volume, and overall needs of the operation)

Unit

SupportStaff

The Student Affairs department (unit) business manager will report to the unit director. The business manager will supervise several unit support staff to assist with the unit-specific fiscal processes and customer service. (The number of unit support staff will depend on the transaction volume and etc.)

Unit CFO/Business Manager:• Oversees fiscal-related customer service and systems support for the unit• Oversees and communicates fiscal status and direction and HR activities of the unit• Hires and manages unit fiscal staff and works directly with embedded fiscal support staff• Performs financial analysis for decision making and capital plans• Approves transactions (front-end) for appropriateness and provides approved transactions to embedded fiscal support staff for further review and entry into PeopleSoft• Maintains unit benchmark information• Recommends budgets, fees, and rates

Unit Support Staff:• Provides fiscal related customer service • Provides fiscal-related assistance for unit staff for travel coordination and reimbursements, purchases, and etc.• Assists business manager by compiling needed information for fiscal decision approvals• Performs independent cash handling and balancing activities and preparation/logging of cash deposits• Manages and independently reconciles (daily) unit change funds• Assists in other fiscal and HR-related activities to support business manager, customers, and unit staff

5-08


Director

CFO(Bus Mgr)

Acct.Clerk

Unit

Embedded SAFSS

ProcSpecAcct

Acct Supv

SupportStaff


The embedded Student Affairs Fiscal Support Services (SAFSS) team will generally consist of four members and will provide primary fiscal processing (in PeopleSoft) support for the unit.

Accounting Supervisor:• Oversees the hiring and management of the embedded SAFSS team• Works closely with the business manager in all fiscal support matters• Is responsible to ensure effective and timely customer service and support and timely general ledger reconciliations are performed by the entire SAFSS team• Reviews and approves transactions• Assists with financial analysis/reporting and fluctuation analysis• Reports (hard line) to the Assoc. Director of Accounting and works with the unit business manager (dotted line)Accountant:• Researches and creates journal entries into the PeopleSoft system for the unit• Provides cost accounting activities/analysis for the unit to identify potential cost savings and new revenue initiatives

Procurement Specialist:• Reviews and assists unit with buying activities (using PeopleSoft) after receiving approved information from the business manager• Serves as the PCard reallocator for unit and enters approved travel requests

Account Clerk:• Verifies and enters cash deposits into PeopleSoft• Performs reconciliations

5-09


The embedded SAFSS (accounting supervisor) will report to the Student Affairs Central Fiscal Support Service’s Associate Director of Accounting.

Director

CFO(Bus Mgr)

Acct.Clerk

Controller/Director

Unit

Accounting &Budgeting

Assoc. Dir.Accounting

Embedded SAFSS

ProcSpecAcct

Acct Supv

SupportStaff


Assoc. Director of Accounting:• Oversees the embedded SAFSS team and associated processing and controls• Works closely with the unit business manager on fiscal matters and for performance reviews of embedded staff• Ensures appropriate levels of customer service to the unit• Hires and trains accounting supervisor• Works closely with the Student Affairs Assoc. Director of Procurement to ensure appropriate higher-level support for the procurement specialist

Student Affairs Central Fiscal Support Services

5-10


The below diagram provides an overview of the Student Affairs fiscal support (service center) structure. The number and location of the embedded teams will continue to be assessed.

Director

CFO(Bus Mgr)

Acct.Clerk

Controller/Director

Unit

Accounting &Budgeting

Assoc. Dir.Accounting

Stu AffsCFO

Embedded SAFSS

ProcSpecAcct

Acct Supv

UnivCFO

ProcurementSupport

Assoc. Dir.Procurement

ProcSpec A/P Spec

VoucherReviewer

Compliance &Reconciliations

SeniorAuditor

Reconciler

ProcurementAssistant

PayrollProcessing

Sr.Acct

Sr.Acct

SupportStaff

Student Affairs Central Fiscal Support Services

(Support staff and structure depends on transaction volume, and overall needs of the operation) 5-11


How did we determine the staffing requirements for the embedded teams?

• We reviewed the number of transactions by type that were performed by the supported operation over a three year period.

• We then used the base recommended fiscal processes that were provided by the fiscal process workgroups and estimated an average number of minutes that it takes to perform the various actions.

• From this combined information, we were able to estimate the number of staff required to perform the various support activities.

• We compared our staff estimates to the best business practice estimates that were provided by KPMG, along with their staffing estimates to determine if the FTE appeared reasonable.

• As we move forward, we will continuously review our staffing levels and workloads; especially as we are able to continue our processes of maximizing the efficiencies for each processes.

• It is important to recognize that every embedded operation may be staffed differently, based on the unique needs of the operation they are supporting.


(prior to 2000)



1 23


5-12


Other benefits that will be achieved include . . . for the first time . . . .

• Student Affairs will have career paths for our fiscal staff. For example, an accounting professional should be able to start in the embedded accountant position, move to a senior accountant position, then to one of the accounting supervisor positions, followed by either a business manager or the Assoc. Director position, then to Controller. Career paths will also be established for the other fiscal support services and unit support positions.

• The embedded operations will be located on site at their supported operation. This off-site operation (to central fiscal support services) provides an automatic backup facility for Student Affairs fiscal business continuity planning.

• The embedded operations will be augmented by the Student Affairs Central Fiscal Support Services as needed. Priorities for processing will be established and if an embedded operation needs additional support to provide timely customer services, they can rely on the central fiscal support services to assist. Additionally, the other embedded teams can assist as appropriate.

• Effective and consistent personnel evaluations can be performed, including input from their supported operations. Evaluations will be tied to pay and over the long-term, we will be able to ensure equity in pay for our fiscal support services staff members.


(prior to 2000)



1 23


5-13



• Student Affairs will have the built-in (structural) flexibility to “change direction” as needed. For example, if the University or Student Affairs changes its fiscal processes, the majority of the change/impact should be absorbed by the service center, with minimum impact on the units.

• Student Affairs will be able to efficiently and accurately monitor that controls are working as intended.

• Student Affairs should be able to report “Green” on all of the University-specified financial-related internal controls, including general ledger reconciliations.

• Some of the fiscal-related work-load can be shifted from the units and placed onto the fiscal support services staff. This should help units better focus on accomplishing their mission and doing what they do best.

• By standardizing the processes, more cost effective and more meaningful training can be developed and provided.

• We can focus on “net income enhancements” by the embedded staff actively searching for ways to improve revenues and reduce costs.


(prior to 2000)



1 23


5-14



• We can better assist units with purchase planning by focusing on historical trends and can better share purchasing and minority business/edge “success stories.”

• We will be able to improve consistency and accuracy in the use of general ledger accounts and purchasing categories. The improved consistencies will improve the accuracy of our management and financial reporting.

• Student Affairs staff will have a “help desk” number to contact for financial processing questions/issues and follow-up. The help desk information will be used to continue to improve overall processes and training.

• By having standardized processes and structures, we will be able to develop and implement standardized tools that can be used throughout Student Affairs for such things as improved reporting, fiscal analysis, reconciliations, and controls monitoring.

• We will have consistent positions, job descriptions, and performance expectations for the fiscal support staff members.


(prior to 2000)



1 23


5-15


Commitment to professional services . . .

One of the benefits of the service center concept as outlined by the University to the Audit Committee included “selected support functions such as fiscal and human resources processing are directed to a consolidated unit staffed by highly trained, skilled experts who specialize in those functions/processes.”

To provide the best possible (professional) services, will require• Teamwork at all levels of the operations.• Effective and open communications.• Agreements with supported units on processing standards or “success criteria.” Metrics will be identified,

maintained, and periodically reported to the supported units and Student Affairs management on achievement of those expectations.

• Standardized fiscal processes and exception processing/procedures.• Training for unit and fiscal support services staff.• Effective use of technology to maximize efficiencies and to record and monitor our success criteria and controls.• Adequate staffing and appropriate expertise at the unit and within the fiscal support services operations.• A culture of continuous improvement throughout the operations.


(prior to 2000)



1 23


5-16


Implementation Concepts


Topic 6: Implementation Concepts

6-00

WHAT

Topic Objectives



6-01

• Discuss the requirements (roadmap) to successfully implement the service center concept

Now that we know that we will be implementing the Service Center model . . .

How do we go about implementing the service center model successfully and achieve maximum benefits and minimize negative impact on our staff and operations?



6-02

Answer:

How do we successfully implement the service center model and achieve maximum benefits and minimize negative impact on our staff and operations?

There is no one answer.

What we do know is that successfully implementing the service center model will require hard work, along with

• appropriate staffing and skilled staff,• teamwork by everyone (including communications),• appropriate facilities,• effective IT support and tools,• efficient policies and procedures, and• committing to continuous improvement.



6-03

Successful Implementation of the Service Center

Concept Requires


Concept

Skilled Staff/Teamwork & Facilities

Effective IT Support & Tools

EfficientPolicies &

Procedures

Cultureof ContinuousImprovement



6-04

What do we need to begin?

Let’s go back and look at the KPMG recommendations.

• Restructure our fiscal organization (move to service center)

• Redesign and standardize the fiscal processes,

• Maximize use of systems technologies,

• Implement centralized controls monitoring processes, and

• Establish a centralized compliance and training group.

KPMG identified that Student Affairs should • Achieve significant efficiency improvements in fiscal processing,• Achieve more streamlined and efficient processes and internal controls, and• Potentially return millions of dollars in annual benefits back to Student Affairs to be used for implementing our strategic initiatives, if we . . .

KPMG stressed that none of these recommendations can “stand alone” and all are interrelated.


Concept Requires


Concept



EfficientPolicies &

Procedures




6-05

• Understand Internal Controls• Perform Risk Assessments for the fiscal-related processes and non-fiscal risks

Procurement/Payables Accounting & Cash Deposits General Non-Fiscal Process Risks

• Identify the preliminary control activities associated with the above fiscal-related processes, including University-specified controls Training/Skills requirements

• Identify information technology support needs or objectives• Identify controls monitoring and communications objectives

• Refine and document the fiscal processes, using the recommended processes from the Student Affairs workgroups as the base

• Ensure appropriate staffing, training and facilities• Continuously monitor and refine the processes, procedures, and structures


Concept Requires


Concept



EfficientPolicies &

Procedures



Implementation Roadmap

6-06

RoadmapWhat do we need to begin?

Before we can begin redesigning and standardizing our fiscalprocesses, as well as design controls monitoring and complianceprocesses, it may be helpful to begin with an overviewunderstanding of Internal Controls.


Concept Requires


Concept



EfficientPolicies &

Procedures


As we design our processes, it is important to keep processing efficiency at the forefront.

Too many controls or controls that are not appropriately designed and executed can significantly slow our fiscal processes; resulting in wasted time, unnecessary costs, unnecessary bureaucracy, items not available when needed, and a tendency to “by-pass” the controls.

Internal controls are generally a means for reducing or mitigating risks.

Our goal in designing processes should be to implement controls that are required by the University and other agencies, and to balance risks with the cost of any additional controls.



6-07

What do we need to begin?

Internal Controls Overview


Topic 7: Internal Controls Overview

7-00

WHAT

Topic Objectives



7-01

• Discuss how controls (internal controls) are a part of the “management process”

• Discuss the purpose of internal controls

• Discuss the 5 interrelated components of internal controls

• Discuss the relationship between risks, costs and controls

• Discuss the University-required internal controls and sub-certification

• Discuss other important University-related internal controls

Many people equate controls with accountants and auditors, however, controls are part of the day-to-day management process. Internal control simply refers to the controlling activities that are performed within an organization.

“Management process is a process of planning and controlling the performance or execution of any type of activity. . . . Organization’s top management is responsible for carrying out its management process.”

Management Process (from Wikipedia)



7-02

Key Management Process

Source: “Understanding Internal Controls, A Reference Guide for Managing University Business Practices”, by University of California.


Purpose of Internal Controls

7-03

Purpose of Internal Controls:

• Keeps an organization on course toward its objectives and the achievement of its mission, and minimizes surprises along the way.

• Promotes effectiveness and efficiency of operations, reduces the risk of asset loss, and helps to ensure compliance with laws and regulations.

• Ensures the reliability of financial reporting (i.e., all transactions are recorded and that all recorded transactions are real, properly valued, recorded on a timely basis, properly classified, and correctly summarized and posted.)

• Helps protect our students, our staff, our management, and the public.

• Safety• Integrity• Reputation

Internal control consists of five interrelated components which all five must be present to conclude that internal control is effective.

The components include:

1. Control (or Operating) environment

2. Risk assessment

3. Control activities

4. Monitoring, and

5. Information and communication




7-04

Five Interrelated Components of Internal Controls:


An effective control system provides reasonable, but not absolute assurance for the safeguarding of assets, the reliability of financial information, and the compliance with laws and regulations.

Reasonable assurance is a concept that acknowledges that control systems should be developed and implemented to provide management with the appropriate balance between risk of a certain business practice and the level of control required to ensure business objectives are met.

The cost of a control should not exceed the benefit to be derived from it.



7-05

Relationship between Risks, Costs and Controls:

1. Control Environment – the control consciousness of an organization. The control environment is greatly influenced by the extent to which individuals recognize that they will be held accountable.


Implementation of the Student Affairs Service Center model is an excellent example of a control conscious organization. With the service center model,

• segregation of duties is effectively maintained through its organizational structure,

• every transaction is reviewed and approved for both appropriateness (unit) and compliance (SAFSS) by people who know the rules, who understand the business and who have the authority to say “No,”

• procedures are standardized and documented,

• an independent operation is responsible for performing internal controls compliance monitoring and reporting to management, and

• all employees are responsible for internal controls.



7-06

2. Risk Assessment – the identification and analysis of risks associated with the achievement of operations, financial reporting, and compliance goals and objectives. This, in turn, forms a basis for determining how those risks should be managed.


Risk is the probability that an event or action will adversely affect the organization.

To achieve goals and objectives, management needs to effectively balance risks and controls. Therefore, control procedures need to be developed so that they decrease risk to a level where management can accept the exposure to that risk.

By performing this balancing act “reasonable assurance” can be attained.

Excessive Risks Excessive Controls

Loss of Assets, Donor, or Grants Increased BureaucracyPoor Business Decisions Reduced ProductivityNoncompliance Increased ComplexityIncreased Regulations Increased Cycle TimePublic Scandals Increase of No-Value Activities

To achieve a balance between risk and controls, internal controls should be proactive, value-added, cost-effective and address exposure to risk.



7-07

2. Risk Assessment (continued)


Risk Analysis

After risks have been identified, a risk analysis should be performed to prioritize those risks:

• Assess the likelihood (or frequency) of the risk occurring• Estimate the potential impact if the risk were to occur; consider both quantitative and qualitative costs **• Determine how the risk should be managed; decide what actions are necessary.



7-08

** Examples of: Quantitative costs include the cost of property, equipment, or inventory, cash dollar loss, damage and repair costs, cost of defending a lawsuit, etc.

Qualitative costs can have wide-ranging implications to the University. These costs may include loss of public trust, loss of future grants, gifts and donations, injury to the University’s reputation, increased litigation, violation of laws, etc.

3. Control Activities – the actions, supported by policies and procedures that, when carried out properly and in a timely manner, manage or reduce risks.

Controls can be classified as preventive, detective, or corrective controls.

• Preventive controls (P) - attempt to deter or prevent undesirable events from occurring. They are proactive controls that help prevent a loss.• Detective controls (D) - attempt to detect undesirable acts.• Corrective controls (C) - are procedures that fix an error or control situation

Control activities generally include • approvals, authorizations, and verifications• reconciliations, • reviews of performance, • security of assets, • segregation of duties, • training, and • controls over information systems.




7-09

4. Monitoring – the assessment of internal control performance over time; it is accomplished by ongoing monitoring activities and by separate evaluations of internal control such as self-assessments, peer reviews, and internal audits.


The purpose of monitoring is to determine whether internal control is adequately designed, properly executed, and effective.

Internal control is effective if management and interested stakeholders have reasonable assurance that:

• They understand the extent to which operations objectives are being achieved.• Published financial statements are being prepared reliably.• Applicable laws and regulations are being compiled.

While internal control is a process, its effectiveness is an assessment of the condition of the process at one or more points in time.



7-10

5. Information and Communication – information about an organization’s plans, control environment, risks, control activities, and performance must be communicated up, down, and across an organization.


When assessing internal control, the key questions to ask about information and communication include:

• Does the department get the information it needs from internal and external sources – in a form and timeframe that is useful?

• Does the department get information that alerts it to internal or external risks (e.g., legislative, regulatory, and developments)?

• Does the department get information that measures its performance - information that tells the department whether it is achieving its operations, financial reporting, and compliance objectives?



7-11

What are the primary internal controls that the University has specified as being required?



7-12

In an effort to assess and improve the University’s internal controls, beginning in FY2006, the University requested operations to annually assess whether sufficient internal control structures are in place to effectively identify weaknesses in financial processes and systems, and to sub-certify compliance on 16 key internal controls.

The controls status is based on the following criteria:

• Green – generally complies with policies and control activities• Yellow – partially complies with policies and control activities; opportunities for improvement exist• Red – routinely does not comply with policies and control activities; improvement is needed.

Areas assessed as “yellow” or “red” require action plans to resolve the control gaps.

By being required to be assessed annually, these internal controls should be assumed to be required University controls.



7-13

1. Require staff with fiscal responsibilities to attend system training offered by OIT and financial training offered by the Controller’s Office?

2. Follow personnel and payroll policies set forth by the Office of Human Resources?

3. Have an effective control structure that includes monitoring activities, to ensure compliance with University policies regarding use of Procurement Cards?

4. Have processes and monitoring activities in place to ensure compliance with the guidelines on alcohol, meals, entertainment, recruiting, cellular phones, employee recognition events, professional dues and subscriptions, and payment for services set forth in the University Expenditure Policies?

5. Have processes and monitoring activities in place to ensure compliance with University Travel Policies?

Does the College/Office . . .



7-14


6. Coordinate all gift and fundraising activities with the Office of University Development?

7. Process all sponsored research proposals and agreements through the OSU Research Foundation?

8. Submit proposed rates and earnings budgets to Resource Planning for all operations that sell goods or services?

9. Maintain supporting documentation for its financial transactions, in accordance with retention guidelines set forth by University Archives?

10. Perform monthly reconciliations of transactions appearing in its general ledger reports (e.g. payroll, purchasing, travel, etc.) to internal source documents?

11. Have an established process for reporting financial errors, problems, etc. to senior administrators within the college?



7-15


12. Reconcile all non-cash assets and liabilities to supporting detail on a monthly basis?

13. Have processes and monitoring activities in place to ensure compliance with fund restrictions imposed by donors, granting agencies and other resource providers?

14. Have processes and monitoring activities in place to ensure compliance with University Treasurer policies on cash handling (including separation of duties, timely preparation of deposits, rules on petty cash/change funds, management review of deposit corrections, and reporting of cash shortages to Internal Audit and OSU Police)?

15. Require faculty and staff with fiscal responsibilities to understand and observe the Ohio Ethics Law?

16. Have processing and monitoring activities in place to ensure effective custody over non-cash assets, including maintenance of accurate equipment inventory records, measures to prevent loss/theft of items, and compliance with University surplus/disposal policies?



7-16

The following are other important University-related internal controls or requirements

• Emergency Management and Business Continuity Plans.

• PeopleSoft access security, limiting access and functionality.

• Conflict of Interest disclosures completed annually.

• University error/violation reporting procedures and anonymous reporting line.

• Dollar limits for transactions, such as for purchases and authorizations.

• Requirement for budgets and frequent comparisons of “budget to actuals.”

• Requirement of submission of fees and rates, and approval by BOT.

• Payroll certifications.



7-17

Other important University-related internal controls (continued):

• Requirement to “tag” all items purchased over a dollar threshold.

• Maintain listings of “delegation of authorities.”

• Requirements for background checks for staff (based on responsibilities).

• Multiple ways to perform purchasing, reducing risk of not being able to purchase items that are needed.

• Independent controls monitoring and reporting by the Department of Internal Audit.

• Independent controls monitoring and reporting by external auditors (for the State).

(just to name a few . . . )



7-18


Summary – Management Process:Effective internal control is a built-in part of the management process of planning and controlling.

Summary – Purpose of Internal Controls:

• Keeps an organization on course toward its objectives and the achievement of its mission, and minimizes surprises along the way.

• Promotes effectiveness and efficiency of operations, reduces the risk of asset loss, and helps to ensure compliance with laws and regulations.

• Ensures the reliability of financial reporting (i.e., all transactions are recorded and that all recorded transactions are real, properly valued, recorded on a timely basis, properly classified, and correctly summarized and posted.)

• Helps protect our students, our staff, our management, and the public.

• Safety• Integrity• Reputation



7-19

Internal control consists of five interrelated components which all five must be present to conclude that internal control is effective. The components include:

1. Control (or Operating) environment

2. Risk assessment

3. Control activities

4. Monitoring, and

5. Information and communication


Summary – 5 Components of Internal Controls:



7-20

Understand Internal Controls• Perform Risk Assessments for the fiscal-related processes and non-fiscal risks


• Identify the preliminary control activities associated with the above fiscal-related processes, including University-specified controls Training/Skills requirements





Concept Requires


Concept



EfficientPolicies &

Procedures




7-21


Risk Assessments and Control Activities Overview


Topic 8: Risk Assessments and Control Activities Overview

8-00

WHAT

Topic Objectives

8-01


Risk Assessments and Controls Activities Overview

• Discuss fiscal related risk assessments performed for the service center and fiscal processes

• Discuss control activities to mitigate the identified and prioritized risks

• Discuss training topics/skills requirements and audiences for service center and fiscal processes

As identified in the Internal Controls Overview, after establishing the Control Environment (Service Center Concept), we should focus on identifying our risks.

The risk assessments presented on the next pages are one of many methods that may be used to identify and prioritize risks. No method is perfect and all methods require some level of judgment. However, the end product of the risk assessment matrix is a reasonable prioritization of each identified risk.

The risks are intended to identify “what can go wrong.” They were derived in September 2006 by a sub-group of the Student Affairs Fiscal Council and combined with emergency management-related risks provided by the University’s Director of Emergency Management.

Once risks are identified, they were prioritized by combining probabilities, threat factors, and impact considerations.



8-02

Procurement and Accounts Payable Processes Risk Assessment(P)

Objective Threat Probability Speed of Threat Factor Human Property Business Total Impact (P x TF x I)# Risk Type Type (1 - 3) Onset Forewarning Duration Total Score Impact Impact Impact Score Total1 Goods/Services Not Available When Needed O, F Mission 2 2 2 1 5 3 3 2 8 802 EDI Processing Errors O, C, F Mission 3 2 2 1 5 0 1 2 3 453 Theft/Vandalism O, C, F Human 2 2 2 0 4 0 3 1 4 324 Violation of Laws O, C, F Mission 2 1 2 2 5 0 0 3 3 305 Loss of Public Trust O, F Mission 2 1 2 2 5 0 0 3 3 306 Injury to University's Reputation O, F Mission 2 1 2 2 5 0 0 3 3 307 Increased Litigation O, C, F Mission 2 1 2 2 5 0 0 3 3 308 Inaccurate Accounting O, C, F Mission 2 1 2 2 5 0 1 2 3 309 Inaccurate Reports to Management O, C, F Mission 2 1 2 2 5 0 1 2 3 3010 Loss of Key Employees O, C, F Human 3 1 1 2 4 0 0 2 2 2411 Fraud O, C, F Human 2 2 2 0 4 1 1 1 3 2412 Vendors Not Paid in a Timely Manner O, C, F Mission 2 2 2 2 6 0 0 2 2 2413 Non-Compliance with Policies/Procedures O, C, F Mission 2 2 2 1 5 0 1 1 2 2014 Inappropriate Vendor Payments O, C, F Mission 2 2 2 1 5 0 1 1 2 2015 Inaccurate/Inappropriate Budgets C, F Mission 2 0 1 2 3 0 1 2 3 1816 Loss of Future Grants, Gifts, and Donations O, C, F Mission 1 1 1 2 4 0 1 2 3 1217 Decreased Enrollment (due to programs/facilities) O, C, F Mission 1 1 1 2 4 0 1 2 3 1218 Unidentified Internal Control Weaknesses C, F Mission 1 1 1 2 4 0 1 2 3 1219 Exceed Budget Expenditures (unapproved) O, C, F Mission 2 1 0 1 2 0 1 1 2 8

Objective Type: O=Operations, C=Compliance, F=FinancialProbability: 1=Low, 2=Medium, 3=HighSpeed of Onset: 0=Slow, 1=Medium, 2=FastForewarning: 0=Warning, 1=Some Warning, 2=No WarningDuration: 0=Short (less than 1 day), 1=Medium (1-3 days), 2=Long (greater than 3 days)Human Impact: The possibility of death or injuryProperty Impact: Consider the cost to replace, set up temporary replacement, repair, loss of cash or other assets, etc.Business Impact: consider business interruption, employees unable to report to work, customers unable to reach facility, contractual agreements, fines and legal costs, etc.

(TF) Threat Factor (0 - 2) (I) Impact (0 - 3)



Procurement and Accounts Payable Processing Risk Assessment

This analysis identifies that “Goods/Services Not Available When Needed,” followed by “EDI Processing Errors” are the highest procurement and accounts payable risks to Student Affairs.

8-03

Accounting and Cash Deposits Processes Risk Assessment(P)

Objective Threat Probability Speed of Threat Factor Human Property Business Total Impact (P x TF x I)# Risk Type Type (1 - 3) Onset Forewarning Duration Total Score Impact Impact Impact Score Total1 Loss of Key Employees O, C, F Human 3 1 1 2 4 0 0 2 2 242 Fraud O, C, F Human 2 2 2 0 4 1 1 1 3 243 Violation of Laws O, C, F Mission 2 1 2 2 5 0 0 2 2 204 Non-Compliance with Policies/Procedures O, C, F Mission 2 2 1 1 4 0 1 1 2 165 Inaccurate Accounting O, C, F Mission 2 2 1 1 4 0 1 1 2 166 Inaccurate Reports to Management O, C, F Mission 2 2 1 1 4 0 0 2 2 167 Injury to University's Reputation O, F Mission 1 1 1 2 4 0 0 3 3 128 Loss of Public Trust O, F Mission 1 1 1 2 4 0 0 3 3 129 Inaccurate/Inappropriate Budgets C, F Mission 2 0 1 2 3 0 0 1 1 6

10 Increased Litigation O, C, F Mission 1 1 1 2 4 0 0 1 1 411 Exceed Budget Expenditures (unapproved) O, C, F Mission 1 1 0 1 2 0 1 1 2 412 Loss of Future Grants, Gifts, and Donations O, C, F Mission 1 0 1 2 3 0 0 1 1 313 Decreased Enrollment (due to programs/facilities) O, C, F Mission 1 0 1 2 3 0 0 1 1 314 Unidentified Internal Control Weaknesses C, F Mission 1 1 1 1 3 0 0 1 1 3





Accounting and Cash Deposits Processing Risk Assessment

The above analysis identifies that the greatest accounting and cash deposits risks to Student Affairs are “loss of key employees”, “fraud” and “violation of laws.”

8-04

General Non-Finacial Processes Risk Assessment (that could impact finacial processes)(P)

Objective Threat Probability Speed of Threat Factor Human Property Business Total Impact (P x TF x I)# Risk Type Type (1 - 3) Onset Forewarning Duration Total Score Impact Impact Impact Score Total1 Fire O, F Environment 2 2 1 1 4 3 3 3 9 722 Tornado O, F Environment 2 2 1 0 3 3 3 3 9 543 Flood O, F Environment 2 1 1 2 4 1 3 2 6 484 Power Failure O, F Environment 3 2 2 0 4 1 1 2 4 485 Bomb Threat/Detonation O, F Human 1 2 1 2 5 3 3 3 9 456 Unexpected Sprinkler Discharge O, F Environment 2 2 2 0 4 1 2 2 5 407 Terrorist/Sabotage O, F Human 1 2 1 1 4 3 3 3 9 368 Earthquake O, F Environment 1 2 2 0 4 3 3 3 9 369 Ice Storm / Blizzard O, F Environment 3 1 1 2 4 1 1 1 3 3610 Epidemics / Illnesses O, F Environment 2 0 1 2 3 3 1 2 6 3611 Hazmat Event O, C, F Human 1 2 1 2 5 3 0 2 5 2512 Computer Outage - PeopleSoft O, F Environment 3 2 2 0 4 0 1 1 2 2413 Shooting / Employee Violence O, C, F Human 1 1 1 1 3 3 0 2 5 1514 Riot O, F Human 1 1 0 1 2 2 2 2 6 1215 Computer Outage - Building O, F Environment 3 2 2 0 4 0 0 1 1 1216 Cable / Telecom Outage O, F Environment 2 2 2 0 4 0 0 1 1 817 Strike O, F Human 1 0 0 2 2 0 0 3 3 6





Because these risks are primarily being mitigated by our business continuity plans and other University emergency and facilities management initiatives this chart is provided for reference only. We will focus our attention on the Procurement and Accounting-related risks and associated control activities.

General Non-Financial Processes Risk Assessment

8-05

After identifying and prioritizing our risks, the following slides overlay a list of various controls that may be helpful in mitigating the identified risks. Controls (rows) that are highlighted are controls that are required by the University.

A judgmental assessment was performed to estimate the effectiveness of the identified risks (columns) by inserting a control effectiveness factor (1=low to 3=high) at the intersection of the risk (column) and the control (row).

From this analysis, we can begin to identify the primary controls that should be implemented, along with the controls that may be beneficial, but may not be cost effective.

The row totals help prioritize the controls across all of the risks. The column total helps identify a level of controls that may be implemented for the associated risks.

There are no standards for an appropriate number of controls associated with the risks. However, by reviewing the column totals from left (highest risk) to right (lowest risks), the control totals should appear reasonable with the highest risks having the most controls.



8-06



Procurement and Accounts Payable Processing Risks and Control Activities80 45 32 30 30 30 30 30 30 24 24 24 20 20 18 12 12 12 8

Con

trol T

ype

(P=P

reve

ntiv

e,

D=D

etec

tive,

C

=Cor

rect

ive)

Goo

ds/S

ervi

ces

Not

A

vaila

ble

Whe

n N

eede

d

ED

I Pro

cess

ing

Err

ors

Thef

t/Van

dalis

m

Vio

latio

n of

Law

s

Loss

of P

ublic

Tru

st

Inju

ry to

Uni

vers

ity's

R

eput

atio

n

Incr

ease

d Li

tigat

ion

Inac

cura

te A

ccou

ntin

g

Inac

cura

te R

epor

ts to

M

anag

emen

t

Loss

of K

ey E

mpl

oyee

s

Frau

d

Ven

dors

Not

Pai

d in

a

Tim

ely

Man

ner

Non

-Com

plia

nce

with

P

olic

ies/

Pro

cedu

res

Inap

prop

riate

Ven

dor

Pay

men

ts

Inac

cura

te/In

appr

opria

te

Bud

gets

Loss

of F

utur

e G

rant

s,

Gift

s, a

nd D

onat

ions

Dec

reas

ed E

nrol

lem

ent

(due

to

prog

ram

s/fa

cilit

ies)

Uni

dent

ified

Inte

rnal

C

ontro

l Wea

knes

ses

Exc

eed

Bud

get

Exp

endi

ture

s (u

napp

rove

d)

Total1 Appropriate Staffing & Expertise P/D 2 3 2 2 2 2 2 3 3 3 2 2 3 2 2 1 1 2 2 412 Segregation of Duties P/D 1 3 3 3 2 2 2 3 3 2 3 2 3 3 1 1 0 2 1 403 Training P/D/C 2 2 2 2 2 2 2 3 3 3 3 2 2 2 1 1 0 2 2 384 Standardized Processes and Procedures P/D/C 1 2 0 2 2 2 2 3 3 2 3 2 3 2 2 1 1 2 1 365 Independent and Timely Reconciliations D 0 3 0 2 1 1 1 3 2 0 3 1 3 3 1 1 1 2 1 296 Independent Compliance Reviews D 1 2 2 2 1 1 2 2 2 0 2 1 3 2 1 0 0 2 1 277 Independent Controls Monitoring & Report to Management D 1 2 2 2 1 1 1 2 2 0 2 2 2 2 1 0 0 1 1 25

8Independent 3-Way "Match" of Purchase Order, Receiver, and Invoice D 0 3 0 2 1 1 1 3 3 0 3 1 3 3 0 0 0 1 0 25

9 System Security Access P 0 1 1 2 2 2 2 2 2 0 2 0 2 1 2 1 0 1 0 2310 Approvals with Delegated Authority P 1 0 2 1 1 1 1 2 2 0 2 1 2 2 1 0 0 1 2 22

11Culture of Open Two-Way Communications, Caring, & Reasonable Financial Expectations P/D 0 1 1 1 1 1 1 2 1 3 2 0 2 1 1 0 0 1 0 19

12 Effective IT General and Application Controls and Testing P/D 0 2 0 2 2 2 1 1 3 0 2 0 2 0 1 0 0 1 0 1913 Secure Assets P/D 2 0 3 2 1 1 1 1 1 0 2 0 3 0 0 0 0 0 1 1814 Limit Dollar Amount of Transactions P 0 0 1 2 2 2 1 1 1 0 2 0 3 2 0 0 0 1 0 1815 Error/Violation Reporting Procedures P/D 0 0 2 2 1 1 1 1 1 0 2 0 2 1 0 0 0 1 0 15

16Performance Evaluations with Controls, Policies, and Procedures as Evaluation Points D 0 0 1 1 1 1 0 2 1 1 2 0 2 2 0 0 0 1 0 15

17 Management Review of Budget to Actual D 0 1 0 0 0 0 0 2 2 0 1 2 0 2 2 0 0 0 2 1418 Periodic, Independent, and Unannounced Cash Counts P/D 0 0 2 1 1 1 0 2 1 0 2 0 2 0 0 0 0 1 0 1319 Periodic, Independent, and Unannounced Inventory Counts P/D 2 0 2 1 1 1 0 1 0 0 1 0 2 0 0 0 0 1 1 1320 Emergency Management & Business Continuity Plans C 2 0 0 0 3 1 1 0 0 1 0 1 0 0 0 2 0 0 0 1121 Unit Inventory Management/Purchase Planning P/D 3 0 2 0 1 1 0 1 1 0 0 0 0 1 0 1 0 0 0 1122 Background Checks D 0 0 1 1 2 3 2 0 0 0 1 0 0 0 0 0 0 0 0 1023 Conflict of Interest Disclosure D 0 0 0 2 2 2 1 0 0 0 1 0 2 0 0 0 0 0 0 1024 Multiple Procurement Methods and Levels P 3 0 0 1 2 2 0 0 0 0 0 0 0 0 0 0 0 0 0 825 Demonstrated Willingness to Prosecute P 0 0 2 2 1 1 0 0 0 0 2 0 0 0 0 0 0 0 0 826 Tag all Items Over an Established Dollar Limit P/D 0 0 2 0 0 0 0 0 0 0 0 0 2 0 0 1 0 0 0 527 Prioritize Transactions and Process Based on Priorities P 2 0 0 0 0 0 0 1 1 0 0 1 0 0 0 0 0 0 0 528 Track/Measure Volume of Priority Transactions D 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 0 3

24 25 33 38 36 35 25 41 38 15 45 18 49 31 16 10 3 24 15 521Est. Control Effectiveness0=None; 1=Limited; 2=Moderate; 3=High Highlighted controls are required by the University

Total

Risk Total

Potential Controls

8-07



Accounting and Cash Deposits Risks and Control Activities24 24 20 16 16 16 12 12 6 4 4 3 3 3

Potential Controls Con

trol T

ype

(P=P

reve

ntiv

e,

D=D

etec

tive,

C=C

orre

ctiv

e)

Loss

of K

ey E

mpl

oyee

s

Frau

d

Vio

latio

n of

Law

s

Non

-Com

plia

nce

with

P

olic

ies/

Pro

cedu

res

Inac

cura

te A

ccou

ntin

g

Inac

cura

te R

epor

ts to

M

anag

emen

t

Inju

ry to

Uni

vers

ity's

R

eput

atio

n

Loss

of P

ublic

Tru

st

Inac

cura

te/In

appr

opria

te

Bud

gets

Incr

ease

d Li

tigat

ion

Exc

eed

Bud

get

Exp

endi

ture

s (u

napp

rove

d)

Loss

of F

utur

e G

rant

s,

Gift

s, a

nd D

onat

ions

Dec

reas

ed E

nrol

lem

ent

(due

to p

rogr

ams/

faci

litie

s)

Uni

dent

ified

Inte

rnal

C

ontro

l Wea

knes

ses

Total1 Appropriate Staffing & Expertise P/D 3 2 2 3 3 3 2 2 2 2 2 1 1 2 302 Standardized Processes and Procedures P/D/C 2 3 2 3 3 3 2 2 2 2 1 1 1 2 293 Segregation of Duties P/D 2 3 3 3 3 3 2 2 1 2 1 1 0 2 284 Training P/D/C 3 3 2 2 3 3 2 2 1 2 2 1 0 2 285 Independent and Timely Reconciliations D 0 3 2 3 3 2 1 1 1 1 1 1 1 2 226 System Security Access P 0 2 2 2 2 2 2 2 2 2 0 1 0 1 207 Independent Compliance Reviews D 0 2 2 3 2 2 1 1 1 2 1 0 0 2 198 Effective IT General and Application Controls and Testing P/D 0 2 2 2 1 3 2 2 1 1 0 0 0 1 179 Independent Controls Monitoring & Report to Management D 0 2 2 2 2 2 1 1 1 1 1 0 0 1 16

10 Approvals with Delegated Authority P 0 2 1 2 2 2 1 1 1 1 2 0 0 1 16

11Culture of Open Two-Way Communications, Caring, & Reasonable Financial Expectations P/D 3 2 1 2 2 1 1 1 1 1 0 0 0 1 16

12 Secure Assets P/D 0 2 2 3 1 1 1 1 0 1 1 0 0 0 1313 Error/Violation Reporting Procedures P/D 0 2 2 2 1 1 1 1 0 1 0 0 0 1 12

14Performance Evaluations with Controls, Policies, and Procedures as Evaluation Points D 1 2 1 2 2 1 1 1 0 0 0 0 0 1 12

15 Periodic, Independent, and Unannounced Cash Counts P/D 0 2 1 2 2 1 1 1 0 0 0 0 0 1 1116 Management Review of Budget to Actual D 0 1 0 0 2 2 0 2 0 2 0 0 0 917 Periodic, Independent, and Unannounced Inventory Counts P/D 0 1 1 2 1 0 1 1 0 0 1 0 0 1 918 Background Checks D 0 1 1 0 0 0 3 2 0 2 0 0 0 0 919 Emergency Management & Business Continuity Plans C 1 0 0 0 0 0 1 3 0 1 0 2 0 0 820 Demonstrated Willingness to Prosecute P 0 2 2 0 0 0 1 1 0 0 0 0 0 0 621 Prioritize Transactions and Process Based on Priorities P 0 0 0 0 1 1 0 0 0 0 0 0 0 0 222 Track/Measure Volume of Priority Transactions D 0 0 0 1 0 0 0 0 0 0 0 0 0 1 2

15 39 31 39 36 33 27 28 16 22 15 8 3 22 334Est. Control Effectiveness0=None; 1=Limited; 2=Moderate; 3=High

Total

Risk Total

Highlighted controls are required by the University8-08

The previous Risks and Control Activities matrices help identify the most important controls to be designed into the overall control structure (service center) and the processes.



• Appropriate staffing. Operations that are inadequately staffed and have inadequate expertise increase the risk of higher error rates, greater amount of time required for identification of errors and re-works, higher staff turnover and absenteeism, lower work-life satisfaction, reduced customer service, higher risk of fraud and higher risk of non-compliance with policies and procedures.

• Segregation of duties. Segregation of duties is a required control by the University and is an integral part in the design of the service center model. At least two people are involved in every transaction with the unit being responsible for the review and approval for appropriateness, and the fiscal support services staff being responsible for performing an independent compliance review and for entering the transaction into the PeopleSoft system. Segregation of duties will be maintained within the FSS staff by additional reviews and independent reconciliations.

• Training. Training is a required control by the University. Everyone that is involved in managing University resources and staff are required by the University to complete a “responsibilities” course that is presented by the University Controller’s Office or to complete the Student Affairs “Buying 101” course that is available through the Student Affairs web. Additional training will be provided to those involved in the fiscal-related and management processes. The next two slides identify training plans for those involved with the Procurement and Accounting processes.

8-09

Providing appropriate training is critical to the success of the service center concept and standardized fiscal processes.

To the right is a draft listing of training topics and/or courses that we are working on for those involved with the Procurement processes.

Our intention is to work with the University to leverage their training resources to the maximum extent possible.



Training Topics/Courses Uni

t Ide

ntifi

ed

Use

rs

Uni

t Bus

ines

s O

ffice

Sta

ff

Uni

t Bus

ines

s M

anag

er

Em

bedd

ed

Fisc

al S

uppo

rt Te

am

Cen

tral F

isca

l S

uppo

rt S

taff

Req/PO Process * X X X X XBlanket PO Process & Log * X X X X XPetty Cash Process * X X X X XProcurement Card Process * & Log X X X X X100W Process * X X X X XTravel Request & Reimb Process * X X X X XTravel Request (Cash Adv. For Employees) * X X X X XTravel Request (Cash Adv. For Non-Univ Empl/Students) * X X X X XTravel Reimbursements (Cash Advance) * X X X X XOther Reimbursements, Refunds, Non-PO Payments * X X X X XAccounts Payable (Student Affairs Satellite A/P) * X X X X XAccounts Payable (University CAP) * X X X X XContact for Assistance/Help X X X X XCompliance Checklist X X X X XExpenditure Policies X X X X XBuying 101 X X X X XBudget Overview - Non-General Funds X X X X XBudget Overview - General Funds X X X X XAccounting and Chartfield Overview X X X X XConflict of Interest * X X X X XDelegation of Authority X X X X XReconciliation Process Overview X X X X XPS Inquiry X X X XeReports X X X XPS Entry X XDocument Logging X XScanning X XTime Tracker X XDocument/Filing X XMicrosoft Access X X X

* - Includes process forms and timelines

AudienceProcurement and Accounts Payable Training

8-10

To the right is a draft listing of training topics and/or courses that we are working on for those involved with the accounting and cash deposits processes.

Many of these classes overlap with the Procurement classes.


Risk Assessments and Controls Activities OverviewAccounting and Cash Deposits Training

Accounting Processes Uni

t Ide

ntifi

ed U

sers

Uni

t Bus

ines

s O

ffice

Sta

ff

Uni

t Bus

ines

s M

anag

er

Em

bedd

ed F

isca

l Sup

port

Team

Cen

tral F

isca

l Sup

port

Sta

ff

Accounts Receivable Process (Initial Billing)* X X X X XAccounts Receivable Process (Collections) X X X X XCash Receipts/Deposits X X X X XJournal Entries X X X XContact for Assistance/Help X X X X XCompliance Checklist X X X X XTreasurer's Policies X X X X XCash Handling X X X X XBudget Overview - Non-General Funds X X X X XAccounting and Chartfield Overview X X X X XDelegation of Authority X X X X XUniversity-related GAAP X X XReconciliation Process X X X X XPS Inquiry X X X XeReports X X X XPS Entry X XDocument Logging X XScanning X XTime Tracker X XDocument/Filing X XMicrosoft Access X X X

* - Includes forms and timelines

Audience

8-11

Important controls (continued)



• Standardized processes and procedures. Standardized processes and procedures is a “given” in that we have already addressed the importance of this control.

• Independent and Timely Reconciliations. Independent and timely reconciliations are required by the University. With the exception of units performing required “daily reconciliations” of their change funds and “weekly reconciliations” of their petty cash, the Fiscal Support Services staff will be responsible for performing independent reconciliations of general ledger transactions to source documents.

• Independent Compliance Reviews. As identified with Segregation of Duties, all approved transactions (by the unit) will be independently reviewed for compliance to policies/procedures by the fiscal support services staff, prior to being entered into the PeopleSoft system.

• Independent Controls Monitoring & Report to Management. When fully staffed, the Student Affairs Central Fiscal Support Services operation will include staff that are devoted to performing controls monitoring. Additionally, technology will be used to efficiently monitor controls activities to the extent possible. Reports will be provided to senior management periodically on the status of the controls.

• System Security Access. Security into the PeopleSoft system is managed by the Office of Information Technology. The Student Affairs Central Fiscal Support Services leadership team will manage the security access rights for Student Affairs into PeopleSoft, based on delegation of authorities by the VP.

8-12




• Approvals with Delegated Authority. Approvals with delegated authority from the VP is a required control by the University. The Student Affairs Central Fiscal Support Services staff will manage the approved authorities. Fiscal support staff will verify that appropriately authorized staff have approved the transactions as part of their compliance review and approval.

• Error/Violation Reporting Procedures. The University requires that everyone involved in the fiscal processes be aware of error/violation reporting procedures. Training of these procedures has already been incorporated into the Student Affairs “Buying 101” course.

• Culture of Open Two-Way Communications, Caring, & Reasonable Financial Expectations. This management control is an important part of helping retain key employees and is a primary control for fraud prevention. The fiscal support services operations will continue its efforts to ensure a caring culture with open two-way communications. Any organizational financial expectations issues are minimized by the fiscal support services only handling the transactions and not being responsible for the overall earnings and financial status of the operations. This is an important control with little or no cost.

• Performance Evaluations. Because a significant portion of the job responsibilities for the fiscal support services staff involve controls, policies, and procedures knowledge and compliance, these factors, along with customer service, will be incorporated into performance evaluations. This is an important control with little or no cost.

8-13




• Independent 3-Way “Match”. Performing a 3-way match of the purchase order, receiver, and invoice is the primary control to ensure that we paying for what we appropriately received, and that the amount that was invoiced is what was agreed upon. Both KPMG and our processing workgroup identified this as an important control that should be implemented into the standardized fiscal processes and procedures.

• Inventory Management/Purchase Planning. Our identified greatest risk with procurement is that goods/services will not be available when needed. To mitigate this risk will require units to implement inventory and purchase planning procedures. Units should identify items that are critical to their operation and ensure that these items are maintained in inventory.

• Multiple Procurement Methods and Levels. To minimize the risk that goods/services will not be available when needed, the University has established several procurement methods with the two primary methods being requisitions/purchase orders and procurement cards. Alternate means should be used as appropriate when needed, or elevate the purchase request to Student Affairs central fiscal support services if higher dollar limits become an issue.

• Prioritize Transactions. Because of the risk that items may not be available when needed, Unit business managers should prioritize transactions in terms of “emergency”, “critical” or “routine” (with routine being the default). Items prioritized as emergency or critical will be processed first to minimize the risk and impact of items not being available as needed.

8-14

80 45 32 30 30 30 30 30 30 24 24 24 20 20 18 12 12 12 8

Con

trol T

ype

(P=P

reve

ntiv

e,

D=D

etec

tive,

C=C

orre

ctiv

e)

Goo

ds/S

ervi

ces

Not

Ava

ilabl

e W

hen

Nee

ded

ED

I Pro

cess

ing

Err

ors

Thef

t/Van

dalis

m

Vio

latio

n of

Law

s

Loss

of P

ublic

Tru

st

Inju

ry to

Uni

vers

ity's

Rep

utat

ion

Incr

ease

d Li

tigat

ion

Inac

cura

te A

ccou

ntin

g

Inac

cura

te R

epor

ts to

Man

agem

ent

Loss

of K

ey E

mpl

oyee

s

Frau

d

Ven

dors

Not

Pai

d in

a T

imel

y M

anne

r

Non

-Com

plia

nce

with

P

olic

ies/

Pro

cedu

res

Inap

prop

riate

Ven

dor P

aym

ents

Inac

cura

te/In

appr

opria

te B

udge

ts

Loss

of F

utur

e G

rant

s, G

ifts,

and

D

onat

ions

Dec

reas

ed E

nrol

lem

ent (

due

to

prog

ram

s/fa

cilit

ies)

Uni

dent

ified

Inte

rnal

Con

trol

Wea

knes

ses

Exc

eed

Bud

get E

xpen

ditu

res

(una

ppro

ved)

Total1 Appropriate Staffing & Expertise P/D 2 3 2 2 2 2 2 3 3 3 2 2 3 2 2 1 1 2 2 412 Segregation of Duties P/D 1 3 3 3 2 2 2 3 3 2 3 2 3 3 1 1 0 2 1 403 Training P/D/C 2 2 2 2 2 2 2 3 3 3 3 2 2 2 1 1 0 2 2 384 Standardized Processes and Procedures P/D/C 1 2 0 2 2 2 2 3 3 2 3 2 3 2 2 1 1 2 1 365 Independent and Timely Reconciliations D 0 3 0 2 1 1 1 3 2 0 3 1 3 3 1 1 1 2 1 296 Independent Compliance Reviews D 1 2 2 2 1 1 2 2 2 0 2 1 3 2 1 0 0 2 1 277 Independent Controls Monitoring & Report to Management D 1 2 2 2 1 1 1 2 2 0 2 2 2 2 1 0 0 1 1 25

8Independent 3-Way "Match" of Purchase Order, Receiver, and Invoice D 0 3 0 2 1 1 1 3 3 0 3 1 3 3 0 0 0 1 0 25

9 System Security Access P 0 1 1 2 2 2 2 2 2 0 2 2 1 2 1 0 1 0 2310 Approvals with Delegated Authority P 1 0 2 1 1 1 1 2 2 0 2 1 2 2 1 0 0 1 2 22

11Culture of Open Two-Way Communications, Caring, & Reasonable Financial Expectations P/D 0 1 1 1 1 1 1 2 1 3 2 0 2 1 1 0 0 1 0 19

12 Effective IT General and Application Controls and Testing P/D 0 2 0 2 2 2 1 1 3 0 2 0 2 0 1 0 0 1 0 1913 Secure Assets P/D 2 0 3 2 1 1 1 1 1 0 2 0 3 0 0 0 0 0 1 1814 Limit Dollar Amount of Transactions P 0 0 1 2 2 2 1 1 1 0 2 0 3 2 0 0 0 1 0 1815 Error/Violation Reporting Procedures P/D 0 0 2 2 1 1 1 1 1 0 2 0 2 1 0 0 0 1 0 15

16Performance Evaluations with Controls, Policies, and Procedures as Evaluation Points D 0 0 1 1 1 1 0 2 1 1 2 0 2 2 0 0 0 1 0 15

17 Management Review of Budget to Actual D 0 1 0 0 0 0 0 2 2 0 1 2 0 2 2 0 0 0 2 1418 Periodic, Independent, and Unannounced Cash Counts P/D 0 0 2 1 1 1 0 2 1 0 2 0 2 0 0 0 0 1 0 1319 Periodic, Independent, and Unannounced Inventory Counts P/D 2 0 2 1 1 1 0 1 0 0 1 0 2 0 0 0 0 1 1 1320 Emergency Management & Business Continuity Plans C 2 0 0 0 3 1 1 0 0 1 0 1 0 0 0 2 0 0 0 1121 Unit Inventory Management/Purchase Planning P/D 3 0 2 0 1 1 0 1 1 0 0 0 0 1 0 1 0 0 0 1122 Background Checks D 0 0 1 1 2 3 2 0 0 0 1 0 0 0 0 0 0 0 0 1023 Conflict of Interest Disclosure D 0 0 0 2 2 2 1 0 0 0 1 0 2 0 0 0 0 0 0 1024 Multiple Procurement Methods and Levels P 3 0 0 1 2 2 0 0 0 0 0 0 0 0 0 0 0 0 0 825 Demonstrated Willingness to Prosecute P 0 0 2 2 1 1 0 0 0 0 2 0 0 0 0 0 0 0 0 826 Tag all Items Over an Established Dollar Limit P/D 0 0 2 0 0 0 0 0 0 0 0 0 2 0 0 1 0 0 0 527 Prioritize Transactions and Process Based on Priorities P 2 0 0 0 0 0 0 1 1 0 0 1 0 0 0 0 0 0 0 528 Track/Measure Volume of Priority Transactions D 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 0 3

24 25 33 38 36 35 25 41 38 15 45 18 49 31 16 10 3 24 15 52121 22 25 29 27 25 21 34 31 15 34 16 39 27 13 10 3 19 12 423

Est. Control Effectiveness0=None; 1=Limited; 2=Moderate; 3=High

Total Select & Required Controls - Effectivenss Total All Controls - Effectivenss

Risk Total

Potential Controls


Risk Assessments and Controls Activities OverviewProcurement and Accounts Payable Processing Risks and Control Activities

Controls highlighted in yellow are our primary controls that if implemented appropriately should provide “reasonable assurance”. Other controls will be added or performed as needed.

8-15

24 24 20 16 16 16 12 12 6 4 4 3 3 3

Potential Controls Con

trol T

ype

(P=P

reve

ntiv

e,

D=D

etec

tive,

C=C

orre

ctiv

e)

Loss

of K

ey E

mpl

oyee

s

Frau

d

Vio

latio

n of

Law

s

Non

-Com

plia

nce

with

P

olic

ies/

Pro

cedu

res

Inac

cura

te A

ccou

ntin

g

Inac

cura

te R

epor

ts to

M

anag

emen

t

Inju

ry to

Uni

vers

ity's

R

eput

atio

n

Loss

of P

ublic

Tru

st

Inac

cura

te/In

appr

opria

te

Bud

gets

Incr

ease

d Li

tigat

ion

Exc

eed

Bud

get

Exp

endi

ture

s (u

napp

rove

d)

Loss

of F

utur

e G

rant

s,

Gift

s, a

nd D

onat

ions

Dec

reas

ed E

nrol

lem

ent

(due

to p

rogr

ams/

faci

litie

s)

Uni

dent

ified

Inte

rnal

C

ontro

l Wea

knes

ses

Total1 Appropriate Staffing & Expertise P/D 3 2 2 3 3 3 2 2 2 2 2 1 1 2 302 Standardized Processes and Procedures P/D/C 2 3 2 3 3 3 2 2 2 2 1 1 1 2 293 Segregation of Duties P/D 2 3 3 3 3 3 2 2 1 2 1 1 0 2 284 Training P/D/C 3 3 2 2 3 3 2 2 1 2 2 1 0 2 285 Independent and Timely Reconciliations D 0 3 2 3 3 2 1 1 1 1 1 1 1 2 226 System Security Access P 0 2 2 2 2 2 2 2 2 2 0 1 0 1 207 Independent Compliance Reviews D 0 2 2 3 2 2 1 1 1 2 1 0 0 2 198 Effective IT General and Application Controls and Testing P/D 0 2 2 2 1 3 2 2 1 1 0 0 0 1 179 Independent Controls Monitoring & Report to Management D 0 2 2 2 2 2 1 1 1 1 1 0 0 1 1610 Approvals with Delegated Authority P 0 2 1 2 2 2 1 1 1 1 2 0 0 1 16

11Culture of Open Two-Way Communications, Caring, & Reasonable Financial Expectations P/D 3 2 1 2 2 1 1 1 1 1 0 0 0 1 16

12 Secure Assets P/D 0 2 2 3 1 1 1 1 0 1 1 0 0 0 1313 Error/Violation Reporting Procedures P/D 0 2 2 2 1 1 1 1 0 1 0 0 0 1 12

14Performance Evaluations with Controls, Policies, and Procedures as Evaluation Points D 1 2 1 2 2 1 1 1 0 0 0 0 0 1 12

15 Periodic, Independent, and Unannounced Cash Counts P/D 0 2 1 2 2 1 1 1 0 0 0 0 0 1 1116 Management Review of Budget to Actual D 0 1 0 0 2 2 0 2 0 2 0 0 0 917 Periodic, Independent, and Unannounced Inventory Counts P/D 0 1 1 2 1 0 1 1 0 0 1 0 0 1 918 Background Checks D 0 1 1 0 0 0 3 2 0 2 0 0 0 0 919 Emergency Management & Business Continuity Plans C 1 0 0 0 0 0 1 3 0 1 0 2 0 0 820 Demonstrated Willingness to Prosecute P 0 2 2 0 0 0 1 1 0 0 0 0 0 0 621 Prioritize Transactions and Process Based on Priorities P 0 0 0 0 1 1 0 0 0 0 0 0 0 0 222 Track/Measure Volume of Priority Transactions D 0 0 0 1 0 0 0 0 0 0 0 0 0 1 2

15 39 31 39 36 33 27 28 16 22 15 8 3 22 33415 30 24 32 29 26 19 21 13 19 12 8 3 18 269

Est. Control Effectiveness0=None; 1=Limited; 2=Moderate; 3=High

Total All Controls - Effectiveness

Risk Total

Total Select & Required Controls - Effectiveness


Risk Assessments and Controls Activities OverviewAccounting and Cash Deposits Processing Risks and Control Activities

Controls highlighted in yellow are our primary controls that if implemented appropriately should provide “reasonable assurance”. Other controls will be added or performed as needed.

8-16

Understand Internal Controls Perform Risk Assessments for the fiscal-related processes and non-fiscal risks


Identify the preliminary control activities associated with the above fiscal-related processes, including University-specified controls Training/Skills requirements





Concept Requires


Concept



EfficientPolicies &

Procedures




8-17


Information Technology Support Overview


Topic 9: Information Technology Support Overview

9-00

WHAT

Topic Objectives

9-01



• Discuss the relationship between fiscal support services and information technology

• Discuss the six information technology support needs that were presented to the Student Affairs IT steering committee and the status of each

9-02



The primary mission of the fiscal support services operation is to maximize fiscal resources and to provide• efficient, timely, and accurate transaction processing• accurate and meaningful fiscal reports, and• monitor and report status of controls

Effective use of information and information technology is one of the most important foundations (one of the 5 components to internal controls) for accomplishing our fiscal support services mission.

Critical to our success in providing efficient processes, accurate and timely financial reports and controls monitoring include • efficient systems to facilitate efficient processes, • accurate information (data), and • efficient data/information access, storage, and retrieval.

9-03



KPMG identified that one of the critical elements for the successful implementation of service center and standardized fiscal processes involved the effective use of information technologies.

Much of KPMG’s focus was on making full use of a number of PeopleSoft system-related controls that were “shut-off” by the University, such as using PeopleSoft to perform the “3-Way Match”.

Other recommendations by KPMG included better use of technology for monitoring controls.

KPMG

Student Affairs Fiscal Process Workgroups

The Student Affairs fiscal process workgroups further identified the following information technology support needs:

• Web-based reconciliation system• Document management system (having broader use than simply fiscal processes and documentation)

9-04



Student Affairs IT Steering Committee Information

The following tables provide fiscal-related IT support needs that were submitted to the Student Affairs Information Technology Steering Committee in January 2008. The first six items were presented to the steering committee as priority needs for successfully implementing the service centers.

The first three items were approved by the Steering Committee for implementation in FY09.

The remaining items will be re-visited at a later point in time.

Priority IT Support Need Reason1 Web-based General Ledger Reconciliation System Compliance, Internal Controls, Continuous Improvement2 Cash Receipts to General Ledger Reconciliation System Compliance, Internal Controls, Continuous Improvement3 Document Management System Efficiency, Measurement, Continuous Improvement4 Dashboard - Graphical Reporting Tool Measurement & Continuous Improvement5 Improved Time Tracking System Measurement, Continuous Improvement, Cost Recovery6 Ticket Tracking (Help Desk) System Measurement, Continuous Improvement, Customer Satisfaction

Others7 Direct Access to the University General Ledger Data Efficiency, Reporting Accuracy8 Improved Reporting Tool Efficiency, Reporting Accuracy9 Rewrite of the existing Budget System Efficiency10 Web-based Delegation of Authority Listing System Efficiency




Identify information technology support needs or objectives• Identify controls monitoring and communications objectives




Concept Requires


Concept



EfficientPolicies &

Procedures




9-05


Monitoring and Communications Overview


Topic 10: Monitoring and Communications Overview

10-00

WHAT


Topic 10: Monitoring and Communications Overview

10-01

Topic Objectives

• Discuss how monitoring and communications “fit” into the management process

• Discuss examples of fiscal-related controls that should be monitored and communicated to senior management

• Discuss future enhancements (IT support needs) for improving monitoring and communications

Overview

10-02



In the Internal Controls Overview, we reviewed that effective internal control is a built-in part of the management process (planning and controlling).

There are 5 interrelated components to internal controls, which all must be present for internal controls to be effective.

1. Control (or Operating) environment2. Risk assessment3. Control activities4. Monitoring, and5. Information and communication

• Keeping an organization on course toward its objectives• Promoting

• effectiveness and efficiency of operations,• reducing the risk of asset loss, and• helping to ensure compliance with laws and regulations

• Ensuring the reliability of financial reporting

Monitoring and Communications are two of the 5 interrelated components for

Controls Monitoring . . .

10-03



Monitoring should be department-specific and should “roll-up” to the college level.

• Are we achieving our financial goals?• How much money do we have to work with?• Are our financial statements reasonably accurate?

• Are we appropriately staffed (with appropriate expertise) to perform our fiscal support activities?• Are our fiscal staff appropriately trained?• Have our unit staff completed required University training?• What are the average fiscal support staff hours worked?• What is the work-life satisfaction of our fiscal staff?

For example, procedures and measurements should be created to answer the following questions for each of our directors. These answers should then be “rolled-up” to the College level.

Financial Goals:

Fiscal Support Staffing and Expertise/Training:


10-04



• Are there any compliance issues?• What are our accuracy/error rates?• What is the total cost of processing and the average cost by process and transaction?• What is the average processing time?• Have we completed our reconciliations?• What are the transaction volumes and trends?• What are the number of help desk questions/issues, by issues category?• What are the number of approved process exceptions, by exception type?

• What is our overall customer satisfaction rating? • What were our audit findings?• How much in “net income enhancements” were identified by the fiscal support services staff?• What are our greatest financial-related/controls risks and how should we mitigate these risks? • Have we achieved our MBE/Edge goals?• Has our Business Continuity Plan been recently tested?

Examples (continued)

Processes and Procedures:

Other:

Metrics can be applied to each of these questions so that we are able to track the results over time and they can be incorporated into strategic goals of the department, fiscal support services, and the college.

IT Support and Controls Monitoring . . . Future Enhancements

10-05



As earlier indicated, six IT support needs were presented to the Student Affairs IT steering committee. All six are important controls monitoring tools. The first three were approved to begin work in FY08/FY09 and the remaining ones will be reassessed at a later point in time.

The “dashboard” is a graphical reporting tool that can possibly present the findings to the controls monitoring and other questions in a single page graphical manner, with full drill-down capability.

The “improved time tracking system” is software that will permit staff to enter the amount of time that they have worked to support a department and a process. This information will be critical to assess the cost of processing and the transaction processing times. Alternate methods can be used until this system is fully in place.

The “ticket tracking (help desk) system” is needed to provide a single point of contact for our customers to call/contract to resolve issues. Instead of Student Affairs developing a system, we will work with the University to refine their implementation of “Remedy” to provide this service for Student Affairs.

Priority IT Support Need Reason1 Web-based General Ledger Reconciliation System Compliance, Internal Controls, Continuous Improvement2 Cash Receipts to General Ledger Reconciliation System Compliance, Internal Controls, Continuous Improvement3 Document Management System Efficiency, Measurement, Continuous Improvement4 Dashboard - Graphical Reporting Tool Measurement & Continuous Improvement5 Improved Time Tracking System Measurement, Continuous Improvement, Cost Recovery6 Ticket Tracking (Help Desk) System Measurement, Continuous Improvement, Customer Satisfaction


10-06



As we move forward, we will continue to refine and prioritize our controls monitoring questions and the methods for obtaining the answers.




Identify information technology support needs or objectives Identify controls monitoring and communications objectives




Concept Requires


Concept



EfficientPolicies &

Procedures




10-07


Next Steps & Conclusions


Topic 11: Next Steps & Conclusion

11-00

11-01

The next steps in our implementation process include the following:


Next Steps & Conclusion


Concept Requires


Concept



EfficientPolicies &

Procedures



• Ensure appropriate staffing, training and facilities

• Continuously monitor and refine the processes, procedures, and structures

For each fiscal process, we will document the preliminary

• Policies and procedures• Process flowchart(s)• Key performance indicators (success criteria)• Process-specific internal controls• Process-specific monitoring techniques, and• Process-specific information technology support needs


Next Steps and Conclusion

To implement the Student Affairs strategic goals of

• Put Students First: Expand Learning Environments• Forge One University• Focus on Staff and Organizational Success• Community Engagement, and• Simplify Systems

Requires efficient fiscal support services (structure and processes) to

• Maximize resources to support all of our strategic goals.• Improve efficiency over time by

• Standardizing processes,• Eliminating duplicate processes and internal controls (bureaucracy),• Better aligning staff skills with functions,• Improving accuracy results in reduced re-work.

• Improve information for decision making, and• Improve operations by

• Improving transaction quality and service level, and • Reducing risks and increasing compliance.

11-02

Conclusion


Next Steps and Conclusion

• Discussed why we are making changes to our fiscal support structure and fiscal processes. WHY

• Discussed how we created our service center model structure and how it is designed to operate. HOW

• Discussed our implementation actions for the service center model so that we are able to achieve the maximum benefits and to minimize negative impact on our staff and operations. WHAT

This is all a work in progress and your input is greatly appreciated!!

Please call me or e-mail me any thoughts you may have for structure and process improvements.

Dan Allen – 688-3318 or [email protected]

This overview was intended to provide the framework for our implementation of a new fiscal support structure (service center model) and our standardized fiscal processes. In this overview, we. . .

11-03

Office of Student Affairs Service Center Implementation & Standardized Fiscal Processes

Documents

Transcript of Office of Student Affairs Service Center Implementation & Standardized Fiscal Processes