Background

The Internal Audit Department of a state-supported university was in the process of performing a scheduled audit of a school within the university that had several academic departments. The internal auditor developed an audit program, which included academic auditing departments within the school having potentially higher risk levels, based on factors such as funding levels, number of funding sources, and number of students. Internal Audit performed this type of audit each year rotating between the various schools within the institution. Audit objectives routinely included evaluating compliance with university policies and procedures relating to procurement, payroll, and cash collections and deposits.

Selected Department

Departments were selected based on the criteria of the audit objectives and discussions with school management. One of the academic departments selected had approximately 30 faculty members, seven administrative staff members, and a nationally recognized graduate program. In addition to being responsible for the academic programs, the department also conducted several functions that provided contract services to the community on a fee basis. Each fund source was recorded in a separate account, and the department had more than 90 accounts. The fund types included state funding, private donations, state and federal grants and contracts, and industry-sponsored contracts. Fund amounts ranged from a low of $1,500 to several which exceeded $100,000. Each type of fund had different requirements relating to how and for what the funds could be expended.

Participants

Faculty members were paid a salary for providing teaching, research, and performing community service in the name of the university. Their contracts were typically for nine months each year. They were allowed to supplement their salary for the remaining three months of the year through various types of grants and contracts. Faculty members were also allowed to work, usually as consultants, up to one day per week outside of the university and were paid directly by the party with whom they were consulting. The consulting fees were personal income for the faculty member and were not processed through the university in any manner.

The department chair had been at the university for more than ten years and was recognized as a faculty leader through various programs at the university. He had held the chair position for five years and was classified as an instructional faculty member with an administrative appointment. Under the guidelines of the university, he received additional compensation for the extra administrative duties he performed as the chair. He was considered a 12-month employee. Therefore, he was not allowed to supplement his university salary in any manner, including summer school teaching or additional funding through a grant.

The university policy stated that department chairs reported to the Dean of the academic college or school. However, in this case, there had historically been little or no review of the department’s finances by the Dean or his representative.

The core administrative staff had been in the department for a number of years. The staff consisted of the chair’s secretary (three years in the department), a business manager (more than 10 years in the department), and a fiscal tech (more than 20 years in the department). The business manager was responsible for the fiscal management of the department, and the fiscal tech prepared the financial transactions at the direction of the chair and the business manager.

The financial transactions of the department were initiated using the university’s on-line financial accounting system. In order to provide the chair and appropriate faculty members with timely management data, the fiscal tech also used a series of spreadsheets to manage each account. These spreadsheets provided up to the minute information regarding each account rather than the reports from the university system, which were usually received about ten days after the end of each month.

The fiscal tech prepared the financial transactions based on direction from the chair, appropriate faculty members, or the business manager. The business manager was responsible for approving all financial transactions. However, the business manager shared her password with the fiscal tech as she believed that she didn’t have time to approve each transaction. The fiscal tech then had the ability to approve and enter transactions, despite the fact that she only had the on-line authority to initiate transactions.

Within the last year, the administrative staff had received salary increases for exemplary performance. The raises were given at the direction of the chair.

Situation

The institution had numerous financial policies and procedures that were fragmented and not well communicated. These procedures were available on-line. Training was available, but it was not required. The department personnel had received the training. Implementation of the financial policies and procedures was delegated to the departmental level with minimal review by central organizations to ensure adherence to these policies and procedures.

The internal auditor performed the review. The major finding resulted in a recommendation that monthly reconciliations of each departmental account be performed and documented and that each account be signed by the business manager, signifying certification that each expenditure was made in accordance with university policy and for university related purposes. The recommendation was fully supported by the Dean, and he ordered all departments to immediately implement the recommendation.

Allegations

When the audit was completed and the above finding was being implemented, university management received an anonymous tip. The caller alleged that a department chair had been paying personal bills from university accounts and that other irregularities had occurred within the chair’s department.

Required. Answer the questions in paragraphs. Refer to any or all Audit regulations, i.e., AU and SAS

1) Upon receiving notification of the anonymous tip, outline the actions that you would take as the university’s auditor.

2) What controls would you look for to determine where the potential weaknesses were located?

3) How would you strengthen controls at the university level to decrease the likelihood of this type of occurrence?