audit risks / trends for colleges and universities june 2, 2015 mike stanley, c.p.a

Audit Risks / Trends For Colleges And Universities

June 2, 2015

Mike Stanley, C.P.A.

Source – College Board

Current Trends in Colleges and Universities

1. Funding: More institutional self-sufficiency and

competition

• Colleges and universities have to become more financially sustainable• Budget cuts abound• Some increase the recruitment focus on O-O-S or international students who pay higher,

out-of-state tuition and fees• Deferred Maintenance has become a major funding need• Adaptability to do more with less will be the hallmark of success for higher education

institutions


2. Regulations

• Consequence of the global financial crisis has been the toughening of the regulatory environment for higher ed institutions

• An increasing focus on managing risk and assuring quality and demands for accountability• Governance is challenged as there is a demand for greater efficiency (having to do more

with less)• Rising student debt levels and default rates continue to increase• Increasing demand from stakeholders (especially public universities) to justify the costs and

benefits of higher education


3. Increasing use of Technology to provide an Education

• Technology now offers many credible academic pathways• Maturation of Massive Open Online Courses (MOOCS)• At the beginning of 2012, MOOCS were virtually unknown but today they have compelled

many leading universities worldwide to voluntarily or involuntarily integrate them in their strategies

• In 2016 and in the future MOOCS will mature from irrational exuberance to a more viable and credible alternative for earning academic credit

• The unique mixture of content delivery, technology, quality, and cost transform educational expectations to form “glocal students” and bring into question the sustainability of brick and mortar/infrastructure-heavy branch campuses


3. Increasing use of Technology to provide an Education

(cont.)

• Advances in Technology, and competition for students will drive a significant increase in distance learning

• Blended courses of 2-3 years where the majority is done via distance learning and online access followed by one year on-campus will also become common

• Costs and fees will have to become more flexible and varied to accommodate the different course and student requirements

• The college experience is slowly shifting off campus and into the internet as students seek out multiple sources for their educational experience


4. Earning Credit for what you know:

• The Obama administration, state governments, and foundation funders are all pressuring college to shrink the time it takes for students to graduate. Two strategies:1) Advance students based on mastery of the subject (Competence Based Learning)

2) Give students credit for related work and life experiences (Prior Learning Assessment)

• Starbucks and the City University of Seattle have developed a partnership that allow employees to earn college credit for workplace training

• Some may argue that the School of Life and of hard knocks is going to become an accredited, degree granting institution


5. Career and Technical Education (CTE)

• After years of being pushed aside to free time for academics, career-focused learning is back

• High schools, community colleges, and companies are bonding together to help increase the opportunities students have to gain technical skills – often spurred by new state laws, like those in Texas and Georgia, These put a bigger emphasis on career and technical education

• Old school term = Vocational schools – these are back in vogue


6. Student Loan Outrage

• Recent data shows that seventy-one percent of students carry some type of student-loan debt

• A recent Harvard Institute of politics poll found that forty-two percent of students blame colleges and universities for rising college prices

• The total student-debt burden now exceeds $1 trillion• Main cause – state and federal funding for higher education and financial aid has dropped

radically since the 1980’s, and today’s college students are less well off than they used to be


7. Data-Privacy Concerns

• We have recently witnessed the beginnings of a backlash over the collection and storage of student data, including grades, contact information, disciplinary records, etc.

• Be cognizant of data storage companies such as inBloom and their use of or lack of privacy protections


8. Other Current Thoughts:

• Focus on Measuring Institutional Effectiveness as colleges and universities continue to face increased pressure to justify costs through college ranking systems (what cannot be measured cannot be managed)

• Institutions should start investigating ways to define and track student outcomes which could relate to future federal funding

• Expect to hear more about innovative higher education models. We mentioned competency-based education and prior learning assessments. Prepare for others including the continued expansion, analysis, and refinery of online education

Types of Risk in Higher Education

1. Financial Risks

• Accounting and Auditing Matters• Falsification of Contracts, Reports, or Records• Fraud• Improper Giving or Receiving of Gifts• Improper Suppliers or Contract Activity• Misuse of Donor Funds• Theft or Embezzlement• Waste, Abuse, or Misuse of Institutional Resources


2. Research Risks

• Conflict of Interest• Data Privacy• Environmental and Safety Matters• Falsification of Contracts, Reports, or Rewards• Fraud• Intellectual Property Infringement, Misappropriation or Disclosure• Human or Animal Research• Research Grant Misconduct or Misappropriation of Costs• Scientific Misconduct• Theft or Embezzlement• Waste, Abuse, or Misuse of Institutional Resources


3. Human Resource Risks

• Discrimination or Harassment• EEOC or ADA Matters• Employee Misconduct• Offensive or Inappropriate Communication• Sexual Harassment• Threat or Inappropriate Supervisor Directive• Unsafe working conditions• Violence or threat


4. Athletics Risk

• Fraudulent Activities• Improper Giving or Gifts• Inappropriate Activities• Misuse of Assets, Players, or Endorsements• Recruiting Misconduct• Scholarship/Financial Aid Misconduct• Sexual Misconduct• Substance Abuse


5. Safety Related Risks

• Confidentiality• Data Privacy – includes disclosure of Confidential Information• Environmental and Safety Matters• Sabotage or Vandalism• Unsafe working conditions• Waste, Abuse, or Misuse of Institutional Resources

Audit Risk and Trends and Guidance

Sarbanes-Oxley Act of 2002 (SOX): Institutions of higher education are not required to comply with SOX;

however, SOX requirements for audit committees can be a basis for best practices. The National Association

of College and University Business Officers (NACUBO) along with PricewaterhouseCoopers reviewed the

SOX requirements and identified sections of the Act that could represent best practices in higher education.

This guidance includes: • The institution should have an audit committee or incorporate audit in an existing committee, such as Finance and Audit

Committee.

• The audit committee should have a charter and the necessary authority to carry out its duties.

• Institutions with internal audit departments should consider using them to periodically report on internal controls to the audit

committee in addition to reporting to management.

• The audit committee should ensure a process exists for receiving confidential complaints and reviewing the nature and disposition

of reported matters.

• The audit committee should consider periodic inquiries of executives on the adequacy of financial controls.

• The audit committee should review the code of ethics for senior financial officers and periodically review how compliance is

assured.

Risk Appetite and Risk Tolerance

Risk Assessment Matrix

Source – Institute of Internal Auditors

Controls, Compliance and Risk

Risk Appetite and Risk Tolerance

There is a growing trend among Higher Ed Institutions to enhance risk management

through better controls over the many systems, process and procedures in place, and

to promote the importance of accountability among all of the institutions employees.

Improved governance and strong internal controls benefit the organization.

Place emphasis on compliance, and the recruiting, retention, and training of staff.

Develop plans to remediate gaps. DON’T INGNORE THE RISKS. Be proactive in

addressing and developing procedures and process to deal with these “elephants in

the room”.


Be aware of gaps in internal control effectiveness:

Control effectiveness has two components: design effectiveness and operational effectiveness. Design

effectiveness refers to whether controls are properly designed to achieve control objectives if they

operate as defined; Operating Effectiveness refers to whether controls consistently operate as

designed. Let’s addresses the design effectiveness of controls.

At this point, processes have been documented, control objectives have been defined and control

activities have been described. The primary goal of this function is to identify the controls that most

effectively and efficiently achieve the control objectives – i.e., the “Key Controls”. Having too many

controls will result in excessive documentation, testing, analysis and assessment efforts, and potentially

inefficient business processes. Having too few controls will result in “design gaps”, or inadequate Control

Activities to achieve Control Objectives. Determine whether each Control Objective is addressed by an

adequate group of Control Activities and whether there may be redundant Control Activities.


The most significant challenges internal auditors said they face in auditing including compliance:

1. Documentation issues;

2. Communication issues;

3. Lack of definitive standards;

4. Size or geographic reach of the organization;

5. Lack of guidance from external auditors (tied with) controls identification and testing;

Align controls with organizational strategies:

• Improve techniques for maintaining current process documentation, risk and control linkages, and

testing amid global and domestic changes

• Organize, streamline, and boost efficiency of internal control programs

• Improve corporate risk and compliance monitoring through software solutions

• Identify and remedy operational design and operating deficiencies

• Transition from internal control over financial reporting (ICOFR) to operational risk emphasis


QUESTIONS/COMMENTS?

audit risks / trends for colleges and universities june 2, 2015 mike stanley, c.p.a

Documents

current trends

students credit

public universities

leading universities

education technology

competition colleges

educational experience

college credit