back to basics - association of college & university

I V o l u m e 5 2 I N u m b e r 3 I S P r I N G 2 0 1 0 I

Back to BasicsINSIDE:New Auditor Training: How to Get Students up to Speed

So You Have To Make A Presentation

Interviewing: How to Interview Like You Like IT

Internal Controls: Back to Basics

College & University AUditor

Features aCuaLiFe4 Meet your ACUA Board Members: vijay Patel and george thomas dwyer ByDonnaL.Stapleton

5 ACUA-l etiquette

internaLauditOrganizatiOn7 new Auditor training: How to get students up to speed ByMelHudson-Nowak

internaLauditPraCtiCes9 so you Have to Make A Presentation ByRandyeKaye

13 interviewing: How to interview like you like it ByRansomMcClung

HigHereduCatiOn16 internal Controls: Back to Basics ByMarkPaganelli

dePartments1 From the editor 2 From the President 3 From the executive director

ACUA members are invited to submit letters and original articles to the editor. go to www.acua.org and click on the FAQ and Publication for further guidelines. Please send your copy electronically to the editor or ACUA in Word 95 (or higher) or text file format. the editor reserves the right to reject, abridge or modify any advertising, editorial or other material.

EditorJohn M. Fuchko, iii, MBA, CiA, CCeP BoardofRegents/[email protected](404) 656-9439

Contributing EditorsACUA life: vacantinternal Audit organization: Claire sams Milligan, AlabamaDepartmentofPostsecondaryEducationinternal Audit Practices: Amy Hughes, MichiganTechnologicalUniversity Higher education: Michael J. Foxman, UniversitySystemofGeorgiaColumns: sterling roth, GeorgiaStateUniversity

Copy EditorsACUA life: Brenda Mowers, MontanaStateUniversity–Bozeman donna stapleton, TechnicalCollegeSystemofGeorgiainternal Audit organization: david dixon, GovernorsStateUniversityinternal Audit Practices: vacant Higher education: Mary Ann MacKenzie, AuburnUniversityColumns: Beverly Hawkins-llewellyn,TheUniversityofMontana

ACUA Managementstephanie newman, ExecutiveDirector

College&UniversityAuditoris the official publication of the Association of College & University Auditors. it is published three times a year as a benefit of membership. Articles in College&UniversityAuditorrepresent the opinions of the authors and do not necessarily represent the opinions of governance, members or the staff of the Association of College & University Auditors. Acceptance of advertising does not imply endorsement by ACUA. ©2010 Association of College & University Auditors.

Send address changes to: ACUA Po Box 14306lenexa, Ks [email protected]

COntentsS P R I N G 2 0 1 0

http://www.acua.org

mailto:john.fuchko%40usg.edu?subject=

mailto:ACUA-info%40goamp.com?subject=

mailto:[email protected]

Our spring 2010 CandU Auditor theme is “Back to Basics.” Every internal auditor, whether staff auditor or chief audit executive, is expected to understand the fundamentals associated with effective internal auditing. Internal auditors are not alone in the expectation that every professional understand the fundamentals. As a military officer, I know that every Soldier (from Private to General) is expected to understand the fundamentals of “Shoot, Move, Communicate.” This edition of the journal provides

some excellent “re-introductions” to important fundamentals of our profession.

Brief Overview and future issuesOur ACUA Life section includes letters from ACUA President Mark Paganelli and ACUA Executive Director

Stephanie Newman. Mark was quite prolific in his writing for this edition in that he also volunteered to write an article! Donna Stapleton provides us a brief personal introduction to Vijay Patel and Tom Dwyer. The ACUA Life section is wrapped up with a short article summarizing some of the finer points of ACUA-L etiquette.

Our remaining articles are detailed and informative. Ransom McClung’s article on interviewing is an excellent introduction to the topic of interviewing. This article is definitely one that you will want to add to your “smart book” of internal audit references. Ransom’s article is well-organized and eminently usable.

Regular ACUA conference presenter and CandU Auditor author Randye Kaye wrote an informative and entertaining article on how to deliver a high-impact presentation. Randye peppers her article with great stories, examples, and even some visuals that should drive the “high-impact presentation”

point home. This is another article to keep handy before delivering that next presentation to the Audit Committee or to auditees at the Exit Conference.

Mel Hudson-Nowak, CandU Auditor’s senior con-tributor, provides her insight on how to provide some basic training (not to be confused with boot camp) for beginning auditors and audit interns. Mel also offered to share her courses on a by-request basis – I strongly recommend taking her up on this offer.

Finally, Mark Paganelli provides a thorough and informative piece on the history and current state of internal controls. Before reading his article – ask yourself: “What are the five components of internal controls from the original COSO publication?” Can’t remember? This article is worth reading even if you can remember the five components; however, it is an excellent introduction to the topic if the original internal control framework has always proven a little elusive.

We continue to seek authors for our upcoming editions. Our summer 2010 edition due date for articles is July 16. Published authors of professional content articles may be awarded CPE credit by ACUA for your efforts. Contact me for additional information. Our theme for the summer 2010 issue is “Strategic Risks.”

a LittLe HeLp frOm my friendsFinally, the CandU Auditor is still looking for two additional volunteers. One, we need an online editor who can facilitate the development of our online presence. Next, we need a deputy editor who can assist me in my editor duties. Ideally, the deputy editor will be prepared to assume the role of Editor at some point during late 2010. n

A “Basic” theme – Basically

LETTER FRoM

tHe editor

This edition of the journal

provides some excellent

“re-introductions” to

important fundamentals of

our profession.

By John M. Fuchko, iii, MBA, CiA, CCeP, editor

College & University AUditor 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 3 2 1

Reduce travel, freeze hiring, no pay increases, we are taking your vacant positions, and oh, by the way, we need you to audit the millions in stimulus money. Plus, we need more operational audits to assist in improving efficiencies so that we can save money. Sound familiar? Unfortunately, one or more of these has likely happened to your office in the last year. When personal finances are reduced, we often go back to the basics. It is also great time to revisit some of the basics in your office during these tough times. The Institute of Internal Auditors (IIA) defines internal auditing as:

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.

The good thing about a down economy is that man-agement is likely to ask a strong internal audit department to assist them with the tasks that are basic to our profession. If not approached, it is an excellent opportunity to shine, demonstrate the

value of internal auditing in improving operations and controls, and to reduce risk. During a tough economy, management may consid-er streamlining operations, out-sourcing, and reorganizing. Auditors with a solid, basic skill set can advise on the internal control

implications of these decisions and the potential risks involved.

A recent IIA survey indicated fraud occurrences have increased significantly since the financial crisis of 2008, and internal auditors were identified as the number one function responsible for managing the day-to-day operations of the organization’s fraud program. This is another great opportunity to add value and improve controls at your institution. Management is much more likely to be interested in protecting assets this year than two years ago. Likewise, they will be much more interested in risk assessment, identifying strategic risks they will be facing during tough economic times, and the mitigating controls that need to be in place.

To assist you in improving your skill set and adding value to your institution, ACUA continues to look for ways to provide must-have training and camaraderie with fellow internal auditors and to promote the value of internal auditing in higher education. To accomplish this, ACUA has returned to basics and plans to spend the next year focusing on quality training at reasonable prices and improving other member services such as the webpage, ACUA-L, and the Journal. We realize that ACUA-L is vital to our members and feel we have found a fix for the recent problems encountered. Mr. Phil Hurd, Director of Internal Auditing for the Georgia Institute of Technology, and the web committee task force, are redesigning the webpage, which will improve information provided to members. Mr. John Fuchko, Chief Audit Officer for the University System of Georgia, has devoted this entire issue to basic audit skills necessary to be a successful auditor in higher education. On the training side, Ms. Toni Messer from UT Dallas oversees several volunteers involved in this effort. Mr. Jim Sleezer, Audit Supervisor with Oklahoma State University, does an outstanding job locating webinar speakers and coordinating these with our sponsor, EthicsPoint. For conferences, Ms. Edwina Greer, Director of Internal Audit at East Tennessee State University, and her track coordinators are busy filling up the training sessions for the Annual Conference in Baltimore. Ms. Sandy Jansen, Assistant Chief Audit Executive for Texas Tech, has just completed a great mid-year conference and will soon begin planning for next year. Be sure to let her know of topics you wish to have presented. Last but not least, ACUA has taken advantage of the economic downturn by finalizing contracts for future conferences. Our 2011 Annual Conference will be at the recently renovated Tropicana hotel in Las Vegas with a room rate of $109, and the 2012 mid-year will be at the Omni in Charlotte, North Carolina, at a room rate of $139. I have asked ACUA’s management team to look into future sites, since it is currently a buyer’s market.

I greatly appreciate the work from all of the ACUA volunteers. Even in challenging economic times, tremendous opportunities exist for auditing in higher education. We, in ACUA, are doing all we can to help you take advantage of them. n

Back to Basics

LETTER FRoM

tHe President

By Mark Paganelli, CPA, CiA, President

Even in challenging

economic times, tremendous

opportunities exist for auditing

in higher education.


LETTER FRoM

tHe eXeCUtive direCtor

Back to basics – fundamentals – a starting point – forming a base – a foundation. All of these words describe the process that ACUA has been engaged in over the past year. The transition to a new management firm, in addition to the downturn in the economy, has presented excellent opportunities for the association to re-evaluate where it is and where it wants to go in the future.

AMP Management Services has served as ACUA’s management firm for a little more than a year now.

Just as ACUA’s members serve their institutions by assisting them with streamlining operations and controls and reducing risk, ACUA’s staff serves that function for the association. The staff has spent the last year becoming familiar with all aspects of the operations of the association and working with the Board to identify existing areas that can be strengthened and new areas to explore. They are also identifying current and emerging areas

of risk and working to find solutions to reduce those risks.

The primary focus has been on identifying ways to provide current services in a more cost-effective way. For example, the staff is working with conference hotels to which ACUA was already contractually obligated to re-negotiate more favorable terms based on current realities. By doing this, ACUA was spared approximately $40,000 in penalty fees from the last Midyear Conference and a similar amount was saved by re-thinking some processes for the Annual

Conference. In addition we have been working to determine the areas we need to invest in to lay the foundation for the future. Re-design of the website should provide numerous opportunities both immediately and into the future to expand the products and services that we are able to offer members. While those two areas have been the most visible, we have also been examining ACUA’s partnerships, volunteer development, membership structure, benefits, products and educational offerings to discover what is working well and where there is room for improvement. These are all ongoing tasks that have simply been made more urgent in light of the current economy and the opportunity of a fresh start with a new management firm.

In addition to getting back to basics in managing ACUA, the staff is getting back to basics regarding how we manage all of our associations. AMP Management Services is working on some ways to streamline and restructure to improve how the staff is able to serve ACUA members. Staff members regularly participate in continuing education and networking with our colleagues in association management so that we are abreast of the latest trends in the industry and can benefit our clients with that knowledge. Staff teams are spending focused time to re-think processes to get work done more efficiently and increase communication.

Revisiting the fundamentals from time to time, whether voluntarily or dictated by circumstances, provides an important opportunity to re-evaluate, re-group and launch ourselves into a better future. n

Back to Basics from Universities to the executive office

By stephanie newman, executive director

As always, feel free to

contact the Executive Office

at [email protected]

with any questions or

concerns. We’re here to

help.


mailto:acua-info%40goamp.com?subject=

You have slowly been able to meet our current board members

through this section of the journal. This time we are going to introduce you to two more members– Vijay M. Patel, Secretary/Treasurer, and George Thomas Dwyer, Board Member-at-Large.

viJay pateLVijay M. Patel is the Director of the Office of Internal Auditing for the University of Southern Mississippi. Vijay has been in this position since 2000, was a Senior Internal & Information Systems Auditor from 1996 to 2000, and a System Design & Information Analyst from 1993 to 1996. Vijay has over 21 years of experience within the education field and over 14 years in accounting/auditing.

He has been very active with ACUA and has also served at a Board Member-at-Large and as the Chair for the Membership Committee from 2006 through 2009. He has a BS in Computer Science and Statistics and a BSBA in Accounting. He is a Certified Fraud Examiner, a Certified Information Systems Auditor, and a Certified Public Accountant.Vijay was born and raised in England and came to the States in 1981. Although currently single, Vijay has a 21-year-old son – Alkesh – who is currently attending Southern Miss as a pre-med Student and who plans on attending The University of Alabama to pursue his M.D.

When asked to describe something that most members might not know about him, Vijay stated that everyone already thought he was crazy and that they may be right. He also told us that he had wanted to pursue a career as a Chemist or Pharmacist when he was still in England.

He really wants the ACUA membership numbers to grow both domestically and especially internationally. He also wants to strive to make ACUA the primary information provider for higher education internal auditors. Well, no hope or dream is ever too high – we just all need to help him in this quest.

tOm dwyerGeorge Thomas Dwyer is currently a Board Member-at-Large and has also been a Conference

Speaker in the past. He is the Assistant Director of Audit & Management Advisory Services for Syracuse University. He has been in the education field for over 16 years and in the Accounting/Auditing area for over 24 years.

Tom was raised in a house with his parents, four siblings and his grandparents. He was very involved in sports as he grew up, and if not in an organized group, then he was hanging out with a group of 15-20 neigh-borhood kids and play-ing a pickup game on most weekends. He has been married to his wife, Joan, for over 22 years and they have two children, Ted (15) and Haley (12). Tom is able to continue his love of sports through his children as they are both involved in multiple sports throughout the year.

Tom’s answer to something that the members might not know about him was that he has never drunk a cup of coffee (wow) and that he is slightly ambidextrous. He is able to perform small motor skills right handed and large motor skills with the left.

Tom’s hopes for ACUA are that we have at least another 50 years of continued success and excellent service to all higher education auditors. He also hopes for the implementation of a new website that will be able to further assist ACUA in providing pertinent services to the members. He feels that members can get the most out of our organization by communicating with each other and establishing all forms of relationships. This will allow each of us to further our knowledge of internal auditing within the higher education realm. Tom feels that we can usually find answers to almost anything within our field somewhere in “ACUA land,” from others who have been there and sought answers to the same questions or situation, and from those have access to the correct regulatory references, operational procedures, or audit programs in general.

Until next time—these are your Board Members! n

Meet Your ACUA Board Members: Vijay Patel and George Thomas DwyerBy Donna L. Stapleton, ACUA Life Copy Editor

ABoUT THE AUTHoR

Donna L. Stapleton is the Internal Auditor for the Technical College System of Georgia. She is one auditor responsible for 26 technical colleges with over 50 total campuses throughout the state. Donna has only been an auditor for the past two years and has only been involved with government accounting for that same amount of time. She spent her previous career in the private sector working as a Plant Accountant, Accounting Manager and Controller – mostly in the manufacturing field. Her forte’ has always been her ability to go into companies with severe problems in their accounting departments and clean them up – a good transition point for internal auditing. She is divorced with two sons, one of whom is a chef and the other is a student at the University of West Georgia.

He really wants the ACUA

membership numbers to

grow both domestically and

especially internationally.

– Vijay PatelTom’s hopes for ACUA

are that we have at least

another 50 years of

continued success and

excellent service to all

higher education auditors.

– Tom Dwyer


AC

UA

Lif

e

Because communication and camaraderie among peers are some of ACUA’s most important core values, now seems like a

good time for a reminder about ACUA-L Etiquette.

dOs• Contribute. Members have a wide range

of experiences, knowledge, and skills that can assist others.

• Postings to the listserv should be sent to [email protected].

• Include a signature block. Identifying yourself is a common courtesy to others. Concealing your identity or affiliation may be unfair to the readers, especially if you are presenting an evaluation of a product, service or survey.

• Use clear and descriptive subject lines to aid members in the management of their

e-mail accounts as well as ease of locating items in the archive.

• Be professional. Please be respectful to others in your reply with constructive advice or data.

• If a post has requested direct responses to a survey, please do so. If you request direct responses to a survey, please summarize those responses to the list in a timely manner.

• Exercise patience with others in their questions and their replies. All of us have different backgrounds, ethnicity, education, skills, experiences and talents. Be appreciative of this diversity in the responses and interactions among the members.

dOn’ts• Post non-internal audit, non-higher education,

or non-ACUA business.

• Post private or personal matters regardless of their relation to internal audit.

• Allow jokes to clutter ACUA-L.

• Solicit personal business, sell products or advertise. Members may respond to a request for supplier information off the list by sending an individual e-mail to the requestor.

• Post unprofessional and/or disparaging remarks targeted against a person or special interest group.

• Post spam messages (junk e-mails, myths and urban legends).

• Publish copyrighted material to the list except as permissible under the “Fair Use” rules.

• Post creations of Web pages in an e-mail when a simple reference to the URL would provide the same information. Most web pages are copyrighted and you could be violating the law in your posting. It also saves our resources and limits possible out-of-date information.

• Post virus alerts to ACUA-L. Many such alerts are hoaxes and do more harm than good in wasting reader time and resources.

• Post chain letters or pyramid schemes to the list.

• Post information and messages from another listserv to ACUA-L without the prior permission of the author(s) of the message(s).

• Use sarcasm or other negative comments. Such behavior may also become an embarrassment to others on ACUA-L.

• Post questions or concerns about ACUA processes or procedures that can best be addressed by contacting the Executive Office or Board members directly, i.e., problems with ACUA-L or the website, problems registering for a conference, questions regarding why there is a certain process or procedure. The Executive Office staff and Board members are here to assist you and will address your question or concern promptly. If an issue comes to their attention that needs to be conveyed to the entire membership, they will take responsibility for doing so. n

ACUA-L Etiquette

Since communication and

camaraderie among peers

are some of ACUA’s most

important core values, now

seems like a good time for

a reminder about ACUA-L

Etiquette.


http://[email protected]/


Peddle bank accounts? Nope.

Profit from student data? Never.

Hold up your money? No way.

Help your school get PA-DSS compliant?

Absolutely!

Visit www.touchnet.com/enroll/pci-pa-dss/ to receive your FREE PCI-PA-DSS Solution Kit.

www.touchnet.com

http://www.touchnet.com

Inte

rnal

Aud

it

Org

aniz

atio

n

The Student Auditor Training ProgramBowling Green State University

Audit Basics

• Audit Documentation &

Internal Audit Office Orientation

Tech Skills

• Using ExcelWorkpaper Basics

• What is a Finding?

• Auditor Work outside of Audits

• Audit Engagement Planning

• Writing an Audit Finding

• Tech Skill Showdown: Analysis in Excel

• Using Access

• Getting to Know the CADB

• Using PowerPointWriting an Audit Finding

• Reconciliation Basics

• Basics of IT Controls

• Audit Professional Organizations & National Support

Using PowerPoint

• Tech Skills Showdown: Audit Planning in PowerPoint

Soft Skills

• Interviewing• Audit Standard Setting

• What Is Sampling?

• Attribute Sampling

• An Overview of Corrective Action

• Project Management

• Flowcharting

• Mastering the “One-Pager”

• Benchmarking

Case Studies – “In the News”

(continued on page 8)College & University AUditor 4 5 6 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 3 2 1 7

Audit directors have asked the same question since the dawn of the profession: how do you teach a new auditor the basics of the

job? And, while most directors would prefer to hire individuals who have learned the fundamentals through past experience and certification, sooner or later each one has been faced with hiring someone

who has all the raw skills, but does not know the first thing about how to perform an audit.

At Bowling Green State University our small staff relies heavily on part-time student audit assistants to supplemental full-time audit personnel. We found that although it was unrealistic and impractical to invest in a traditional

new auditor training program, on-the-job training alone failed to give students a sufficient basis for assigned tasks.

We decided that either the students would have to be provided with a formal training program or their work assignments would need to be simplified. Given our need to use student employees flexibly – and our commitment to student co-curricular learning – we decided to build a formal in-house training program. This article outlines the program, talks about lessons learned and provides a possible framework for creating a low-cost, high-value for new employees in any office.

prOgram specificsWho? Our program is designed for undergraduate upperclassmen with little or no prior audit experience. Each class is created and presented by a member of the full-time staff. At various times during each semester (“Tech Skills Showdowns”), the tables get turned and the students are required to present their work to the staff and invited visitors.

New Auditor Training: How to Get Students up to SpeedBy Mel Hudson-Nowak, MBA, CIA, Senior Contributor

ABoUT THE AUTHoR

Mel Hudson-Nowak, MBA, CIA, is the Director of Internal Audit at Bowling Green State University (BGSU), a position she has held since 2006. Prior to joining BGSU, she worked in various finance positions at Ford Motor Company, including an overseas assignment at Volvo Cars for Sarbanes-Oxley readiness. Mel has a BA from Smith College, an MBA from Michigan State and is a Certified Internal Auditor. Mel has previously served as both the Editor and the Internal Audit Practice Section Editor for the College and University Auditor. She is a regular contributor to these pages.

This article outlines the

program, talks about lessons

learned and provides a

possible framework for creating

a low-cost, high-value for new

employees in any office.


When? Student employees work shifts of 10-15 hours per week arranged around their class schedules. The first session, a 2-hour orientation, is independently scheduled on the first day of classes. After that, the remaining training courses are built into the regular staff meeting, the only time per week when we ensure that everyone is in the office together. Generally, courses are planned to last 30 minutes, allowing the remaining half of the staff meeting to focus on needed department communication.

What? The program consists of approximately 30 courses in four separate categories: Audit Basics, Tech Skills, Soft Skills and Case Study. This breakdown was utilized because it was felt that quality audit work requires a balance of audit know-how, technical skills in key software applications, soft skills in communicating and work management, and real-life learning from case studies. Although auditors in full-time positions may be able to pick up the technical and soft skills over time throughout their professional careers, we have learned that students do not necessarily have a strong foundation in these areas. That lack of exposure was impacting their success and we felt could be addressed by a handful of focused courses. Additionally, case studies were thought to provide a relevant connection to real-life situations and a way to enhance audit acumen in a quick and entertaining way.

Where? Classes were generally held in the Internal Audit conference room. We formalized the program by requiring each class to have a slideshow presentation, and leveraged campus audio visual resources to reserve a projector each week. A standard binder was provided, where each participant can retain the handouts and notes from each class.

LessOns LearnedDuring the first year, we learned a great deal about what works and what does not work in student training program. Overall, the program was a huge success, but there were a few success factors and limitations that merit focus.

Build It In

Each auditor has – at one time or another – cautioned an audit customer to build a control into the process rather than add it on top of the process. This advice was an important aspect of the success of the training program. The training program was an integrated part of a weekly meeting, and the listing of topics was prepared well in advance. Although there were a couple of weeks when the schedule changed, by and large the structure of the training ensured that the subject course was prepared and that it was held as planned. If we had attempted to build a stand-alone program, it is unlikely that it would have lasted throughout the year; day-to-day work would have inevitably taken priority.

Spread the Work

In a small audit shop, no one person can be the trainer. At the beginning of each semester, we took the planned training schedule and distributed the development of classes based on interest and existing knowledge. When necessary, we made assignment changes based on illness, vacation and other circumstances that arose. A common PowerPoint template was created so there no one felt obligated to make something fancy, and each person shared his or her

course with the other full-time staff members several days in advance so that feedback could be provided. Breaks were inserted when students were required to demonstrate their learning by presenting to us. In that way, the burden of training was spread equally and the result of the program was a shared success.

Make it Engaging

When we developed the framework for the program, we agreed that dialogue was an important part of the learning process. Because the students see our full-time staff as experts, we thought it would be unlikely that they would ask hard questions or insert their own ideas without help. So, we decided that each course would include some interactive component or exercise that the students would have to complete and discuss. We struggled in some courses to be true to that intent, but we held each other accountable for including something, and the courses with a strong exercise were definitely better than those with weaker ones.

Give and Get Feedback

After the first semester, we asked the students which classes were most beneficial, and toward the end of the second semester we asked them to comment on which sequence would be most useful. By looking at the program from the perspective of our students, we were able to gain important information about the changes that should in incorporated. We expect that those lessons will let us incrementally improve the program for next year, while still effectively leveraging the work we did this year.

using tHe framewOrkAlthough our program was designed to benefit our students, we found that the training materials were helpful for us as well. In the development of the course materials, we stumbled on useful guides and training resources we did not know existed or had forgotten. For example, our training on sampling uncovered “A Practical Guide to Sampling” out of the National Audit Office in the United Kingdom, and we cleaned up the “Excel Functions for Auditors” brochure for our tech skills class on Excel. Each class provided any opportunity to refresh our skills and discuss the core elements of the audit professions.

Although some of our modules were unique to our office process, (i.e., ‘Getting to Know the CADB’ focuses on using our internally developed corrective action database), most of the courses could be used to develop a comprehensive training program. Other offices could either combine modules into larger sessions if more time is available or pick and choose among other modules to focus on skills that need periodic attention.

In this first year, the upfront investment was high; however, we found that a basic new auditor training program was not as hard to develop as we would have thought. The benefits were remarkable, from having a team that shared a common well-understood lexicon to being able to provide our students with a practical skill set that they could display to recruiters. Our graduating senior, after speaking intelligently about her training and the real-life work she had done, landed an internal audit job at a Fortune 500 company and we could not be prouder.

If you’re interested in reviewing any of our courses, send an e-mail to [email protected]. n

(continued from page 7)

mailto:auditca%40bgsu.edu?subject=

ABoUT THE AUTHoR

Randye Kaye is noted Voice Talent for everything from corporations to video games. She uses her experience in radio broadcasting, stage acting and improvisation to teach communication and presentation skills, both privately and in Workshops. She helps events run smoothly as a corporate emcee, and believes strongly in the high value of face-to-face communication in this social media world. Randye is the author of “Ben Behind His Voices: One Family’s Journey Through Schizophrenia to a New Normal,” (Claire Cerus, author’s representative), and speaks frequently to groups about reducing stigma for the mentally ill and their families. Visit www.randyekaye.com or write to [email protected] for more info.

So – if you cannot get out

of it – how can you get

through it?

Inte

rnal

Aud

it

Pra

ctic

es


Have you ever seen one of those people, the ones who actually thrive on being the center of attention, who have the nerve to

appear entirely comfortable in front of an audience? Yeah, I know – for most of the population, it is impossible to imagine anything except terror when faced with the prospect of making a presentation. It does not matter if the audience consists of three people or three hundred – most of the world

considers any form of public speaking right up there on the stress meter next to facing a rattlesnake. This is not why you chose to work with finance and budgets!

Still, presentations are a necessity in most fields and, as a College or University Auditor, you may be called upon to inform departments about the process, field questions, calm fears, and eventually present your findings and recommendations. You may also have to make some sort of sales presentation at times.

So – if you cannot get out of it – how can you get through it?

The truth is that you may never love public speaking. We are born with different strengths, which means we really need each other in this universe. I, for instance, feel the panic whenever I have to work with a spreadsheet. Talking to an audience? Piece of cake. I am thinking you might feel just the opposite way.

The good news, though, is that we can learn from each other. With just a few lessons from someone whose brain is more in tune with organization and finance, I have actually learned to use QuickBooks. All I needed was someone to show me the process, and then I needed to practice until the fear and doubt diminished. In similar fashion, when you have learned the process behind a high-impact presentation, and applied it a few times, you will eventually feel more comfortable too.

These are the three vital aspects in presentations:

• Message – get it focused, clear and organized

• You – use and build upon your own strengths and personality

• Visuals – learn how they enhance the presentation, rather than star in it

step #1: messageThe best way to format your speech is to think backwards. What is your objective here? What do you want to accomplish? Answer this question first: When I am done with my presentation, I would like my audience to…….what? Know something (from a speech to inform)? Think differently (a speech to persuade or inspire)? Do something (a speech to activate)? This will become your purpose, your objective (some call it an elevator speech).

One you know your objective, it is time to work backwards and figure out how you will accomplish it.

Flesh the message out as you formulate– what are the important points you want your audience to hear? How will you introduce the topic? How will you conclude? This is like that good old “Thesis Statement” you had to do for your English 101 Professor in college:

• What point will you prove (Introduction)?

• Prove the point (Body of speech).

• Remind us how you proved the point (Conclusion).

I usually figure out the middle part first – find your supporting facts or main points. These can be illustrated or fleshed out with stories, statistics, quotes, or visuals. After you have the main points organized, you may find that one or two interesting things stand out – you can use one of these in your introduction, to get the audience’s attention, and inspire them to stick around and listen to what you have to say (if they have a choice in the matter).

Imagine the following opening:“Hi, my name is Fred Flintstone and it’s nice to be here. Thank you for taking the time to listen. To begin with, take a look at this chart.”

(….zzzzzzzzzzzzzzzz….and the sound of people tweeting)

So You Have To Make A PresentationBy Randye Kaye

mailto:www.randyekaye.com?subject=

mailto:randyekaye%40gmail.com?subject=

(continued on page12)College & University AUditor 4 5 6 7 8 9 11 12 13 14 15 16 17 18 19 20 21 22 3 2 1 10

Consider this opening:“What could your department budget do with an extra million dollars? By the end of this fiscal year, you can make this happen just by implementing a few changes in your structure. I’m here to show you how easily that can happen.”

Or: “Did you know that nine out of every ten University CFOs prefer Reese’s Pieces to M&M’s? This may come in handy when delivering difficult news.”

OK, you get the point. Openings are designed to get attention and set the tone for what you have to say. Conclusions sum up the main points, remind the audience what to take-away (and I don’t mean Chinese food), and sometimes tell them what next steps to take. You can spice up these “bookends” for your presentation with separate or connected (e.g., ask a question in the opening, answer it in the closing) stories, quotes, statistics, etc. After attention is paid, set some ground rules and expectations (e.g., “you may ask questions at any time,” “we’ll be covering the five most important steps your department can take to balance the budget this year,” and “please set your phasers to stun, just like Spock”).

Transitions between segments are vital as well. Make sure the audience knows that you have finished one point, and are moving to the next. A simple word or phrase like “The next step is…” will help set the framework. Frames are very comforting to your audience.

If your presentation is fairly short, you can talk through most of it. But adult attention spans are short, and getting shorter. If you will speak for a longer period of time, try to include something different, such as an audience interaction (show of hands, participation), a demonstration, or a chance for audience members to share with a neighbor.

#2. yOuOnce your speech is organized (write it, say it out loud, rewrite it, make sure the points are clear) – it is time to think about getting up there and saying it to actual people. There are many excellent resources about stage presence, and vocal and physical communication (I recommend Toastmasters as a wonderful, practically free way to learn and practice these skills), but the best advice I can give you is to be yourself, on a very good day. If you are naturally expressive, use that. If you are a quieter, more precise kind of person, use that skill. Do not try to be someone else – but do respect your audience enough to come to the podium prepared.

How will you present the info? The method you choose will determine how you will practice.

• Reading a prepared speech, word for word (not usually recommended, but at the very least, be so familiar with what you are reading that you can read it expressively and look at your audience as much as possible)?

• Using a basic outline, and filling in the gaps with your own conversational style (practice glancing at your outline, and have a basic idea as to how you will fill in those gaps)?

• Totally off-the-cuff (usually only for the very brave and experienced!)?

Nerves? Remember this: it’s about the audience, and the message, not about you. If you focus on your message, if you

remember that the audience needs the information, there is less room in your brain to stress about what the audience thinks of your manicure or if there is spinach on your teeth (just to be sure, check the mirror anyway).

But to get the most out of who you are naturally, stretch yourself until you are just a tad past the usual comfort zone (yep, just like at the gym). Always stand behind the lectern? Try moving around the stage, with purpose (such as to speak to the other side of the room) – just don’t wander or pace aimlessly. That is worse than standing still. Is your voice monotone? Try saying phrases with different tone, tempo, emphasis. Do not race through the speech. People’s brains need time to absorb what you have said. There is power in the well-placed and meaningful pause, and it sure beats saying “um” or some other vocal filler.

Now – practice. A lot. Practice may not always make perfect, but it sure does make you more comfortable.

Remember that it is not just what we say, but how we say it – with vocal and body language. If you walk up to the lectern with shoulders down, shaking in your boots, frowning with dread, you will have to work extra hard to impress your audience. Simple posture and expression changes – stand tall, walk briskly to the podium with a smile – make all the difference. To change your body language, change your thoughts. Try saying to yourself “I can’t wait to get up there and share this info!” – and say it until at least part of you believes it. You are what you pretend to be …well, at least that’s what they tell me in acting class. Trust me, it is often true.

There was a study where very shy people were given an assignment to go to a party and do three actions of not-shy people: find out the names of 5 folks you never met, ask 3 people what they do for a living, etc. Armed with the security of an assignment, this was not too hard for the subjects. The result? They still felt shy, but most of the partygoers perceived them as outgoing. It is the actions, not the inner doubts, that create the impression. So act as if you love to make presentations! Allow your face and body to help you deliver the message.

#3. visuaLsVisuals are meant to be spice, not substance. Flip charts: still great for small groups. Props: can be very effective. PowerPoint gets the Oscar for most overexposed and incorrectly used visual.



http://www.audimation.com



Lots of tips regarding PowerPoint, but here is the main thing: Your PowerPoint slide is not really designed to serve as your speaker notes in a big enough font so you do not need reading glasses. Most people use wayyyyyy too many words on the slides, and then turn their backs on the audience to read the slides to them. Yikes!!! No, no, no. Sorry – I know it is easier than practicing your content, but the audience wants to hear you speak and explain, not read the words on the screen. Most of them can read – and will do so while you are busy trying to say something else.

I saw a speaker last week who printed the entire story he wanted to tell on the slide! A story! Our tribal storyteller ancestors would be very disappointed. Tell the story. If you want to, have an image, graph, or some main ideas in very large font on the slide to enhance your point. But, yep, to present effectively, you are going to have to get the audience to focus on you, and on how the information is presented by you.

And while we’re at it – keep the animation to a minimum. It does not add to the presentation to fly phrases in from the ceiling. It is simply a distraction. Keep it simple and interesting. Don’t change the slides every 10 seconds. This isn’t a filmstrip. Fonts? Two at the most, with design that reflects the tone of your presentation.

So that’s basically it: First of all, define and refine your message. Then – practice delivering it as your own best self – as many times as it takes to feel more comfortable, knowing that your message is important to your audience. Third, use visuals wisely and as an enhancer of the message.

Easier said than done, you say? Well, then here is where to go for more information, help, and practice:

Web – e.g., www.dummies.com has PowerPoint info

Toastmasters – www.toastmasters.org – find a meeting near you, or start a club

Classes – your local continuing education center, community colleges

YouTube – Observe great speakers – what makes them great?

Private Coaching – worth its weight in confidence – look locally, or contact coaches like me from the National Speakers Association – www.nsaspeaker.org

So you have to make a presentation? Prepare and practice, one step at a time. You may find yourself actually having fun! At the very least, you will be more scared of a rattlesnake. As it should be. n

http://www.dummies.com

http://www.toastmasters.org

http://www.nsaspeaker.org

http://www.CCHTeamMate.com

Let’s take a few minutes to go back a few years to our college days. Do you remember those accounting courses – intermediate, cost, and

governmental, to name a few? But, how many of you ever took a college course on basic interviewing techniques? I bet the answer to my question is “no.” Like me, you might have attended a brief introductory seminar on how to answer questions in

a job interview, but you never took a formal course on how to ask interview questions.

Now let’s return to today. All those accounting courses have certainly helped prepare you for your job. Nevertheless, the one vital skill we practice almost every day, but that is generally not taught in college, is

how to ask interview questions. To be successful in our jobs, we must know how to ask questions in an interview to elicit the information that we need. Your interview, if done correctly, can build respect and establish trust with the interviewee. We want a thorough, non-threatening, productive interview that is beneficial to both you and the interviewee. Overall, the whole purpose of a well-planned and well-executed interview is to have a person openly share the ideas and information needed to achieve your objectives.

So you now ask, “How I can create an open atmosphere of communication in my interview?” The answer to that question is – with thorough preparation and proper execution. Think of the interview as divided into various key stages. These key stages are:

1. Planning the Interview

2. Building the Relationship

3. Conducting the Interview

4. Documenting the Interview

Each stage has several components that help to ensure you conduct and document that successful interview. For each stage, let’s identify various fundamental components and review their role in the successful interview.

pLanning tHe interviewTime – A successful interview begins hours before the interview is held. A successful interview might require at least an hour or more to prepare while only taking only 30 or 40 minutes to conduct. Yes, an hour or more to prepare for a 30-minute interview. A well planned interview can result in the need information after 30 minutes. Think about everyone’s schedule. Few people have the time or the patience for a one or two hour marathon meeting. Remember to use your time wisely before the interview so no one’s work time is wasted at the interview.

Objectives – How do you prepare questions for a short 30–40-minute interview? First, decide on the interview objective(s). What information do I need? What are the key questions I need to ask? Questions for the interview should be driven by the answer to those questions. In other words, what information do I need to have obtained before completing the interview?

What resources do I already have that can help me focus on those key objectives which lead to my set of questions? The project’s audit or consulting program is the first and best place to start with question preparation. Look at the specific steps in the program for leads. In each step, there is a specific objective of the project which naturally leads you to an interview question. Another resource you can use to help develop your question is the annual office risk assessment, which documents why the project was selected for an audit or consulting project. Note each high-risk factor and develop a question or two to address the risk noted. Both the project program and the risk assessment can help focus attention on what key questions you need to ask. At a minimum, you can always fall back on: who, what, when, why and how.

Personality – Once you decide on the important questions to ask, you now need to know something about the person you interview. Here are a few questions you need to ask yourself. What is that person’s personality? Is the person a verbal or a non-verbal individual? Is the person known for telling the truth or one who is not truthful? Is the person known for helping auditors or stonewalling auditors? Does the person respond to humor or is the person

Interviewing: How to Interview Like You Like ITBy Ransom McClung, CPA, CFE, Cr.FA, CFF

Ransom McClung, CPA, CFE, Cr.FA, CFF, retired in April 2010 as the Director of Investigations and Training in the Office of Audit Services at Florida State University. Ransom currently teaches as an adjunct instructor in the Accounting Department at Florida State University. He teaches undergraduate classes in financial, cost, and managerial accounting, fraud examination, internal auditing, and forensic accounting. Ransom has certifica-tions as a CPA, CFE, Cr.FA, and a CFF. He has a Master of Science Degree in Criminology from Florida State University.

To be successful in our jobs,

we must know how to ask

questions in an interview to

elicit the information that we

need.


Inte

rnal

Aud

it

Pra

ctic

es

“all business?” If the person is known for not having a sense of humor, then jokes are best left out of the interview. The answers to these few questions should drive how you prepare and conduct the interview. As we all know from our past experiences with people, how you ask a question can determine what type of response you get. We want to ask questions that consider the person’s personality with the goal to get the best response possible.

So where do I find out that kind of information about a person’s personality? Possibly someone in your office can help you. Find out if someone has already interviewed that person. Seek out your office mates for help. Let the successes of your office mates’ previous interviews be the foundation for your successful interview.

Location – The location of the interview is also a factor to consider because we want the person as relaxed and open as possible. Should you therefore conduct the interview in your office or in the person’s office? For an information-gathering interview, the person’s office is acceptable. We are all more comfortable in our own office than someone else’s office. Of course, picking that location limits your ability to control any interruptions or office distractions, but the person’s comfort needs to come first. The interview goal and the type of questions you need to ask will guide your choice of interview locations.

Time – Besides the person’s personality, also consider the person’s work schedule. Does the person arrive to work at 7:00 am or 9:00 am? Does the person have a set lunch time? If the person always goes to lunch at exactly noon, it might be best to schedule the meeting early in the morning or later in the afternoon. If the person normally works till 4:00 pm, a 3:30 pm interview meeting may not allow enough time to conduct your interview. Schedule the interview time so that it will not be rushed or hurried.

BuiLding tHe reLatiOnsHipWe have now adequately prepared for the interview by developing focused questions and researching the person’s behavioral traits. So how can we conduct a meaningful interview?

Time – Be on time for the interview. You might even arrive a few minutes early to the interview. I like to leave my office with plenty of time to get to the interview away from my office. You never know what might happen. I recently went to interview someone for the first time. His office was listed in the University telephone directory as room 318. Guess what? Room 318 is the mailroom – all employees in that department have an office listed in the directory as room 318. Because I left early, I had plenty of time to find the person’s physical office. A simple act of being on time for the interview lets the person know that you respect that person’s time.

Introduction – Before entering the office, I always knock to get permission to enter, even if the office door is open. I show that person my respect for his area by asking permission to enter the office. The handshake is next. A solid handshake that is not overwhelming is best. During the handshake, I introduce myself and the purpose of my visit. I might even mention that the interview is only going to take 30 or 40 minutes. I, of course, also thank the person for the interview during the handshake. The questions are soon to come but first I need a few minutes to transition to the questions … kind of like a runner getting ready to run a race.

Transition – This part of the interview is before we ask those key questions. Runners always warm up before a race. The warm-up gets

them prepared for the race. It also serves as a time for the runner to get mentally prepared and physically relaxed. A successful warm-up helps to ensure a successful race. The transition phase is where you and the interviewee should be able to get mentally prepared and physically relaxed. You should use this time to develop a solid working relationship with the person. In this phase, you want to relax the person so the sharing of information in the interview will not be impaired. You might get the person talking about the person’s job, hobbies, or family. This part of the interview, however, should not be too long as we only have a limited amount of time to ask our questions. Some persons might derogatorily call this part of the interview the “small-talk” session and imply the session is not really needed or beneficial. Remember the “small talk” is a relaxation technique for both you and the interviewee. A relaxed person is a more talkative person.

cOnducting tHe interviewQuestions – Now let us get to the purpose of the interview. We will ask only six, at the most, open-ended questions during the meeting. We ask one question at a time and carefully listen to the person’s answer. We repeat the answer in our own words so that person can verify that our understanding of the response is correct. We usually ask first the non-threatening questions and we progress to the challenging questions later in the interview. It is also important in the interview that we do not judge the answer at this time. The time for judging the person’s response to our question is later back in the office when we have time to further review the response. Expressing our judgments on the spot can slow or even stop the conversation. Remember we are only gathering facts and impressions in this meeting—it is not an interrogation. Nevertheless, the act of suspending judgment does not mean that you cannot follow up on the person’s response, if needed, just tread lightly.

Body Language – We should also pay close attention to our own body language while asking questions. We want to have an open body posture facing the person. We want to make appropriate eye contact and sit up straight—this is not a time to be slouching. Just as important, we want to breathe! Breathing helps us to relax and this helps the interviewee to relax. Having an open posture, maintaining appropriate eye contact, and taking a breath, shows the person you are giving your full attention and energy to the interview. In short, we maintain with our hands, arms and legs the message that we are paying close attention to what is being said.

dOcumenting tHe interview So you have finished the interview, now what? Now is the time to document what was discussed in the interview. Is this part of the interview process, you ask. Of course it is. Remember that what you produce from your notes now become the official work paper for your project. I want to rush back to the office to organize my notes into a cohesive written document in order to get the best results from the interview. To accomplish this, I do not schedule back-to-back interviews. That arrangement only delays getting the first interview notes promptly transcribed into an organized document. You may



Co-sponsored by the Association of College and University Auditors

SAVE THE DATE! Register Today! 100 Seat Capacity!

GEORGIA 2010 CONFERENCE FOR COLLEGE AND UNIVERSITY AUDITORS Georgia Capitol Hill Campus

August 2-3, 2010

CONFERENCE PROGRAM16 CPE credits

$110 registration fee, if postmarked on or before July 10, 2010

Make check payable to “Board of Regents of the University System of Georgia;” indicate for “Georgia 2010 Conference for College and University Auditors” and mail to:

Attn: Tracy Pinnock Office of Internal Audit and Compliance

Board of Regents of the University System of Georgia 270 Washington Street, SW

Atlanta, Georgia 30334

LODGING Holiday Inn Atlanta Capitol Conference Center

Special $89.00 daily room rate and $15.00 daily parking rate expire July 10, 2010

BRAVES VS METS GAME – Aug 2, 7:10 PM LIMITED BLOCK SEATING tickets available in Golden Moon Pavilion @ $14 each Email Alex Ingle ([email protected]) and obtain tickets by July 10, 2010

Questions? Contact Tracy Pinnock: 404-656-2231 or [email protected]

even want to format the written notes from the interview into a narrative, into a question/answer format or even just bullet points. The format that is acceptable to you and that conforms to office practice is best. In many cases, however, we wait a day or two to make sense of our notes; this practice leads to inaccurate or incomplete interview notes being put into an official work paper document. It is easy to procrastinate in transcribing your notes, but remember, documenting an accurate and complete record of the interview as soon as possible helps to ensure that the time spent preparing and conducting the interview will be worth the efforts.

I have discussed some basic elements of a successful interview in this article. There are obviously other facets of the interview that I have not addressed. Nevertheless, the basic ideas introduced in this paper should give you a foundation from which to develop your interviewing prowess. Now that you have a basic framework to help you prepare your next interview—I suggest you try them. Maybe then you can say that you interview like you like it! n

Inte

rnal

Aud

it

Pra

ctic

es

Co-sponsored by the Association of College and University Auditors

SAVE THE DATE!

Register Today! 100 Seat Capacity!

GEORGIA 2010 CONFERENCE FOR COLLEGE AND UNIVERSITY AUDITORS Georgia Capitol Hill Campus

August 2-3, 2010

CONFERENCE PROGRAM

16 CPE credits (See attached program)

$110 registration fee, if postmarked on or before July 10, 2010

Make check payable to “Board of Regents of the University System of Georgia;” indicate for “Georgia 2010 Conference for College and University Auditors” and mail to:

Attn: Tracy Pinnock Office of Internal Audit and Compliance

Board of Regents of the University System of Georgia 270 Washington Street, SW

Atlanta, Georgia 30334

LODGINGHOLIDAY INN ATLANTA CAPITOL CONFERENCE CENTER (Link)

Special $89.00 daily room rate and $15.00 daily parking rate expire July 10, 2010

BRAVES VS METS GAME – Aug 2, 7:10 PMLIMITED BLOCK SEATING tickets available in Golden Moon Pavilion @ $14 each

Email Alex Ingle ([email protected]) and obtain tickets by July 10, 2010

Questions? Contact Tracy Pinnock: 404-656-2231 or [email protected]



https://resweb.passkey.com/Resweb.do?mode=welcome_ei_new&eventID=2546791

mailto:Alex.Ingle%40braves.com?subject=

mailto:tracy.pinnock%40usg.edu?subject=

ABoUT THE AUTHoR

Mark Paganelli, CPA, CIA, is the President of ACUA and is the University of Tennessee Executive Director of Audit and Consulting Services. He has held this position since 1999 and has been with the University of Tennessee since 1992. Mark previously supervised the investigative section for the Tennessee Division of State Audit. Mark holds a bachelor’s degree in accounting and a MBA. He is a Certified Public Accountant and a Certified Internal Auditor.


At ACUA’s annual conference in Louisville, Kentucky, I asked approximately 100 members attending my session on internal

controls to identify the five original components of an internal control system, and only Ms. Nur Erenguc, former internal audit director for the University of Florida, was able to do this. Subsequently, I asked a group of 300 state auditors to do the same and no one spoke up. I realize some may have known the answer and did not respond. I have taught a basic internal controls class to hundreds of auditors, business personnel, and others, and very few in the accounting profession have been able to identify these five components. This is important because the implementation of these interrelated components can help protect assets, ensure accurate financial reporting, and assist with compliance of many applicable laws and regulations, all of which preserve a university’s reputation. If the information is so vital, why is it not better understood? In an attempt to answer this question, I begin at the beginning.

The U.S. Foreign Corrupt Practices Act of 1977 (FCPA) criminalized transnational bribery and required companies to implement internal control programs. In response to the FCPA and the savings and loan scandal of the early 1980s, a national commission was formed to study fraudulent financial reporting. The commission identified factors that can lead to fraudulent financial reporting and made recommendations for reducing its occurrence. The commission was a privately led initiative sponsored by several organizations and was called the Committee of Sponsoring Organizations (COSO). COSO exists today and is comprised of most major accounting associations to include the Institute of Internal Auditors (IIA). In 1987, the commission issued a 198-page report, which identified 49 recommendations for reducing the likelihood of fraudulent financial reporting. The report notes that, even if all of the recommendations were implemented, financial statement fraud would still occur.

Following the issuance of the report, COSO continued to study fraudulent financial statement issues and produced numerous other reports and guidance. For example, a COSO document issued in 1992, “Internal Control–Integrated Framework,” was designed to establish a common definition for internal controls and standards for assessing and improving internal controls. This framework identified five interrelated components that

comprise an internal control system, thereby enhancing the reliability of financial reporting.

Since these publications were issued, however, financial statement fraud continued to grow even more prevalent. We have experienced Enron, WorldCom, and Tyco, among other corporate failures, due to poor internal controls and fraudulent financial statements. These failures resulted in legislation such as the Sarbanes-Oxley Act of 2002, which requires management to certify and the external auditor to attest to the effectiveness of a public company’s internal controls. As a result, COSO expanded its initial model to cover the associated risks throughout an organization and in 2004 issued “Enterprise Risk Management–Integrated Framework.” This publication expanded the number of interrelated components to eight and identified four entity-wide objectives to which the components should be applied: strategic, operations, reporting, and compliance.

Despite these efforts, fraudulent financial incidents continue, such as the Bernie Madoff scandal and similar Ponzi schemes. Although not entirely related to fraudulent activity, the entire U.S. financial system almost collapsed in 2009 because of a failure to understand enterprise-wide risks and to accurately convey these risks to stakeholders. Legislators and industry experts are currently drafting new guidance and legislation to help prevent another round of fraudulent financial reporting and/or industry collapses.

All of this may be good and necessary, but if people do not understand the basic components adopted almost 20 years ago, how effective will this new verbiage be? I am also mindful that I am basing my opinions on a career spent in the university and government environments, which are not subject to all of the federal legislation discussed above. I would also argue that the last year has shown past legislation and industry guidelines have not been extremely effective. Instead of creating new regulations, we should revisit the original COSO report to determine if it is relevant and has properly addressed the problems. I think if you changed the date on the 1987 report and re-issued it today, many of the recommendations and discussion would still apply.

Internal Controls: Back to BasicsBy Mark Paganelli, CPA, CIA

Before additional guidance

and regulations are created,

let’s go back to the basics

and find ways to simplify the

five internal control concepts,

improve the education process

for these concepts, and

improve the methods used to

communicate them.

tHe prOBLemThe original COSO report contains a section titled “Recommendations for Education.” In this chapter, the following comment is made:

Education can influence present or future participants in the financial reporting system by providing knowledge, skills, and ethical values that potentially may help prevent, detect, and deter fraudulent financial reporting.

The industry experts who created the COSO and supplemental reports recognized the importance of education in order for their recommendations to be successful. I would argue that the knowledge and necessary skills discussed in their documents have not been transferred and have largely been ignored for the following four reasons.

First, the formal training and careers of a large percentage of top financial executives began long before the COSO model was

adopted. Thus, to become knowledgeable of the topic required reviewing the 198-page document and supplemental publications. Although several companies and individuals have tackled this task and done quite well, I daresay an even greater number failed to understand the key COSO concepts or did nothing to implement them. In a university setting, where there are no federal requirements related to internal controls, the number would be even larger.

Executives are not intentionally ignoring COSO’s guidance, and one must consider the many technology changes, changes in financial markets, and other changes that have taken priority since COSO issued its 1987 report. The last two decades have seen more change in the financial area than possibly any other time in history. Accounting and auditing pronouncements once occurred every few years, and now industry professionals are bombarded with changes and with trying to keep pace with new areas such as derivatives, stock options, and a host of others. This is even true for the standards that govern most universities and colleges. Professionals are doing well to keep track of the areas specific to their expertise, much less industry-wide, broad-based changes suggested by COSO. Even the IIA, the American Institute of Certified Public Accountants (AICPA), and other organizations, which have done a great job of creating and providing guidance and training on internal controls, saw interest and enthusiasm wane in years before the Enron and MCI scandals. Only after these scandals did the federal government mandate through the Sarbanes-Oxley legislation that organizations were required to follow several components of the COSO model. This mandate did not apply to higher education, so we are even further removed from these changes.

The second reason COSO’s recommendations have not been widely implemented is that these principles can be costly and not always the most efficient method in which to operate. There is a cost to having proper controls, and millions have been spent as a result of Sarbanes-Oxley. The cost has not only been in identifying and documenting the control structure, but also in implementing additional controls that otherwise would have never been put into place. As most are aware, having appropriate controls and an enterprise risk framework can reduce risk. However, reducing risk is often difficult to quantify from a cost standpoint until after a risk event actually occurs. Furthermore, some would still argue that Sarbanes-Oxley is overkill and unnecessary. Thus, the individuals who attempted to implement COSO’s recommendations in the mid-1980s faced a very challenging road. Not many awards were given to CFOs who had implemented COSO’s recommendations. As auditors, we too are often faced with attempting to articulate the cost/benefit of implementing various controls.

Third, the accounting profession has not done a good job of educating the next generation of professionals on COSO’s concepts. The older generation has an excuse since they preceded this initiative, but the next generation of accounting, auditing, and financial executives is receiving little or inadequate training related to COSO. I have reviewed current auditing books at two universities, and the lengthiest discussion regarding COSO was about a half chapter. The accounting books used to train non-accounting majors contain even less discussion. The key to preventing financial statement fraud, understanding enterprise risk, and reducing losses has been identified but is not being taught to future professionals who will someday be responsible for implementing the financial controls. This is slowly changing, with books updated to include case studies of Enron, MCI, and Tyco; but, I am not sure COSO’s concepts or preventive steps will be emphasized enough in the material. It seems that, if the COSO document and its components are so important to the integrity of the financial statement and accompanying risks, entire classes should be devoted to it.

The final problem is that often the managers responsible for implementing internal controls do not have financial backgrounds and may have never heard of COSO. As internal auditors, we have been exposed to COSO and should be very familiar with its components. Internal auditors, however, are not responsible for implementing internal controls. We can point out deficiencies that exist throughout an organization, but if there is no interest, internal auditors will be of limited use. Management is responsible for implementing internal controls, and if not adequately trained or knowledgeable of this matter, they will not be successful.

As previously noted, the financial management of organizations has been bombarded with changes that have taken priority over COSO’s recommendations, and the non-financial work force will be even further

Hig

her

E

duca

tion

(continued on page 18)



removed from any exposure to COSO. Imagine if a new engineering principle had to be taught to an organization’s entire work force. What would be the interest among the financial staff? The CEO? Others? To address the issue and educate this group, the auditing profession has expanded the initial COSO guidance to emphasize that it relates to areas outside the financial arena, such as operations and compliance. This is useful in educating groups on internal controls and analyzing controls across large organizations, but does more need to be done?

Back tO BasicsIf education and communication are the problem, how do you make everyone from the president to the Board members to the faculty aware of the five basic internal control concepts and their role in implementing them? I will briefly discuss each of the five concepts below to help you better understand the information and hopefully this will enable you to communicate it to others within your institution.

Control Environment. If you ask a diverse group of employees to define control environment, you will get many answers. A control environment to faculty is different from that for the IT group, which is different from the one for accounting. This is probably the most important of the five controls. To communicate this across such a spectrum, a term that is easily understood and communicated must be used. I feel “Tone at the Top” is most commonly used regarding the control environment and is easily understood by most. The tone at the top concerns those in senior-level positions who have the greatest influence on the university’s culture and the type of behavior expected. This is probably truer in academic environments than in corporate America. You could visit any institution of higher education and ask several people about the president or chancellor and quickly learn the type of culture that exists. I have worked for the beloved president who knows everyone’s name and is well respected in the community and by the students and faculty. It is a pleasure to work in this type of environment, and the culture is one you do not want to disappoint based on your performance and/or actions. When people behaved unethically it was quickly addressed – which sent a message to others. Years ago, I worked one summer as a stock boy for Walmart. During the interview process, after I was told that I would be hired, the manager pointed his pen at me and said, “If you so much as steal a pen from here, you will be fired.” The message and tone were set from day one, and I still remember that conversation many years later. Such an environment is heaven for an internal auditor and where we can be most effective in assisting with implementing sound controls throughout an organization.

I have also experienced the opposite in university leaders who are arrogant, unethical, and place little or no emphasis on controls or the university’s best interests. They look for ways around existing controls, attempt to influence others to do the same, and are punitive to those who do not assist. In these situations, it is very difficult for an internal control structure to survive and is a challenging work environment for internal auditors. It has also been my experience that such behavior will divide the staff into those who will do whatever the president says in order to be perceived as a team player and those who attempt to do what is right and in the institution’s best interest.

Large frauds, normally, cannot be perpetrated solely by the CEO or the CFO. Either individual needs assistance and this assistance is usually provided by subordinates who want to be viewed as team players and often do not even benefit from their dishonesty. When employees are placed in these situations, it is important they have

options besides resigning. The internal audit department plays an important role in providing this option, thus encouraging a proper “tone” within the organization. Abuses by senior management are usually known by employees, and they must have the ability to communicate their concerns to the Board, who is responsible for supervising senior management. Although employees may contact Board members directly, they should also be given options through a well-publicized hotline and should be protected through anti-retaliation policies. Internal audit can play a role in administering the hotline and in communicating concerns to the audit committee of the Board. Audits of senior management’s expenses are another important role internal auditors can play in maintaining a proper tone at the top.

Although senior management can have the greatest influence on the tone in a culture of a college or university, all employees play a role, and it is important to communicate and nurture this tone. During a televised interview, former New York City Police officer Mr. Frank Serpico, who turned in his corrupt co-workers, stated in any organization that 5-10 percent of the employees are extremely honest and will do the right thing no matter what the environment. He added that the opposite is true, and another 5-10 percent will lie, cheat, or steal no matter what types of controls exists. He emphasized that the important part (which I believe to be true) is the remaining 80-90 percent who will be influenced by the culture and what is acceptable as right or wrong. The subordinate employees at Enron, WorldCom, and HealthSouth who assisted in these frauds were not former criminals. In most cases, they were probably good employees in a work environment that may have condoned and encouraged dishonest behavior. Likewise, individuals did not join the New York City Police Department because they were corrupt or dishonest but they may have found themselves in a culture where such behavior was the norm. From an internal audit standpoint, this is greatly important. Attempts should be made to identify, publicly recognize, and if necessary, protect the 5-10 percent who cannot be corrupted, especially when the proper tone is not established at the top. This will enable them to influence the “tone” at a level below the top of an organization.

Risk Assessment. Risk assessments have been performed in the insurance business for years. Although COSO recognized their importance over 20 years ago, they have only recently begun to be utilized by corporations and are truly in their infancy in higher education. If you plan to implement proper internal controls, it is essential to identify the most significant risks that threaten your institution. Numerous models exist, but these are the basic steps: 1) identify negative events or risks that can occur and rank the impact they will have on your institution and the probability they will occur, and 2) identify the controls in place to mitigate the risks. What is left is called the residual risk. From an internal audit standpoint, you should first focus your efforts on risks with a high impact, high probability, and inadequate controls.

Ensure that the assessment includes non-financial areas of your organization and that you think about the big picture, such as what can threaten the existence of your institution or its reputation. Recently, natural disasters have significantly interrupted operations for several institutions and endowment and other financial losses have significantly impacted the finances of universities large and small. Multimillion-dollar fines for non-compliance of federal research regulations are also a significant risk. Matters such as these should be indentified and ranked and should become the focus of internal audit efforts. Internal auditors can provide greater impact and assistance in these areas to the Board and senior management than simply reviewing controls at the departmental or college level would provide.



Which would have a larger impact, a bookkeeper stealing a thousand dollars or an institution’s assets being invested in an area that risks its ability to meet operating needs if the market moves in a certain direction? Is it riskier for travel expenses to be processed improperly or to not plan adequately for a campus disaster? In an ideal world with proper staffing, all of these would be addressed, but some effort should be given to address big picture risks. Since the implementation of internal controls is management’s responsibility, it is also crucial that the internal auditor make management aware of the importance of identifying and addressing the most significant risks.

Control Activities. This principle suffers from the same identity crisis as the control environment. I doubt many people will accurately define “control activities,” but everyone knows what policies and procedures are. Let’s not complicate matters and simply say that policies and procedures are necessary for a sound internal control environment. As auditors, we are very familiar with policies and procedures and use them often during audits to determine compliance with established controls. We are also frequently reviewing policies and procedures and we recommend modifications to strengthen and/or streamline existing controls. Policies and procedures are vital to detecting and preventing fraud and should cover such items as pre-numbered receipts, separation of duties, and routine reconciliations. Policies and procedures are also important in training and communicating with new employees regarding institutional practices and protocols. The larger the institution, the more vital this principle is. It is often more difficult to communicate with employees in a large organization, but updated policies and procedures and appropriate training can greatly assist with this process. If you want 80-90 percent of your employees to do the right thing, it helps if the right thing is documented in writing.

Information and Communication. This is probably the easiest principle to understand but the hardest to implement. Your institution may have a great leader who is ethical; you may have up-to-date and solid policies and procedures; and you may have identified the significant risks threatening your institution—but if all of this is not communicated throughout your institution you have not succeeded in establishing a sound internal control environment. The communication must reach all levels, which is probably more difficult in a higher education environment than in most other organizations. Reduced funding is a risk threatening most institutions. Imagine trying to communicate the impact of this risk to faculty, coaches, physical plant employees, students, and other staff. E-mail, the internet, and other electronic means assist with the majority of these audiences, but not all employees have access. Furthermore, how do you communicate an ethical culture to employees or even the constant policy changes related to increased regulations and other issues affecting organizations today? It is equally important that communication flow upward from staff, faculty, and students to senior management. There is no easy or correct answer, but communication must be continuous and must take many different avenues to ensure its effectiveness. From an auditor’s standpoint, we can assist by indentifying matters that are not being properly communicated and assist with these areas or recommend corrective action. Also, since we report to senior management and/or the Board and work with staff at all levels throughout the organization, we can serve as a valuable communication tool that both advises staff of expectations from senior management and also communicates staff concerns upward.

Monitoring. Next to the control environment or the “tone at the top,” monitoring is probably the most important concept. In my experience, whenever a fraud has been committed, regardless of the size, you can

Hig

her

E

duca

tion

Effective ERM and audit software solutions from Methodware• Selected by universities around the world• Easy to use and implement• We drive the ACUA Risk Dictionary

Risk Simplifiedudit software

hodwaresities

mplementA

www.methodware.com

point back to a lack of monitoring as a contributing factor. Most colleges and universities have existed for decades, if not centuries, and we have mature internal control systems. Unlike a small or startup business, such institutions have policies and procedures and forms that are approved by multiple parties and reports available for review at many different levels of management. Although internal controls can be bypassed through collusion, I can recall only one instance of this in the hundreds of investigations I have seen at institutions of higher education. In most instances, an individual determines that no one is monitoring his or her activities and tests the existing internal controls. If the fraud is not detected, the frequency and dollar amounts continue to grow. If neglected, internal control systems will become complacent over time and more vulnerable to theft or other abuses. Retirement, downsizing, outsourcing, and reorganizations all impact the role of monitoring.

If you wish to indentify financial losses to your institution, audit an outsourced function such as the bookstore, foodservice, or the book buyback. In almost every instance, we have identified a failure of university personnel to adequately monitor these contractors and the contractors failed to make payments in accordance with the contract. There is an old military phrase— “Inspect what you expect.” If these contractors determine from the onset that the contract terms are being inspected/monitored, they are more likely to comply. This is also true of employees at all levels within an institution. Top corporations are filled with stories of the company CEO visiting and monitoring the organization at the lowest level. In my days as a stock

(continued on page 20)



http://www.methodware.com

!We’ve changed (sort of).For over 30 years, you’ve known us as Beers + Cutler, a leading accounting and consulting firm serving higher education and research institutions nationwide. We have now joined forces with Baker Tilly. And while our name has changed, our level of commitment to our clients and people remains the same. Our team of professionals is dedicated to providing highly flexible and technical co-sourced internal audit resources to our clients.

Together with Baker Tilly, our combined industry expertise will provide greater resources and services to meet your internal audit, business advisory, assurance, and tax needs. We will continue to deliver specialized audits including technology, sponsored research, construction, and fraud risks into the future.

© 2010 Baker Tilly Virchow Krause, LLPBaker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed member of Baker Tilly International.

Accountants and Advisors

Connect with us: bakertilly.com

boy in a small-town Walmart, Sam Walden visited the store about twice a year. He requested to be picked up at the airport by a stock person, not the manager. Marriott Corporation is also filled with stories of Mr. Marriott visiting the housekeeping staff at their most remote locations. Middle management of both corporations knew to expect an inspection from senior management at some point. As auditors, we are constantly inspecting the institution at all levels and reporting our findings to appropriate parties. The frequency of our inspections, however, is not sufficient to be effective on a daily basis. This is why it is critical that we test the adequacy of the monitoring function in our audits and emphasize its importance to all levels. We constantly preach the importance of reconciling and reviewing ledgers

and receive pushback from all levels. This control, however, is one of the most critical financial monitoring steps throughout our institution, and we feel the battle is worth fighting. In several large frauds, we can point to a failure to monitor the ledgers as an existing control that would have detected the problem promptly.

In 1987, COSO created a relevant and sound report whose principles have never been fully implemented and are still valid today. Before additional guidance and regulations are created, let’s go back to the basics and find ways to simplify the five internal control concepts, improve the education process for these concepts, and improve the methods used to communicate them. n



http://www.bakertilly.com

Set Sail with ACUA!

ACUA Annual Conference – September 19-23, 2010 Marriott Waterfront – Baltimore, Maryland

ACUA is pleased to offer 2010 Annual Conference registration at the same price as 2009!

Registration

Registration will be open by June 1. Early registration ends August 9.

Early Member Registration - $870 Early Non-Member Registration - $1,020

Hotel Reservations

Baltimore Marriott Waterfront Hotel - $195 per night, single/double

Visit www.ACUA.org for program details, registration and hotel reservations.


http://www.ACUA.org


http://bit.ly/epcampus

http://www.ethicspoint.com

back to basics - association of college & university

Documents