What keeps you up at night?

1. What keeps you up at night? Nuala McGowan, Senior Manager for Compliance, Harvard University Michael Monaghan, Director of Financial, Operational & Compliance Audit, Harvard University NCURA, Financial Research Administration, New Orleans, March 10 – 12, 2013

2. Agenda • Introductions • Risks and risk management • What do you worry about? • How should I think about risk? • What can I do about it?

3. Introductions Nuala Michael

4. IntroductionsWhich of the following best describes your role? • Central Sponsored Research Administration Office • Department Grants Management • Department - other • Compliance Office • At wrong conference, I think

5. IntroductionsHow many years of research administration experience do you have? • Less than 1 year • 1-3 years • 3-5 years • 5-10 years • 10-15 years • Too many to count / >15

6. Risks and Risk Management • What is risk? • Risk Management “The hole is not at my end of the boat so I don’t have to worry…”

7. What do you worry about? Conflict of Interest Extra Comp Effort Reporting Cost Transfers Sponsor Reporting Cost Sharing Equipment Export Controls Admin Expenses Subrecipients Recharge Centers International Projects Other? T&E Expenses

8. The End Game - Residual Risk Heat Map Strengthen Controls Audit Controls High Risk Risk 1 Risk 3 Risk 2 Risk 4 Moderate Risk Risk 6 Risk 5 Low Risk Monitor Self Assess Weak Moderate Strong Management Controls

9. Risk Assessment - The Voting Process Three Elements: • Likelihood of occurrence • Impact of occurrence • Management control level - Inherent Risk Residual Risk

10. Risk Assessment Criteria Based on Risk Management Materials provided by KPMG/McGill University

11. Mean = Sample QuestionThe risk of a power failure midway through the Super Bowl leading to a game delay and disruption to television scheduling on an international scale. Impact • Insignificant • Minor • Moderate • Major • Extreme

12. Sample QuestionThe risk of a power failure midway through the Super Bowl leading to a game delay and disruption to television scheduling on an international scale. Likelihood • Rare • Unlikely • Moderate • Likely • Almost Certain Mean =

13. Mean = Sample QuestionThe risk of a power failure midway through the Super Bowl leading to a game delay and disruption to television scheduling on an international scale. Management Controls • Weak • Weak/Mod • Moderate • Mod/Strong • Strong

14. Mean = Effort ReportingThe risk that salaries charged, or effort committed, to federal awards do not reflect the effort or activity actually expended on respective awards leading to disallowed costs, fines and penalties • Insignificant • Minor • Moderate • Major • Extreme Impact

15. Effort ReportingThe risk that salaries charged, or effort committed, to federal awards do not reflect the effort or activity actually expended on respective awards leading to disallowed costs, fines and penalties Likelihood • Rare • Unlikely • Moderate • Likely • Almost Certain Mean =

16. Mean = Effort ReportingThe risk that salaries charged, or effort committed, to federal awards do not reflect the effort or activity actually expended on respective awards leading to disallowed costs, fines and penalties Management Controls • Weak • Weak/Mod • Moderate • Mod/Strong • Strong

17. Mean = Cost TransfersThe risk that unallowable or unallocable costs are transferred to a federal sponsored award leading to disallowed costs, additional audit scrutiny, fines and penalties Impact • Insignificant • Minor • Moderate • Major • Extreme

18. Cost TransfersThe risk that unallowable or unallocable costs are transferred to a federal sponsored award leading to disallowed costs, additional audit scrutiny, fines and penalties Likelihood • Rare • Unlikely • Moderate • Likely • Almost Certain Mean =

19. Mean = Cost TransfersThe risk that unallowable or unallocable costs are transferred to a federal sponsored award leading to disallowed costs, additional audit scrutiny, fines and penalties Management Controls • Weak • Weak/Mod • Moderate • Mod/Strong • Strong

20. Mean = Recharge CentersThe risk that rate schedules are based on inaccurate or incomplete financial information or are not consistently applied leading to the overbilling of federal awards and non-compliance with University policy and federal requirements Impact • Insignificant • Minor • Moderate • Major • Extreme

21. Recharge CentersThe risk that rate schedules are based on inaccurate or incomplete financial information or are not consistently applied leading to the overbilling of federal awards and non-compliance with University policy and federal requirements Likelihood • Rare • Unlikely • Moderate • Likely • Almost Certain Mean =

22. Mean = Recharge CentersThe risk that rate schedules are based on inaccurate or incomplete financial information or are not consistently applied leading to the overbilling of federal awards and non-compliance with University policy and federal requirements Management Controls • Weak • Weak/Mod • Moderate • Mod/Strong • Strong

23. Mean = Administrative ExpensesThe risk that unallowable and / or unallocable administrative salaries and expenses are charged to federal awards leading to disallowed costs, fines and penalties Impact • Insignificant • Minor • Moderate • Major • Extreme

24. Administrative ExpensesThe risk that unallowable and / or unallocable administrative salaries and expenses are charged to federal awards leading to disallowed costs, fines and penalties Likelihood • Rare • Unlikely • Moderate • Likely • Almost Certain Mean =

25. Mean = Administrative ExpensesThe risk that unallowable and / or unallocable administrative salaries and expenses are charged to federal awards leading to disallowed costs, fines and penalties Management Controls • Weak • Weak/Mod • Moderate • Mod/Strong • Strong

26. Mean = Sponsor ReportingThe risk that financial and / or technical reports are not submitted timely leading to funding / payment delays Impact • Insignificant • Minor • Moderate • Major • Extreme

27. Sponsor ReportingThe risk that financial and / or technical reports are not submitted timely leading to funding / payment delays Likelihood • Rare • Unlikely • Moderate • Likely • Almost Certain Mean =

28. Mean = Sponsor ReportingThe risk that financial and / or technical reports are not submitted timely leading to funding / payment delays Management Controls • Weak • Weak/Mod • Moderate • Mod/Strong • Strong

29. Mean = International ProjectsThe risk that international sponsored research projects do not comply with University policies and sponsor and / or national requirements leading to regulatory non-compliance, potential funding losses and reputational damage Impact • Insignificant • Minor • Moderate • Major • Extreme

30. International ProjectsThe risk that international sponsored research projects do not comply with University policies and sponsor and / or national requirements leading to regulatory non-compliance, potential funding losses and reputational damage Likelihood • Rare • Unlikely • Moderate • Likely • Almost Certain Mean =

31. Mean = International ProjectsThe risk that international sponsored research projects do not comply with University policies and sponsor and / or national requirements leading to regulatory non-compliance, potential funding losses and reputational damage Management Controls • Weak • Weak/Mod • Moderate • Mod/Strong • Strong

32. Mean = Sub-recipient MonitoringThe risk that subrecipients do not conduct research in compliance with laws, regulations and terms and conditions of awards and subawards and that project costs incurred are not reasonable and allowable Impact • Insignificant • Minor • Moderate • Major • Extreme

33. Sub-recipient MonitoringThe risk that subrecipients do not conduct research in compliance with laws, regulations and terms and conditions of awards and subawards and that project costs incurred are not reasonable and allowable Likelihood • Rare • Unlikely • Moderate • Likely • Almost Certain Mean =

34. Mean = Sub-recipient MonitoringThe risk that subrecipients do not conduct research in compliance with laws, regulations and terms and conditions of awards and subawards and that project costs incurred are not reasonable and allowable Management Controls • Weak • Weak/Mod • Moderate • Mod/Strong • Strong

35. Mean = Export ControlsThe risk that export-controlled information, materials or items are transferred overseas or to a foreign national without the required approvals / licenses leading to civil and criminal penalties and reputational damage Impact • Insignificant • Minor • Moderate • Major • Extreme

36. Export ControlsThe risk that export-controlled information, materials or items are transferred overseas or to a foreign national without the required approvals / licenses leading to civil and criminal penalties and reputational damage Likelihood • Rare • Unlikely • Moderate • Likely • Almost Certain Mean =

37. Mean = Export ControlsThe risk that export-controlled information, materials or items are transferred overseas or to a foreign national without the required approvals / licenses leading to civil and criminal penalties and reputational damage Management Controls • Weak • Weak/Mod • Moderate • Mod/Strong • Strong

38. Mean = Travel and Reimbursement ExpensesThe risk that unallowable or unallocable travel and reimbursement expenses are charged to a federal award leading to disallowed costs, additional audit scrutiny, fines and penalties Impact • Insignificant • Minor • Moderate • Major • Extreme

39. Travel and Reimbursement ExpensesThe risk that unallowable or unallocable travel and reimbursement expenses are charged to a federal award leading to disallowed costs, additional audit scrutiny, fines and penalties Likelihood • Rare • Unlikely • Moderate • Likely • Almost Certain Mean =

40. Mean = Travel and Reimbursement ExpensesThe risk that unallowable or unallocable travel and reimbursement expenses are charged to a federal award leading to disallowed costs, additional audit scrutiny, fines and penalties Management Controls • Weak • Weak/Mod • Moderate • Mod/Strong • Strong

41. Mean = Equipment ManagementThe risk that equipment management policies and procedures and associated records do not comply with federal requirements leading to audit findings and additional federal scrutiny Impact • Insignificant • Minor • Moderate • Major • Extreme

42. Equipment ManagementThe risk that equipment management policies and procedures and associated records do not comply with federal requirements leading to audit findings and additional federal scrutiny Likelihood • Rare • Unlikely • Moderate • Likely • Almost Certain Mean =

43. Mean = Equipment ManagementThe risk that equipment management policies and procedures and associated records do not comply with federal requirements leading to audit findings and additional federal scrutiny Management Controls • Weak • Weak/Mod • Moderate • Mod/Strong • Strong

44. Mean = Cost SharingThe risk that cost sharing commitments are not fully accounted for and tracked leading to non-compliance with award terms and inflation of overhead costs Impact • Insignificant • Minor • Moderate • Major • Extreme

45. Cost SharingThe risk that cost sharing commitments are not fully accounted for and tracked leading to non-compliance with award terms and inflation of overhead costs Likelihood • Rare • Unlikely • Moderate • Likely • Almost Certain Mean =

46. Mean = Cost SharingThe risk that cost sharing commitments are not fully accounted for and tracked leading to non-compliance with award terms and inflation of overhead costs Management Controls • Weak • Weak/Mod • Moderate • Mod/Strong • Strong

47. Mean = Extra CompensationThe risk of unauthorized and non-compliant extra compensation payments to faculty and research personnel charged to federal awards leading to disallowed costs and audit findings Impact • Insignificant • Minor • Moderate • Major • Extreme

48. Extra CompensationThe risk of unauthorized and non-compliant extra compensation payments to faculty and research personnel charged to federal awards leading to disallowed costs and audit findings Likelihood • Rare • Unlikely • Moderate • Likely • Almost Certain Mean =

49. Mean = Extra CompensationThe risk of unauthorized and non-compliant extra compensation payments to faculty and research personnel charged to federal awards leading to disallowed costs and audit findings Management Controls • Weak • Weak/Mod • Moderate • Mod/Strong • Strong

50. Mean = Conflict of InterestsThe risk that personal/family relationships and dealings with third parties are not fully disclosed or resolved leading to research integrity challenges and negative publicity Impact • Insignificant • Minor • Moderate • Major • Extreme