Role of Internal Audit

1. Role of Internal Audit What does Internal Audit Look For?

2. Today’s Objectives • Provide a background of Internal Audit and what we do • Introduce and highlight basic points of the CU Policies and Procedures related to common expenses seen by Internal Audit during the review of P-Card and Travel & Expense Reports. • Highlight the importance of providing a sufficient business purpose for all expenses • Gain an understanding of how inappropriate expenses or insufficient business purposes may impact the reputation of the university. • Provide a background of Internal Audit’s role in fiscal misconduct investigations

3. Internal Audit Our Mission • Projects • Performance • Compliance • Consults • IT Investigations Risk Mitigation Risk Identification Governance Management Risk Management Risk Avoidance Advisory IA Five Year Strategic Plan Education Awareness

4. Our Stakeholders Board of Regents University Community Management Faculty & Staff Students Other Stakeholders Citizens Parents Donors Patients Colorado Government Officials Regulatory Agencies

5. Internal Audit Our Mission • Projects • Performance • Compliance • Consults • IT Investigations Risk Mitigation Risk Identification Governance Management Risk Management Risk Avoidance Education and Awareness Advisory IA Five Year Strategic Plan

6. Education and Awareness Present information on IA activities, internal controls, risk management, compliance, ethics, fraud prevention and sound business practices to the university community • Educational presentations • Informal sharing of information and resources

7. Projects • Performance • Compliance • Consults • IT Investigations Risk Mitigation Risk Identification Governance Management Risk Management Risk Avoidance • Projects • Performance • Compliance • Consults • IT Advisory IA Five Year Strategic Plan Education

8. What Is An Audit? • Most audits involve a comparison with some standard(s) or requirement(s) • The essence of auditing is measuring something against a good example to make a critical, evaluative judgment • Virtually all modern organizations engage auditors whose basic task is to provide assurance that the organization’s controls and operations are efficient and effective

9. Benefits of Strong Internal Controls • Improve efficiency and effectiveness of operations • Provide appropriate checks and balances • Reduce or prevent errors • Ensure significant risks are identified and addressed • Protect employees and resources • Comply with applicable laws and regulations

10. Risks of Weak Internal Controls • Erroneous Management Decisions - based on erroneous, inadequate or misleading information • Fraud, Embezzlement and Theft - by management, employees, customers, vendors or the public-at-large • Sanctions - penalties arising from failure to comply with regulatory requirements, as well as overt violations of the law • Excessive Costs/Deficient Revenues - expenses which could have been avoided, as well as loss of revenues to which the organization is entitled • Loss, Misuse or Destruction of Assets - unintentional loss of physical assets such as cash, inventory and equipment

11. Common Audit Findings

12. Expense Policy Training What does Internal Audit Look For?

13. Policies & Procedures • Will you be conducting business on behalf of the University of Colorado and submitting expense reimbursements (including attending conferences, participating in official functions, travel)? • Will you be approving reimbursement for expenses? Or preparing claims or processing payment? • For any of these conditions, it is your responsibility to become familiar with what is expected of you regarding expense reimbursements.

14. Policies & Procedures The University of Colorado has established guidance designed to protect both the University and its employees This guidance is documented in various forms and locations • Regent Laws and Policies • Administrative Policy Statements (APS) • Office of University Controller policies • Procurement Service Center (PSC) policies

15. Who “Owns” Policies & Procedures The Procurement Service Center (PSC) is responsible for maintaining and updating the PSC Procedural Statements for Travel, Official Functions, Sensitive Expenses and Undocumented Expenses. The Office of Policy and Efficiency is responsible for maintaining and updating the Administrative Policy Statement for Propriety of Expenses. The Office of University Controller is responsible for assuring that the fiscal practices of the University comply with regent policies, other external and internal rules and regulations.

16. Things to Remember… THINGS TO REMEMBER…. The APSs and PSC procedural statements represent the minimum standards and practices to follow. A campus or department may adopt more restrictive policy and procedure standards to fit their needs. FOR EXAMPLE…. If a campus wishes to require that all receipts be submitted for approvals and reimbursements, this is allowable, regardless of amount. If a department wishes to require pre-approval for all expenses before an expense reimbursement will be approved, this is allowable.

17. Test of Propriety The Tests of Propriety are used to evaluate the appropriateness of expenditures. In order for an expenditure to be considered an appropriate use of university funds, the answer to the test questions must be YES. If any of the questions receive a NO response, then the transaction is not an appropriate use of university funds.

18. Test of Propriety Is the transaction: • For official university business? • In the best interests of the university? • The most effective way to accomplish official university business? Meaning that, without the expenses, would programmatic objectives be difficult or otherwise more costly to achieve? Or would the impact, level, or quality of achievement be reduced? • In compliance with applicable policies, laws, regulations and rules; and contracts, grants and donor restrictions, including having the required approvals and authorizations by the appropriate fiscal role? • Within the available resources of the responsibility unit, taking into consideration all outstanding commitments and encumbrances? • Directly beneficial to the responsible unit where it is being charged? • Reasonable? Meaning that the quantity and quality of goods and services being purchased is sufficient to meet the university’s identified need without exceeding it. • In compliance with university conflict of interest provisions?

19. Sensitive Expenses • The PSC Procedural Statement: Sensitive Expenses applies to all expenditures with university funds and sets forth university requirements for determining the propriety and maximum amounts of certain sensitive expenses. • All Sensitive Expenses must comply with APS Propriety of Expenses.

20. Did You Know… • Alcoholic beverages are allowable as long as they are in compliance with APS Alcoholic Beverages Purchased for University Events and PPS Alcoholic Beverages Purchased for University Events. • Parking is allowable if they are fees associated with an employee in travel status or rate-based parking paid by employee at a secondary work location. Parking is not allowable for fees at the employee’s primary work location. • Donations are not allowable to paid with university funds. • Flowers, fruit baskets and greeting cards are allowable for decorative purposes for official functions, donor cultivation, community relations support, major life events for employee or immediate family member of the employee. HOWEVER, they are not allowable for expressing holiday, get-well or congratulation wishes for employees.

21. Did You Know… • Food and related consumables are allowable in the general public area or reception area of an organizational unit hosted by the university employee who is either at/above the level of chair/director or who is involved in donor cultivation, solicitation, and stewardship activities. • Food and related consumables are not allowable for the employee’s personal consumption. • Staff appreciation meals, once per year, are allowable as long as the approved meal is the award and no separate award is given, and in compliance with PSC Procedural Statements Recognition and Training and Official Functions. • Tips are allowable, up to a maximum of 20% of the actual cost of service(s) or good(s).

22. Travel The PSC Procedural Statement: Travel applies to all travel which will be paid for by the university for employees, students and others. Any funds used for travel reimbursement must be: • Appropriately used • Properly authorized • For documented official university business • Substantiated by applicable receipts • Correctly processed for payment • Compliant with all applicable regulations and agreements

23. Did You Know… • Travelers are expected to use university preferred vendors and university negotiated terms and conditions whenever possible. • Travel expenses directly related to official university business are reimbursable. • Allowable miles are those driven in excess of the normal round-trip commute from the employees home to their primary work location, regardless of the type of transportation used for their normal commute. • Meal reimbursement is not allowed if adequate meals are included with lodging, as part of conference/registration fees, or otherwise provided to the traveler at no cost. • Travelers can be reimbursed for reasonable tips (up to a maximum of 20% of the service charge) for ground transportation. Meal service tips are included in the meal per diem amount and cannot be claimed separately. • Traffic tickets and/or fines are not reimbursable.

24. Official Functions The PSC Procedural Statement: Official Functions applies to meetings, meals or other functions, that are hosted by an organizational unit, attended by guests and/or associates or employees, and held for official university business. All Official Functions must comply with APS Propriety of Expenses and PSC Procedural Statement: Sensitive Expenses.

25. Did You Know… • The Official Function Form requires a list of names and relationships to the university for up to ten attendees or when attendees exceed ten, a list that provides a description of the relationship of the group to the university and the number of attendees. This data may also be typed directly into Concur. • Valid detailed receipts showing actual charges are required for all Official Functions per the PSC Procedural Statement: Undocumented Reimbursement. • If alcohol is purchased as part of an Official Function, the expense must be coded to Official Function with Alcohol so the expense can receive proper university officer approval. • Per the PSC Procedural Statement: Sensitive Expenses, reasonable tips are reimbursable for Official Functions (up to a maximum of 20%).

26. Keep in Mind… The University of Colorado will only pay or reimburse for related expenditures that are ordinary, reasonable, not extravagant and necessary to conduct official university business. Keep in mind these are public funds, and you are representing the university. Ask yourself: • Would a university outsider (such an elementary school teacher, a grocery clerk, or your neighbor) consider the expenditure to be reasonable and a necessary expense of public funds? • Would an outsider (such as the general public or an auditor) consider the expenditure a reasonable expense for university business and appropriate use of university funds? • Would you want others (such as newspaper, radio, television, or other media outlets) knowing and reporting about the expenditure?

27. Sales & Use Tax The University Office of Controller Sales & Use Tax: As a public institution of higher education of the State of Colorado, the University of Colorado is generally exempt from most federal taxes and all Colorado state and local government sales tax. For this tax exemption to qualify, both of the following must be met: • The purchased item MUST be for the exclusive use of the university, to be used by the organizational unit in conducting official university business; and, • The purchase MUST be made using the University Procurement Card, University Travel Card, or a university purchase order.

28. Did You Know… • Sales Tax: Colorado’s sales tax is a transactional tax charged when a buyer purchases tangible personal property or benefits from certain taxable services in Colorado. The State of Colorado imposes a sales tax of 2.9% on retail sales transactions of 17 cents or more. • Use Tax: Use tax must be paid by the purchaser of goods stored, used, or consumed by the purchaser where the seller did not or could not collect sales taxes. In the case of fundraising events, meals and beverages and/or merchandise sales would be exempt from sales tax. HOWEVER, items that are re-sold to fundraising event attendees would be subject to use tax. • If an employee makes a purchase with personal funds, with the intention of subsequently requesting reimbursement from the university, the purchase is NOT tax exempt, even if the employee presents a university tax-exemption number.

29. Remember…. • Be Reasonable. • Be Consistent. • Document, Document, Document.

30. Is It Appropriate? The following are some typical examples that Internal Audit identifies while performing reviews of P-Card and Travel & Expense reports.

31. Is It Appropriate? Three CU Denver employees meet for lunch at Rock Bottom Brewery to discuss administrative issues. The total of the bill is $75 (no alcohol purchased). A $15 tip is left. The lunch is coded to Official Function. Is this an appropriate expense? NO…it was determined this is not a valid university expense per the APS Propriety of Expenses. This is not in the best interest of the university and is not reasonable. From the outsiders perspective, this appears to be a waste of university funds, as the meeting could have taken place on campus and there is no business purpose that the meeting needs to occur at a restaurant.

32. Is It Appropriate? An employee travels from their home to DIA for a business trip, leaving on a Monday and returning on a Sunday. The employee deducted her regular commute from home to campus when submitting for reimbursement. Is this an appropriate expense? YES…it was determined that this a valid university expense per PSC Procedural Statement: Travel. Regular commute (round trip) must be deducted during regular work days.

33. Is It Appropriate? An employee travels to San Diego for an educational conference. The employee leaves Denver on Tuesday afternoon as the conference runs from Wednesday morning to Friday evening. The employee books the flight back to Denver for Sunday afternoon so he could visit a friend on Saturday night/Sunday morning. When completing the expense report for the trip, the employee submits for M&IE for Tuesday through Sunday. Is this an appropriate expense? NO…it was determined this is not a valid university expense. The employee is due per diem for Tuesday through Saturday Per the PSC Procedural Statement: Travel, M&IE must be excluded for non-business days.

34. Is It Appropriate? An employee travels to New York for an educational conference. The conference includes breakfast and lunch for all three days of the conference. When the employee returns she submits her expenses in Concur and requests M&IE for all breakfasts and dinners for the length of the conference. She stated that she would prefer to just have Starbucks for breakfast rather than the breakfast provided. Is this an appropriate charge? NO…it was determined this is not a valid university expense. Pre the PSC Procedural Statement: Travel, meal reimbursement is not allowable if adequate meals are included with lodging, as part of conference/registration fees, or otherwise provided to traveler at no cost.

35. Additional Support • Administrative Policy Statements are located at: http://www.cu.edu/ope • PSC Procedural Statements are located at: • http://www.cu.edu/psc/procedures • Internal Audit information is located at: • http://www.cu.edu/internalaudit

36. When you see something that looks wrong… • University of Colorado policy requires all employees to promptly report actual or suspected fiscal misconduct or other fraudulent acts. There are several options including: • CU EthicsLine is a way to anonymously report concerns of fiscal misconduct, fraudulent acts, or suspected misconduct. The CU EthicsLine is accessible via a toll-free phone number (1-800-677-5590) or via www.Ethicspoint.com. This service is provided by an independent company and is available seven days a week, 24 hours a day. • Reports can also be reported to the Internal Audit Department in person, in writing, via telephone, fax or email. We are located at: 1800 Grant Street, Suite 600, Denver, CO 80203-1185. Phone: 303-837-2200 Fax: 303-837-2190. Email can be directed to Kevin.Sisemore@cu.edu.

37. Investigations What is Internal Audit’s Role?

38. Projects • Performance • Compliance • Consults • IT Investigations Risk Mitigation Risk Identification Governance Management Risk Management Risk Avoidance Advisory IA Five Year Strategic Plan • Investigations • Financial • Compliance Education Awareness

39. Audits vs. Investigations Audits = Financial Information Organizations Organizational Units Processes Investigations = Actions or Inactions of People

40. Investigations Internal Audit is charged with conducting internal investigations of allegations of employee fiscal misconduct as defined by Regent Policy

41. “Fiscal Misconduct” • Deliberate act or failure to act in the course of university employment regarding fiscal matters • Contrary to established law, rule, or policy • With the intent to obtain an unauthorized benefit • Which results in loss or other damage to the university or university faculty, staff, student or university affiliated entity • Fiscal misconduct also includes attempted fiscal misconduct • Regent Policy 13E

42. Investigations Examines the actions of one or more individuals Typically Internal Audit investigations involve university personnel but on occasion have included non-employees

43. “Fiscal Misconduct” - Examples • Embezzlement or misappropriation of university funds, goods, property, services, or other resources • Using university funds for personal purchases • Improper handling or reporting of financial transactions • Authorizing or receiving compensation for goods not received or services not performed • Authorizing or receiving compensation for hours not worked • Diverting funds to an unrelated private enterprise that otherwise could be available to the university

44. Investigations Then What Happens?

45. Regent Policy 13E: Fiscal Misconduct Remedies. Appropriate and timely actions will be taken to remedy fiscal misconduct. Such remedial actions may include, but are not limited to: (1) taking disciplinary action (up to and including termination of employment) against university officers and employees who engage in fiscal misconduct or fail to report suspected fiscal misconduct, (2) seeking restitution for all losses, including investigative and legal expenses, (3) forwarding information to the appropriate authorities for criminal prosecutionof persons who engage in fiscal misconduct, and (4) instituting civil actionto recover losses.

46. What about false reports? Policy 13E: Fiscal Misconduct False Allegations. Employees who make false allegations of suspected fiscal misconduct with the intent to disrupt the university's business or to cause harm to another will be subject to disciplinary action.

47. Questions? Comments?

48. Final Thought… WHEN IN DOUBT… ASK!