The Auditor’s Perspective

1. The Auditor’s Perspective Division of Sponsored Research Research Administration Training Series Presented by: Joe Cannella (jciii@ufl.edu) Audit Manager, Office of Audit Compliance & Review June 19, 2007

2. AGENDA • Session Objectives • Research Environment at the University of Florida • Auditors and the Office of Audit & Compliance Review (OACR) • Research Risks (Operational, Compliance, Financial) • Auditor’s Perspective • Questions?

3. Session Objectives • Auditor: a friend or a foe? Find out what your university auditors consider to be high-risk issues in sponsored research administration and accounting. There will be a discussion of audits performed, summary of common issues and findings and proactive best practices in higher education. • Auditor’s role and how you can be prepared? • Joining forces for educational, and compliance oversight activities involving research administration?

4. University of FloridaThe Environment • An AAU public university with thousands of research faculty • 2005-2006 research awards over $500 million • University’s Strategic Goal is to be a “Top 10 Research University”

5. University of FloridaThe Environment • NIH is the largest source of external research funding • Royalty and licensing income generated from intellectual property continually support the University

6. University of Florida The Environment • Decentralized organizational structure • Three centralized offices overseeing some aspects of research administration • Office of Audit & Compliance Review performs risk analysis-research administration subjects may be categorized as high compliance risk areas

7. Who are the Auditors • Office of Audit & Compliance Review (OACR) • Large audit universe with the associated risk impacting the scope and emphasis of engagements. Audits and reviews may be related to financial, operational, or compliance objectives. • Emphasis on assisting management with improving internal controls and mitigating risk. OACR is not the owner or manager of the controls. • Assist with spread of information and communication across the University • Reports directly to the Audit Committee of the Board of Trustees • State of Florida Auditor General • Annual Audit of Compliance and Internal Controls Over Financial Reporting and Federal Awards (A-133) • Other Audits • Other Offices for Federal Cognizant Agencies • Audits may be subcontracted to external parties • Scope can vary greatly

8. Research Risks • Various types of risk (Financial, Operational, or Compliance) • Research administration risks generally involve a heavy compliance element • External audit findings or lack of institutional controls can impact public perception and/or future funding • How to manage or mitigate risks (Control, Avoid) • Operating controls, monitoring controls, oversight, and auditing • Controls can be preventative (most effective) or detective • Controls at institutional and unit levels are expected by Sponsors • If controls are working they should identify issues • Danger is not taking action when you notice a problem

9. Audit and Risk Areas Involving Sponsored Research • Administrative and Clerical Salaries * • Animal Care and Resources • Billing • Biosafety and controlled substances (accounting and security) * • Clinical Trials • Compensation and kickbacks • Conflict of Interest (financial or technical) * • Contract and Grant Accounting (properly allocating charges) • Costs and Budget Transfers * • Cost Sharing, Indirect cost accounting • Effort Reporting , Level of Commitment * • Foreign / Export Controls • Funding and various sources of financial support

10. Audit and Risk Areas Involving Sponsored Research • Graduate student compensation * • HIPAA / Privacy of Information • Human Subject Research • Intellectual Property • Institutional Review Boards • Reporting • Research Centers • Research Integrity • Research Laboratories • Royalty Revenues and Technology Licensing • Subcontract Monitoring * Identified in recent DHHS OIG 2007 Work Plan

11. Current OACR Audit Focus and Issues • Contracts and Grant Accounting • Implementation of PeopleSoft • The new environment • Time and Effort Reporting • Purpose of effort reporting • Changes and best practices • Subcontract Monitoring • Indirect Costs • Research Compliance Committee • University-wide system audits • Control Self Assessment

12. Control Self Assessment Results

13. Other Factors Impacting Risks at our Institution • Institutional Culture • Organizational Structure • Policies and Procedures • Information Support Systems • Resources Committed • Educational Activities

14. Auditor’s Perspective • Auditor’s perspective should be one of “fact finding” • Should be independent and objective • An auditor is not a “compliance officer” or business management • Scope and objectives are important (investigation – audit – review) • Documentation is key – especially for “red flag areas” or unusual transactions • Audit reports and communication

15. Internal Audit’s role in coordinating Federal or State Agency audits • What is expected from you as a research administrator • Assistance with information transmittal • Assurance for timely and complete responses • Knowledge of Institution and its practices • Follow-up after audit is completed

16. What if you are audited? • Do it right the first time, rather than trying to make corrections later. • Make sure proper people are involved • Confirm auditor/investigator’s authority • Maintain proper conduct. Make sure staff are informed and professional • Don’t leave the investigator unattended, and make records of what has been examined and copied • Don’t expand the scope • Follow-up after audit is completed

17. Questions? • Contact Information: • Joe Cannella, Audit Manager • jciii@ufl.edu • (352) 273-5087 • University of Florida OACR web site: • http://oacr.ufl.edu/