Inspection Of Compliance Programs for High Risk Areas

1. Inspection Of Compliance Programs for High Risk Areas September 21, 2001 Sharon Corum, CPA

2. Inspection:An examination aimed at forming a judgment or evaluation of high-risk compliance programs

3. Communication of Inspection Results: Internal Audit should send a memo (not an audit report) to the component’s Institutional Compliance Committee and to the Chief Administrative Officer. UT System’s Compliance Office will become aware of inspection results through the normal compliance reporting mechanisms.

4. Purpose Of An Inspection(Presented in sequential order) • Determine that a responsible party has been designated for each compliance high-risk area • Determine whether the responsible party has a complete understanding of monitoring controls and their responsibility for implementing those controls • Verify that an acceptable monitoring plan has been established for each high-risk area

5. (… Acceptable Monitoring Plan…) includes: • Description of the operation controls being monitored • Description of how the controls are being monitored • Maintenance of documentation of the monitoring activity

6. Documentation is being maintained related to compliance program activities Verify that appropriate specialized training is being conducted …Purpose of An Inspection…(continued in the following order…)

7. Purpose Of An Inspection(continued…) • Evaluate whether activities of high risk compliance programs have been accurately represented and reported to the Compliance Office, Institutional Compliance Committee, and UT System • Determine whether the monitoring plan is auditable

8. Auditable Monitoring Plan… • Documented evidence of corrective action taken when monitoring controls identified failure of operating controls • Documentation for instances of non-compliance and its resolution • Documentation for reporting of non-compliance or potential non-compliance

9. Auditable Monitoring Plan:(…continued) • Documentation of specialized training for all employees who interact with risk • Documented specialized training in cases of failure of operating controls or instances of non-compliance • Evidence of Designated Responsible Person providing periodic reports to the Compliance Office and the Institutional Compliance Committee

10. If an Acceptable and Auditable Monitoring Plan Exists Then: Schedule an audit of the high-risk area, if all other inspection criteria were met and the Monitoring Plan appears auditable. If the Monitoring Plan is not auditable, inform the Chief Administrative Officer, the Compliance Officer, and Institutional Compliance Committee of the inspection results.