UCSF

1

• UCSF
• Controllers Office
• SAS 112
• January 2007

2
Agenda

• What is SAS 112
• Key Controls
• Q A

3

• What is SAS 112

• New auditing standard
• - Statement of Auditing Standard 112

4
Why SAS 112

• WorldCom
• 11 billion accounting fraud
• Enron
• 4 billion accounting fraud
• United State Federal Law and SEC
• For Public Companies
• SarbanesOxley 404
• Requires conducting an assessment of the
  effectiveness of internal controls by management,
• to be audited and approved by the companys
  independent accountants
• American Institute of Certified Public
  Accountants
• For non-profit organization like UCSF
• SAS 112 (Effective Date July 1, 2006)

5
Purpose of SAS 112

• Establish a standard for determining seriousness
  of a control issue and classifying it into three
  categories
• control deficiency
• significant deficiency
• material weakness
• Ensure effectiveness of internal controls that
  impact financial statements

6
Control Deficiency

• A control deficiency exists when the design or
  operation of a control does not allow management
  or employees, in the normal course of performing
  their assigned functions, to prevent or detect
  misstatements on a timely basis.

7
Examples of Control Deficiencies

• Lack of timeliness of cash deposit and account
  reconciliation
• Lack of proper approval for invoices gt 2,500
• Lack of review and reconciliation of departmental
  expenditures (sponsored and non-sponsored funds)
• Lack of overdraft funds monitoring
• Lack of outstanding accounts receivable
  monitoring and follow-up
• Lack of physical inventory

8
Other Two Deficiencies

• A significant deficiency is a control deficiency,
  or combination of control deficiencies
• A material weakness is a significant deficiency,
  or a combination of significant deficiencies
• Progressive in nature, severity and reporting
  requirements and follow-up

9
Impacts of SAS 112 and the Risks Involved

• Due to significant changes in the evaluation of
  control exceptions and more stringent audit
  standards, UCSF would more likely encounter
  significant deficiencies or material weaknesses
  being identified than we have during past audits.

10
Impacts of SAS 112 and the Risks Involved

• SAS 112 requires UCSF disclosure of deficiencies
  to 3rd parties such as
• Regents
• Federal sponsors
• 3rd party creditors
• Accrediting agencies
• Rating agencies
• Insurers
• Impact of these disclosures
• Negative impact on sponsored project funding
• Negative impact on credit rating
• Negative impact on reputation

11
How to Reduce Risks

• Place key controls in our operation to minimize
  control deficiency and risk by preventing or
  detecting errors and frauds in a timely manner
• What is Key Control?
• A set of critical processes to prevent or detect
  errors and frauds

12
Key Controls Impacting Departments

• Examples
• Daily Bank Deposits-Bank deposits are tracked on
  a daily basis in a log to match deposits with
  journal entries
• Purchasing and Payables Invoices gt
  2,500-Invoices greater than 2,500 must be
  approved by the department responsible for the
  purchase
• General Ledger Verification (Sponsored and
  Non-Sponsored Funds)-In WebLinks monthly revenue
  and expense summary and detail ledgers are
  available for departments to review and reconcile
  budget and financial transactions
• Physical Inventory-Physical Inventory is
  conducted by the department custodian/PI every
  two years. Campus Asset Management ensures the
  inventory is conducted every two years. Records
  are reconciled to the physical inventory results.

13
Key Controls Impacting Departments

• Examples
• Overdraft Funds-Extramural Funds reviews awards
  in overdraft status (expense gt authorized budget)
  and notifies Control Points for follow-up action
• Payroll Expense Distribution Report-The Payroll
  Expense Distribution Report is available on-line
  for each department to review. PwC will discuss
  the review process with Department selected for
  testing for the current fiscal year. If there is
  no evidence of review, compare the
  timesheets/effort allocations to the payroll
  reports generated from the Central Campus Payroll
  Department.

14
Key Controls Documented

• SAS 112 Key Controls Documentation template
• Describe key control and process
• Identify Roles, Responsibility, and
  Accountability
• Document test plan for effective control
• Identify sufficient evident of review
• Describe compensating control when primarily
  control fails

15
Example of Control Process Described
inReconciliation of Departmental
Expenditures-General Ledger Verification
(Sponsored and Non Sponsored Funds)

• Process
• Departments are to review and reconcile, annotate
  exceptions, follow-up with corrective actions by
  submitting a journal entry, contacting a recharge
  unit or the Controllers Office to make adjusting
  entries as appropriate.
• Steps to take by departments
• Perform necessary steps to reconcile departmental
  accounts including identification, follow-up and
  resolution of exceptions. Per Audit and
  Management Services Best Practices for Ledger
  Verification at http//www.ucsf.edu/ams/best/ledge
  r.html
• Signed copies of the monthly reconciliation and
  supporting documentation are to be maintained by
  the department in a file easily accessed by
  external auditors.

16
What does it mean to you?
17
Before and After SAS 112 Implementation

• Before SAS 112
• For the most part these key controls should
  already be in place in each department
• After SAS 112
• Criteria to evaluate control issues has been
  tighten
• Document the key controls for external auditors
• Require documentation for evidence of review
• Provide framework and tools for Finance Mgrs to
  perform regular review and monitoring internal
  controls

18
Roles and Responsibilities

• Controllers Office
• Follow University Policy and Procedures and Best
  Practices
• Act as a liaison between external auditors and
  departments
• Provide guidance, key controls framework, and
  communication for SAS-112 implementation
• Departments
• Identify and document other applicable
  significant key controls in your specific area
  (s)
• Implement key controls
• Document evidence of review for all levels when
  performed (signature and/or email)
• Audit and test key controls to Ensure the key
  controls in place
• Document evidence of review
• Fix and follow-up when significant deficiency or
  material weaknesses identified
• Document evidence of corrective action taken

19
Policy Statement

• Campus Administrative Policy 300-27
• IV. Responsibility
• A. Verification of Expenditures (Key Control 13)
• It is the responsibility of the department to
  verify that the expenditures incurred are in
  accordance with University regulations, and that
  expenditures incurred against restricted funds
  (e.g., gifts, contracts, and grants) are
  consistent with the terms of the fund.
• B. Budgetary Control (Key Control 26)
• 1. Department heads are responsible for
  maintaining budgetary control of all expenditures
  under their jurisdiction.
• 2. It is the responsibility of the department to
  make budgetary adjustments or expenditure
  transfers to eliminate any deficit before the end
  of the appropriation period.

20
Important Dates

• SAS 112 Effective Date July 1, 2006
• Entire Fiscal Year is subject to review and
  testing
• DO NOT go back and create documents
• BEGIN key control processes effective January
  2007
• - Campus Roll-Out January 1, 2007
• SAS 112 information can be found on the
  Controllers website at
• http//www.acctg.ucsf.edu/internal_controls/sas112
  /index.htm

21
Q A
22
Thank You