The Auditor

1
The Auditors Perspective

• Division of Sponsored Research
• Research Administration
• Training Series
• Presented by
• Joe Cannella (jciii_at_ufl.edu)
• Audit Manager, Office of Audit Compliance
  Review
• June 19, 2007

2
AGENDA

• Session Objectives
• Research Environment at the University of Florida
• Auditors and the Office of Audit Compliance
  Review (OACR)
• Research Risks (Operational, Compliance,
  Financial)
• Auditors Perspective
• Questions?

3
Session Objectives

• Auditor a friend or a foe? Find out what your
  university auditors consider to be high-risk
  issues in sponsored research administration and
  accounting. There will be a discussion of audits
  performed, summary of common issues and findings
  and proactive best practices in higher education.
  
• Auditors role and how you can be prepared?
• Joining forces for educational, and compliance
  oversight activities involving research
  administration?

4
University of FloridaThe Environment

• An AAU public university with thousands of
  research faculty
• 2005-2006 research awards over 500 million
• Universitys Strategic Goal is to be a Top 10
  Research University

5
University of FloridaThe Environment

• NIH is the largest source of external research
  funding
• Royalty and licensing income generated from
  intellectual property continually support the
  University

Federal Awards by Agency Federal Awards by Agency Federal Awards by Agency Federal Awards by Agency Federal Awards by Agency Federal Awards by Agency Federal Awards by Agency Federal Awards by Agency
Fiscal Year Ended Fiscal Year Ended Fiscal Year Ended Fiscal Year Ended Fiscal Year Ended Fiscal Year Ended Fiscal Year Ended
00 01 02 03 04 05 06
NIH 69.7 93.5 103.9 104.4 113.2 130.4 143.8
NSF 20.7 28.2 39.2 40.7 42.4 46.6 39.6
USDA 13.3 30.6 27.1 26.3 29.2 31.4 33.3
DOD 12.1 14.7 24.6 24.2 21.2 22.4 23.1
HHS 1.0 0.7 3.4 23.3 14.3 14.3 13.6
Other 58.3 59.4 69.9 69.6 65.4 71.5 71.0
Total 175.1 227.1 268.1 288.5 285.7 316.6 324.4
6
University of Florida The Environment

• Decentralized organizational structure
• Three centralized offices overseeing some aspects
  of research administration
• Office of Audit Compliance Review performs risk
  analysis-research administration subjects may be
  categorized as high compliance risk areas

7
Who are the Auditors

• Office of Audit Compliance Review (OACR)
• Large audit universe with the associated risk
  impacting the scope and emphasis of engagements.
  Audits and reviews may be related to financial,
  operational, or compliance objectives.
• Emphasis on assisting management with improving
  internal controls and mitigating risk. OACR is
  not the owner or manager of the controls.
• Assist with spread of information and
  communication across the University
• Reports directly to the Audit Committee of the
  Board of Trustees
• State of Florida Auditor General
• Annual Audit of Compliance and Internal Controls
  Over Financial Reporting and Federal Awards
  (A-133)
• Other Audits
• Other Offices for Federal Cognizant Agencies
• Audits may be subcontracted to external parties
• Scope can vary greatly

8
Research Risks

• Various types of risk (Financial, Operational, or
  Compliance)
• Research administration risks generally involve a
  heavy compliance element
• External audit findings or lack of institutional
  controls can impact public perception and/or
  future funding
• How to manage or mitigate risks (Control, Avoid)
• Operating controls, monitoring controls,
  oversight, and auditing
• Controls can be preventative (most effective) or
  detective
• Controls at institutional and unit levels are
  expected by Sponsors
• If controls are working they should identify
  issues
• Danger is not taking action when you notice a
  problem

9
Audit and Risk Areas Involving Sponsored Research

• Administrative and Clerical Salaries
• Animal Care and Resources
• Billing
• Biosafety and controlled substances (accounting
  and security)
• Clinical Trials
• Compensation and kickbacks
• Conflict of Interest (financial or technical)
• Contract and Grant Accounting (properly
  allocating charges)
• Costs and Budget Transfers
• Cost Sharing, Indirect cost accounting
• Effort Reporting , Level of Commitment
• Foreign / Export Controls
• Funding and various sources of financial support

10
Audit and Risk Areas Involving Sponsored Research

• Graduate student compensation
• HIPAA / Privacy of Information
• Human Subject Research
• Intellectual Property
• Institutional Review Boards
• Reporting
• Research Centers
• Research Integrity
• Research Laboratories
• Royalty Revenues and Technology Licensing
• Subcontract Monitoring
• Identified in recent DHHS OIG 2007 Work Plan

11
Current OACR Audit Focus and Issues

• Contracts and Grant Accounting
• Implementation of PeopleSoft
• The new environment
• Time and Effort Reporting
• Purpose of effort reporting
• Changes and best practices
• Subcontract Monitoring
• Indirect Costs
• Research Compliance Committee
• University-wide system audits
• Control Self Assessment

12
Control Self Assessment Results
13
Other Factors Impacting Risks at our Institution

• Institutional Culture
• Organizational Structure
• Policies and Procedures
• Information Support Systems
• Resources Committed
• Educational Activities

14
Auditors Perspective

• Auditors perspective should be one of fact
  finding
• Should be independent and objective
• An auditor is not a compliance officer or
  business management
• Scope and objectives are important (investigation
  audit review)
• Documentation is key especially for red flag
  areas or unusual transactions
• Audit reports and communication

15
Internal Audits role in coordinating Federal
or State Agency audits

• What is expected from you as a research
  administrator
• Assistance with information transmittal
• Assurance for timely and complete responses
• Knowledge of Institution and its practices
• Follow-up after audit is completed

16
What if you are audited?

• Do it right the first time, rather than trying to
  make corrections later.
• Make sure proper people are involved
• Confirm auditor/investigators authority
• Maintain proper conduct. Make sure staff are
  informed and professional
• Dont leave the investigator unattended, and make
  records of what has been examined and copied
• Dont expand the scope
• Follow-up after audit is completed

17
Questions?

• Contact Information
• Joe Cannella, Audit Manager
• jciii_at_ufl.edu
• [phone]
• University of Florida OACR web site
• http//oacr.ufl.edu/