• TABLE OF CONTENTS
HIDE
 Title Page
 Table of Contents
 Introduction
 Operations
 Organization chart
 Budget and expenditure analysi...
 Audits and other planned revie...
 Audit report summaries
 Management advisory services
 Investigations
 Follow-up
 Other activities
 OACR audit charter
 Contacts and resources






Group Title: University of Florida Office of Audit and Compliance Review annual report
Title: University of Florida Office of Audit and Compliance Review Annual Report
ALL VOLUMES CITATION PAGE IMAGE ZOOMABLE
Full Citation
STANDARD VIEW MARC VIEW
Permanent Link: http://ufdc.ufl.edu/UF00072255/00004
 Material Information
Title: University of Florida Office of Audit and Compliance Review Annual Report
Series Title: University of Florida Office of Audit and Compliance Review Annual Report. 2005-2006.
Physical Description: Serial
Language: English
Creator: University of Florida Office of Audit and Compliance Review
Affiliation: University of Florida -- College of Liberal Arts and Sciences
Publisher: University of Florida
Publication Date: 2006
 Subjects
Subject: University of Florida.   ( lcsh )
Spatial Coverage: North America -- United States of America -- Florida
 Record Information
Bibliographic ID: UF00072255
Volume ID: VID00004
Source Institution: University of Florida
Holding Location: George A. Smathers Libraries, University of Florida
Rights Management: All rights reserved, Board of Trustees of the University of Florida

Table of Contents
    Title Page
        Title page
    Table of Contents
        Page 1
    Introduction
        Page 2
    Operations
        Page 2
    Organization chart
        Page 3
    Budget and expenditure analysis
        Page 4
        Page 5
    Audits and other planned reviews
        Page 6
    Audit report summaries
        Page 7
        Page 8
        Page 9
    Management advisory services
        Page 10
    Investigations
        Page 11
    Follow-up
        Page 12
    Other activities
        Page 13
        Page 14
    OACR audit charter
        Page 15
    Contacts and resources
        Page 16
Full Text


ANNUAL REPORT 2005-06





%.-" r- 9 m--
eeet

Maae n i









e e ih e Sarbanes-OxIey 3 eisltion.il






Message

from the

Chief Audit

Executive






extensive control documentation were initiated
during this period. With the first year of the two-
year work plan behind us, significant challenges in

and itsaffiliated organizations rerain.

Maintaining full and effective staffing continued to
be the Office ofAuditand Compliance Review's
(OACR) primary challenge with all time high market
demand for audit professionals triggered mostly by
the Sarbanes-Oxley legislation. While we
successfully recruited for certain key positions
Edurin gthe period, we finished the year with two
o CONTENTS open positions.
Introduction ....................................... .............
The 2005-2006 year has also been significantfor
O perations ............. ............ .... ...............2 p fes ional service including:
Goals and Objectives
Staffing and Other Resources The Spring Conference jointly organized with
Organization Chart the North Central Florida Chapterof the
StaffTraining Institute of InternalAuditors
Budget andExpenditureAnalysis Presentation at the International Conference of
the Institute of Internal Auditors in Houston,
TimeAnalysis Serving on the highereducation quality
lTieAllocation assessment team for Oregon University
Audits and Other Planned Reviews ..................6 Syste,
Trend Analysis Taking various leadership roles in professional
Client Surveys organizations and within the University.
Audit Report Summaries .....................................7
Audit Repon Summaries In addition to promoting the OACR and its activities,
Management Advisory these opportunities provided cost effective
Services .......................... ............... ......... 10 educational progra formanage entand staff.
Special Advisory Reviews
Newsletter We wel_ e 2006-2007 with the OACR's ongoing
Post-AuditAssistance cormmitment for exemplary internal audit services
Investigations ............ ..................... 11 and its renewed emphasis to partner in educational
Summary ofSignificant Issues programs for the promotio n of best fiscal practices
Follow-Up ........... ....................... 12 forthe Univesity and its affiliates.
Follow-Up Statistics
Other Activities ...... ..................................... 13 N r Eenguc, A, CFE
OACR Audit Charter ..................................... 15 Chief Audit Executive
Contacts and Resources ................................. 16


xjtl3e.B port 2005-2006 2













INTRODUCTION OPERATIONS

The Office of Audit and Compliance Review Goals and Objectives
(OACR) provides a central point for the
coordination of activities that promote A key operational objective for the period was
accountability, integrity, and efficiency for the completion of the first year of the 2005-2007 work
University of Florida. The OACR Charter is plan. We directed additional emphasis and
included on page 15 of this report. resources to the University's direct support and
affiliated organizations and closely followed the
Fiscal year 2005-2006 was the second year of the trends and developments in the application of
myUFL implementation. As a result, we focused on Sarbanes-Oxley accountability measures to not-
reviews of major areas with a broad impact such for-profit organizations and universities in
as University Payroll, Travel, Utilities and particular.
Cashiering. We completed Information
Technology audits and provided significant Preparations began for the external quality
management advisory assistance as the system assurance review scheduled for early 2007. IIA
stabilized. We continued to provide audit support standards require external quality reviews of
for the major Direct Support Organizations, UF internal auditing offices every five years. To that
Foundation and University Athletic Association. end, in preparation for our external review, we
We expect to continue to provide proactive completed an internal quality assurance review
assistance as well as post implementation audits with the assistance of a consultant.
to promote good business procedures together
with a reasonable level of controls in all areas. Staffing and Other Resources
During 2005-2006 OACR hired one full-time staff
auditor and two part-time graduate assistants. We
promoted two staff members into audit manager
and senior auditor vacancies. We ended the year
with two position vacancies.

We remodeled space in Tigert Hall to accommodate
our entire staff. Thus, we closed the Yon Hall office.
This was also the first full year of using a new audit
workpaper software program which required re-
engineering our internal procedures.

To better align audit resources with the University
units expecting and supporting audit effort, we
continued a funding methodology necessary to
meet this need and expectation. We expect to fill the
two auditor vacancies in the coming year and add a
OACR STAFF Standing: Lily Reinhart, Brian Mikell, Jeff Capehart, part-time audit support position. When fully
Craig Reed, Hui Zhou, Vito Hite, Suzanne Newman, Brecka staffed at 14 auditor positions, the OACR will
Anderson, Joe Cannella favorably benchmark with its peer organizations
Seated: Marilyn Velez, Nur Erenguc, Carole Silverman, Chris
Bunn and meet the internal audit needs of the Universit
and its support organizations.







2005-2006 3













INTRODUCTION OPERATIONS

The Office of Audit and Compliance Review Goals and Objectives
(OACR) provides a central point for the
coordination of activities that promote A key operational objective for the period was
accountability, integrity, and efficiency for the completion of the first year of the 2005-2007 work
University of Florida. The OACR Charter is plan. We directed additional emphasis and
included on page 15 of this report. resources to the University's direct support and
affiliated organizations and closely followed the
Fiscal year 2005-2006 was the second year of the trends and developments in the application of
myUFL implementation. As a result, we focused on Sarbanes-Oxley accountability measures to not-
reviews of major areas with a broad impact such for-profit organizations and universities in
as University Payroll, Travel, Utilities and particular.
Cashiering. We completed Information
Technology audits and provided significant Preparations began for the external quality
management advisory assistance as the system assurance review scheduled for early 2007. IIA
stabilized. We continued to provide audit support standards require external quality reviews of
for the major Direct Support Organizations, UF internal auditing offices every five years. To that
Foundation and University Athletic Association. end, in preparation for our external review, we
We expect to continue to provide proactive completed an internal quality assurance review
assistance as well as post implementation audits with the assistance of a consultant.
to promote good business procedures together
with a reasonable level of controls in all areas. Staffing and Other Resources
During 2005-2006 OACR hired one full-time staff
auditor and two part-time graduate assistants. We
promoted two staff members into audit manager
and senior auditor vacancies. We ended the year
with two position vacancies.

We remodeled space in Tigert Hall to accommodate
our entire staff. Thus, we closed the Yon Hall office.
This was also the first full year of using a new audit
workpaper software program which required re-
engineering our internal procedures.

To better align audit resources with the University
units expecting and supporting audit effort, we
continued a funding methodology necessary to
meet this need and expectation. We expect to fill the
two auditor vacancies in the coming year and add a
OACR STAFF Standing: Lily Reinhart, Brian Mikell, Jeff Capehart, part-time audit support position. When fully
Craig Reed, Hui Zhou, Vito Hite, Suzanne Newman, Brecka staffed at 14 auditor positions, the OACR will
Anderson, Joe Cannella favorably benchmark with its peer organizations
Seated: Marilyn Velez, Nur Erenguc, Carole Silverman, Chris
Bunn and meet the internal audit needs of the Universit
and its support organizations.







2005-2006 3













OACR ORGANIZATION CHART





Nur Erenguc





SCarole Silverman
CSenlo Audlt Mgr
Ex1ecuve
S-| D'rect|
ad aSulzanne Newman cofrne
Administrav 1
Coordinator



eChris BunnSil







oa ning for IBk of In A o s
staffudmbersiewtlo uditin oa l ou oire
Additionally, woed co-ponore e anAudH Managerof Florida 229 12
CraiL Reednhr0
Audl Manaoer Jeff Capehart


g fffSenl f A udoor Ai |IIo
Seoor AudAtor I








taffAudtor| ir








Staff Training Table 1-Staff Training

Continuing professional education is highly valued ,,,,.B, ,, ''-
and attendance to relevant conferences and AoconfHelhCe 18
seminars is promoted. Since cost-effective training of Internal Auditors
Institute of Internal Auditors 373 12






seminars is promoted. Since cost-effective training progras efl loridaInstitue of Crtifie
of new staff was a priority, we initiated training for
staff members new to auditing or to our office. University of Florida 229 12
Additionally, we co-sponsored with the IIA two and
a half days of training in Gainesville. Audit and Association of College and
accounting staff from other organizations University Auditors
participated in this training. One staff member
completed a master's degree in a relevant field Association of Health Care 18 1
during the fiscal year. Table 1 reflects a listing of Internal Auditors
staff participation in formal training programs in Florida Institute of Certified
2005-2006. Public Accountants 2 1



2005-2006 4











Budget and Expenditure Analysis Operating Expenses

The OACR expenditures by category are illustrated
in Table 2. Professional staff salaries remain our 17% 8% 7%
primary commitment representing 90%p of totalu
expenditures. This year, we made one-time 10%
commitments to renovate office space in Tigert Hall
and to purchase audit workpaper software. These
purchases will benefit staff for years to come. We 26%
also contracted with a consultant to provide 6
internal quality assessment services in preparation
for the external quality assessment review 12% 14%
scheduled for 2007. Supplies and communication
expenses represented the largest percentage of E Office Supplies U Travel
operating expenses. Personnel Expenses P Telephone/Postage
R Dues/Subscriptions E Maintenance
SCComputer Supplies Printing

Table 2Analysis of Expenditures

Salaries $929,524 $1,058,853
Other Personal Services (OPS) 24,204 21,154
Fixed Assets 12,502 8,879
Operating Expenses 20,673 22,310
Training 18,627 15,602
Renovations -- 20,308
AutoAudit Software Purchase -- 18,075
Consultants 4,385





















Total (11,521)
Time Analysis

Table 3 provides a comparison between time available hours for the period was 11.3% less than
available as planned and actual time available for planned. This was the result of unanticipated
projects. Even with 299 hours of overtime, position vacancies. These vacancies had an impact
on project progress and completion.


Table 3-Planned/Actual Hours


Time Available (14.5x2,040) 29,580 29,580

Less: Adjustment for Position Vacancies (3,404) 3,404

Training/Leave Use/Operational Support (8,874) (8,117) (757)

Total (11,521)

Excess hours worked 299 (299)




2005-2006 5












Time Allocation increase in audit time is attributable complexity of
planned audit projects and greater time spent on
Chart A represents the planned activity mix for total audits by less experienced staff.
time available for projects and actual effort
expended, and Chart B provides a comparison Direct time percentages are established as a
between prior year and current allocation of time productivity goal for each professional position
available for projects. For all categories, actual time and for the office as a whole. Direct time excludes
did not vary significantly from the plan. In administration, service support, leave and
comparison with the prior year, time spent on training.
follow up and investigations was consistent.
Management Advisory Services (MAS) was greater Chart C compares direct time achieved in the last
in the prior year due to providing advisory services two fiscal years. Ongoing emphasis on new staff
relating to stabilization of the new myUFL systems. training was in conflict with the targeted direct
The decrease in operational support is attributable time percentage of 72%, which we could not
to the reduction in administrative time spent in achieve. Procedures were implemented to monitor
recruitment and orientation of new employees. The staff direct time more closely.



Chart A-Allocation of Total Time Chart B-Allocation of Time Available
Planned vs. Actual for Projects
Prior vs. Current Year

Training/Leave 3
Use/Op Supp 3 % Operational Support 20 ,

FollowUp Follow Up


Investigations Investigations


MAS MAS


Audits Audits


0% 10% 20% 30% 40% 50% 60% 0% 20% 40% 60% 80%
Planned E Actual U 2004-2005 U 2005-2006



Chart C-Office Direct Time by Fiscal Years

100%
80% 78~, 79
60% -
40% -
20% -
0%
Quarterl Quarter2 Quarter3 Quarter4 Total Office

FY 04-05 ~ FY 05-06 Goal 72%



2005-2006 6












AUDITS AND OTHER PLANNED Trend Analysis of Projects
REVIEWS Planned/Completed

Trend Analysis 80
70
Table 4 reflects a three-year analysis of projects 62
planned and completed. The work plan includes 60
planned audits and advisory reviews.
50 O 2005-2006
Over the last three years, 73 projects were planned 40 2004-2005
40 H 2004-2005
and 62 were completed. The upward trend in
projects planned is attributable to the continued 30 2003-2004
growth in OACR staff size. The low completion
percentage in 2005-2006 is consistent with greater 20
time spent on each project than planned. 10

During 2005-2006, 71% of available time, or 14,766 0
hours, was spent on audits. Internal audits were
planned based on evaluation of risk and included
input from university management.


Table 4-Trend Analysis of Projects Planned/Completed




2003-2004 21 20 15 7 22
2004-2005 27 21 17 4 21
2005-2006 34 32 16 3 19*

Table 6 lists reports issued this period.
Client Surveys
(11 Responses)


Audit
Client Surveys Performance

Client surveys completed at the conclusion of each
engagement reflect that OACR services are well
received. Ninety-eight percent of survey Audit Report 44%
responses indicated ratings of either good or
excellent in all categories.


Audit Team



0% 20% 40% 60% 80%
Excellent U Good O Fair O Poor


2005-2006 7













AUDIT REPORT SUMMARIES WebCT Vista

The summary of audits issued profiles major We audited the University's online course
engagements completed during the fiscal year. The management system, WebCT Vista. The primary
subjects of the reports illustrate the commitment to objective of this audit was to determine the
proactive and diverse coverage. We conducted adequacy of the internal control system that
audits of major business processes including ensures efficient operation, information security
University payroll, travel, and cashiering. We and compliance with applicable governance over
reviewed internal controls in the Parking, Utilities WebCT Vista. Under the oversight of the Office of
and Telecommunications auxiliaries. Our Information Technology, WebCT Vista is effectively
information technology audits this year focused on providing services to a significant number of
the web-based student course system and students and faculty. In Fall 2005 it was used by
information security management at large units. In approximately 34,000 students and 900 faculty.
the research area we looked at the process for Opportunities for improvement were identified
procuring and awarding contracts to vendors with applicable to change management, a business
scientific or specialized expertise and at the continuity plan, review of production data and
procedure for reporting labor charges allocated to data base administrator training.
federally funded research projects. We audited
Student Government administration and University Travel
operations emphasizing Activity & Service fee-
funded activities. We continued to provide audit We audited travel transactions processed through
services to the Direct Support Organizations at the the myUFL system for the University of Florida and
UF Foundation and University Athletic Association affiliated organizations such as the University of
by performing audits and working with their audit Florida Foundation. Travel expenditures processed
committees. during the 2004-2005 fiscal year exceeded $28
million. We found internal controls over the
Telecommunications and Cellular Charges processing and accounting for travel to be generally
adequate to ensure compliance with established
In our audit of the Telecommunications, we
rules, policies and procedures. We noted
determined that telecommunications charges were, r r. We n
nd t tel at he were opportunities for improvement in the monitoring of
billed and collected timely and that they were
adequately supported at rates that sufficiently expense reports and in monitoring for duplicate
covered operating costs. We found that campus payments. We also found opportunities for
units did not always perform sufficient review of improving the controls over the distribution of
charges to determine that only authorized and travel checks, establishment of travel
official business charges were paid. Subsequent to authorizations and in the procedures for issuing
our audit, Telecommunications implemented a travel advances.
billing system that provides a sufficient level of
detail to determine if charges are correct.
Additionally, we found that departments did not
always perform a cost comparison/benefit analysis
to support selection of a cellular plan or maintain
documentation of the analysis performed. The
University Controller agreed to reissue guidelines
for monitoring telephone invoices and for cell
phone use and charges.








2005-2006 8












University Athletic Association Gator Additionally, we noted that approving time and
Sportshop reviewing the preliminary paylists prior to
finalizing payroll will reduce the volume of
The objective of this audit was to assess the incorrect payments to employees. Opportunities
adequacy and effectiveness of the internal control were also identified to improve internal controls in
systems in purchasing and inventory, sales and role security and access management.
revenues, payroll and temporary services
expenditures and information technology. The Foundation Gift Collections
Gator Sportshop retail operation, generating
revenues in excess of $2 million per year, was We audited university units that collected gifts for
effectively achieving its mission and operational deposit with the Foundation. All gifts solidted in
goals in providing a retail outlet for UF fans, the name of and received for the benefit of the
students and alumni. The Athletic Assodation University of Florida must be deposited in one of
agreed to develop and formally adopt written over 5,800 funds administered by the Foundation.
policies and procedures for the Sportshop in the We found that written polices and procedures were
areas of receiving merchandise, sales and not clearly communicated regarding gift
collections, and game-day souvenir stand processing. We also noted that some university
accountability. units were not making timely deposits or
reconciling deposits to Foundation records.
University Cashiering

In the Cashiering audit, we noted that the
Cashiering function had adequately designed and
implemented controls. As the point of receipt for all
University collections, including student fees,
accounts receivable and loan collections, the
University Cashier collected approximately $670
million in the 2004-2005 fiscal year. The Cashier
provides change, processes collections for deposit,
and coordinates the physical transfer of collections
from campus units, including credit card payments
accepted by over 70 campus entities. Although
University directives require that credit and debit/
ATM card transactions be deposited by the next
business day, we found that some departments did Emerson Hall
not deposit these transactions timely. Some
departments failed to use locked bags when
transporting cash between buildings. Student Government

University Payroll The scope of Student Government administration
and operations audit emphasized accounting for
The University processed payroll for Activity and Service fee funded activities. The
approximately 25,000 employees, totaling $1.05 controls for Student Government administration
billion, during the 2004-2005 fiscal year. Our audit and operations were designed adequately and
concluded that internal controls were designed operating effectively. Timeliness of reconciliations
adequately and operating effectively to ensure that with official university records and the clarification
payroll is calculated, recorded and disbursed for the establishment and use of reserve accounts
accurately for services performed. Payroll were comments developed for improving fiscal
adjustments could be reduced if departments controls.
ensure that job actions are processed timely. To
that end, an electronic personnel action form (ePAF)
will be implemented to enhance the input process.


2005-2006 9












Unit-Based Information Security University Athletic Association Cashiering
Management
The UAA Cashiering office is the focal point for all
We audited information security management at 25 UAA collections, which totaled over $27 million for
university units for controls in place over restricted the 6-month period ending March 31, 2006. The
and sensitive data and for compliance with Office of Cashier provides change, processes collections for
Information Technology's security policies and deposits, coordinates the physical transfer of
procedures. While most areas had excellent IT collections from UAA departments and is the
security, improvement opportunities existed custodian of a change fund that ranges from
campuswide in data backup/recovery procedures $45,000 to $95,000. Our audit concluded that the
which could hamper operations in the event of a UAA Cashier's office is effectively achieving its
disaster, such as a hurricane or fire. operational goals and has adequately designed
controls. Suggestions for improvement included
Transportation and Parking the adoption of formal deposit and reconciliation
procedures.
The Transportation and Parking services (TAPS)
audit focused on the evaluation of internal controls Subrecipient Contracts
associated with sales and accounting for revenue,
purchasing and disbursement activities and Our audit of subrecipient contracting and
compliance with bonded debt. TAPS is a self- procurement practices reflected that they were
supporting auxiliary responsible for issuing decals designed adequately and operating effectively. The
for campus parking and collecting fines for parking Division of Sponsored Research reviews, approves
violations. Operating revenues were nearly $14 and executes contracts to vendors while three
million for the 2004-2005 fiscal year. We found that campus units, Engineering, IFAS and the Main
TAPS achieved their stated mission of providing a Contracts and Grants, monitor them. We
customer focused parking program for the recommended that the three offices develop a
University community. Opportunities for consistent monitoring process and that they
improvement were found in the accounting for develop procedures to improve the processing of
parking garage revenues, accountability for decal contract payments.
stock, monitoring payroll deduction collections and
monitoring fines revenues. Effort Reporting

University Utilities Effort reporting is mandated by the federal
government to verify that labor charges to
University Utilities, a Physical Plant Department, federally sponsored agreements are reasonable and
procures utility services from external vendors, reflect actual work performed. The Effort
maintains distribution networks, reads meters, Reporting System, currently available through
collects and disposes of refuse and provides myUFL, is designed to capture the information in
accounting support and coordination for utility order to be in compliance with federal standards.
services. Our audit concluded that controls were We found that the design of the Effort Reporting
designed adequately and operating effectively to system needed improvement. The Division of
ensure that utility services rates were properly Sponsored Research, Finance and Administration
calculated, billed, collected and recorded. and the Office of the Provost agreed to collaborate
Opportunities for improvement communicated to to identify the best approach to improve system
management included improved procedures for design. Input from faculty will be solicited in order
monitoring future rate calculations, identification to determine the best method to emphasize the role
and classification of direct vs. indirect costs, and of individual researchers in the verification
maintaining adequate reserves. process.






2005-2006 10











University of Florida Foundation Effort Distribution
Application Access Management
2% 23%
This audit evaluated the internal controls in place
at the Foundation to manage access to 45%
applications and ensure accuracy and integrity of 18%
data. We found that controls in general were
designed adequately and operating effectively. We 12%
identified opportunities for improvement in the General Univerity Service and Support
rr r General University Service and Support
request and authorization of role security, and in ] University Governance and Publications
procedures to ensure the appropriateness of all 10 DSO Service
current users. D Consultations and Advisory Reviews
E Other
University of Florida Foundation
Restricted Gifts During fiscal year 2005-2006, 1,478 hours were
spent on MAS, which represented 7% of available
The Foundation serves as the fundraising arm and hours. A significant portion of MAS effort was
processing agent of donor's funds and annually expended on advisory reviews, consultations and
disburses funds to University units for use in general University service and support. Following
accordance with donor intent. Each college or are summaries of MAS projects and service/
department within the University is responsible support:
for overseeing the administration and proper use
of these funds to ensure donor intent compliance. Executive Travel and Reimbursements
Our audit evaluated the design and effectiveness
of controls to promote the use of restricted funds The objective of this project was to review the
in accordance with donor intent and Foundation effectiveness of processing controls over executive
policies and procedures. Foundation fund reimbursements and evaluate their propriety and
establishment, donor intent communication, and compliance with established policies and
fund use in accordance with donor intent were procedures. While reimbursements were found to
determined to be generally adequate. be reasonable and appropriate, we communicated
suggestions to enhance processing procedures.

MANAGEMENT ADVISORY Florida Group Practice Billing
SERVICES The objective was to review the Florida Group
Practice billing format to determine the adequacy of
OACR is committed to providing proactive, information provided to patient payees. The FGP
preventive advice on internal controls, operations agreed to reevaluate the current billing format and
and compliance. Requests for management recommendations were made to assist in making
advisory services (MAS) usually come from various the user statements more "user friendly."
management levels throughout the University. The
information provided through these services Health Science Center (HSC) Security
assists management in decision making and in Program for Information and Computing
improving operations. Results of these types of Environment (SPICE)
services are usually communicated through
management letters. SPICE was designed to protect the security and
privacy of information that is managed by the HSC
OACR actively provides advisory reviews, by ensuring that appropriate administrative,
consulting assistance, training and training tools, technical, and physical safeguards are in place. The
and post-audit assistance. The following chart program includes policies and procedures that
illustrates the MAS types performed and the comply with federal security and privacy
percentage of time spent. regulations, state law, and University of Florida IT
security policies. In an advisory capacity, we


2005-2006 11











participated in the SPICE compliance team's efforts restitution of $400,000 received by the University
to develop a process for recurring evaluation of during 2005-2006.
individual HSC units.
Significant issues from investigative reviews are
General Consultation Services summarized as follows:

During the fiscal year, OACR provided MAS Resource Misuse
consulting services in response to requests from
many University-related entities including, the Concerns were presented to OACR that an
University President, The Vice President for employee of the College of Pharmacy used a
Finance and Administration, the University of university owned vehicle for personal benefit. An
Florida Foundation, the Warrington College of OACR investigation confirmed the misuse and
Business and the College of Medicine. noted that the employee did not maintain vehicle
log records. Recommendation included the
General University Service maintenance of vehicle log records.

General service to the University includes serving Conflict of Interest
on advisory committees such as Sarbanes-Oxley,
Auxiliary and Information Technology Advisory An allegation stated that a College of
Council, as well as time spent serving on search Dentistry faculty member participated in outside
committees for significant University positions. activities undisclosed to the University. It was
confirmed that the faculty member participated
Newsletter and received payment for outside activities
undisclosed to the University and did not fully
Quarterly newsletters were distributed campus- record annual leave when involved in these
wide with regular features that include highlights activities. A lack of administrator understanding
from projects and campus-wide issues. Copies are and compliance with disclosure of outside activities
available at http://oacr.ufl.edu. and financial interests policies was identified. This
was immediately addressed by the College and
Post-Audit Assistance leave use records were corrected.

OACR routinely provides support and guidance on An allegation presented concerns that kickbacks
the implementation of planned actions. were received in the hiring of consultants at
Bridges by an employee with an undisclosed
company. Based on OACR review no merit was
INVESTIGATIONS found to the allegation of an improper
compensation arrangement with consultants hired.
However, the employee failed to properly disclose
The OACR receives complaints and allegations of to the University outside financial interests.
fiscal improprieties from a variety of internal and Internal control issues identified during the review
external sources, including hotline calls, direct included: consultant service purchase in excess of
correspondence, and referrals from other $50,000 without a contract; use of unencumbered
university offices and state agencies. The disbursements in consultant service purchase;
investigative reviews conducted by OACR have hiring practices that did not reflect involvement of
dual objectives of responding to facts of allegations supervisory staff; and use of a vendor listed in the
and addressing relevant fiscal and administrative myUFL system to operate as a pass-through in the
control weaknesses. Where appropriate, contracting of independent consultants.
recommendations for improvements of internal
controls are communicated to management and are
monitored for implementation. In total, 1084 hours,
or 5% of available hours were committed to
investigative efforts. Investigative efforts
performed during 2003-2004 resulted in the


2005-2006 12












FOLLOW-UP Quarterly follow-up procedures were conducted
throughout the year and their results were
Audit reports include auditor's comments and communicated to University management and the
planned actions developed and agreed to by the Board of Trustees Audit Committee. For the report
audit team and management and the estimated time period, the OACR staff expended 1,031 hours or 5% of
for their implementation. Reports issued by available hours for follow-up reviews.
external auditors, including the Office of the Auditor
General, contain recommendations for which Table 5 summarizes the results of our follow-up
university management also provides a corrective activities as of June 30, 2006.
implementation plan.
As reflected by the summarized information,
Standard 2500, Standardsfor the Professional Practice of implementation percentages for audit
Internal Auditing, promulgated by the Institute of recommendations and planned actions were higher
Internal Auditors, requires that the internal this period. Several action plans involved significant
auditor determine that management has taken information technology and data processing
appropriate action regarding reported audit resources for implementation and therefore were not
comments. implemented within the anticipated time frame.


Table 5-Follow-Up Activities




1 Academic Affairs 65 44 18 3 68% 69%
2 Finance & Admin. 73 52 19 2 71% 79%
3 Health Affairs 6 5 1 0 83% 68%
4 IFAS 11 5 6 0 45% N/A
5 Student Affairs 5 4 1 0 80% N/A
6 UAA 26 22 4 0 85% 50%
7 UFF 6 5 1 0 83% 86%




The planned action "not to be implemented" generally reflects changing conditions that render the plan obsolete.


Planned Action
Implementation Percentage
80
70 68 7
60
50
40
30
20
10 83% 5% 80% 83%


1 2 3 4 5 6 7


2005-2006 13











OTHER ACTIVITIES

Professional Activities
Member State University Auditors
OACR staff participated in various national Consortium (SUAC)
initiatives, training, and organizations including:
Participant Florida Audit Forum
Member Institute of Internal Auditors (IIA)

Member Association of Healthcare Internal University Service
Auditors (AHIA)
During 2005-2006, OACR members participated in
Member American Institute of Certified Public various university-wide initiatives and
Accountants (AICPA) assignments including:

Member Florida Institute of Certified Public Member Auxiliary Review Committee
Accountants (FICPA)
Member University Information Technology
Member Association of Certified Fraud Advisory Committee Information Security
Examiners (ACFE) Management (ITAC-ISM)

Member IIA North Central Florida Chapter Member University Information Technology
Advisory Committee Network Infrastructure
President IIA North Central Florida Chapter (ITAC-NI)

Treasurer IIA North Central Florida Chapter Member Sarbanes-Oxley Committee

Board Member IIA North Central Florida Member University of Florida
Chapter Communications Network (UFCN)

Program Committee IIA North Central Florida Presenter Division of Sponsored Research -
Chapter Research Administration Training Series

Planning and Organization North Central Vi y I P
Visitor University IT Planning Retreat
Florida IIA Chapter Spring Conference

Presenter North Central Florida IIA Chapter Participant Information Technology Security
Spring Conference Awareness day

Webmaster IIA North Central Florida Chapter

Volunteer Instructor IIA

Session Facilitator Large campus audit
directors roundtable, Association of College and
University Auditors

Presenter International Conference of the IIA

Member Higher Education Quality
Assessment Team for the Oregon University
System IIA Spring Conference, Best Western Hotel


2005-2006 14















Table 6-Reports Issued 2005-06




Florida Group Practice Billing As of July 1, 2005 8/8/05 72.200503 MAS
Telecommunications and Cellular
Telecat sa s of April 1, 2005 10/18/05 UF-05-443-22 Internal Audit
Charges
WebCT Vista Online Course As of October 14, 11/4/05 UF-06-472-24 Ineal Audit
Management System 2005
University Travel As of June 30, 2005 11/8/05 UF-06-459-11 Internal Audit

UAA Gator Sportshop As of August 31' 11/30/05 UF-06-456-03 Internial Audit

HSC Security Program for
Information & Computing 03/22/05 12/7/05 12/14/05 72.200602 MAS
Environment (SPICE)


As of November
Uiiversity Cashiering As ofAugust 1, 1/10/06 UF-06-457-09 Intemal Audit

University Payroll ofNovember 1/30/06 UF-06-458-10 Internal Audit
30, 2005

Foundation Gift Collections As of October 31, 2/24/06 UF-06-451-03 Intenial Audit

Student Govemment As of June 30, 2005 2/28/06 UF-06-461-13 Internal Audit
Unit-Based Information Security As of December 31, 5/12/06 UF-06-474-26 nt ui.


Transportation & Parking As of June 30, 2005 5/24/06 UF-06-478-03 Internal Audit

irsity Utilities As of March 31, Inte l Audit

UAA Cashiering* AsofMar 8/3/06 UF-06-454-06 Internal Audit
2006

Subreipiet Contrat As of NovemberInte l Audit
21005

Effort Reporting* AofNovember 9/1/06 UF-06-477-29 Internal Audit
30, 2005


Executive Travel and
UFFApplicationAccess As of April 30, 2006 9/6/06 UF-06-450-02 Intemal Audit

euive Travel and 7/1/05 6/30/06 8/21/06 72.200601 MAS
Reimbursements*
UFF Restricted Gifts* 1/1/05 12/31/05 10/06 UF-06-449-01 Intemal Audit
*Substantially completed as of June 30, 2006






2005-2006 15











OACR AUDIT CHARTER

Introduction

Internal auditing is an independent, objective assurance integrity, honesty, loyalty, morality, dignity, and
and consulting activity designed to add value and confidentiality consistent with the Institute of Internal
improve an organization's operations. It helps an Auditors Code of Ethics. The Institute's Standards for
organization to accomplish its objectives by bringing a the Professional Practice of Internal Auditing shall
systematic, disciplined approach to evaluate and constitute the operating procedures for the Office.
improve the effectiveness of risk management, control,
and governance processes. The Office of Audit and Duties and Responsibilities
Compliance Review (OACR) at the University of Florida
administers the internal audit program for the (a) Conduct and coordinate audits, investigations,
University with the objectives to assist members of the and management reviews relating to the
University and the Board of Trustees in the effective programs and operations of the university and
discharge of their responsibilities. To this end, the OACR its support organizations.
furnishes them with analyses, appraisals,
recommendations, counsel, andinformation concerning (b) Conduct, supervise, or coordinate other
the activities and organizations reviewed. activities carried out or financed by the
university for the purpose of promoting
Mission economy and efficiency in the administration
of, or preventing and detecting fraud and abuse
The Office of Audit and Compliance Review serves the in, its programs and operations.
University of Florida and its support organizations,
including its direct support organizations and Faculty (c) Receive complaints and coordinate all activities
Pradice Plan corporations. It provides a central point of the University as required by the Whistle-
for coordination of and oversight for activities that blower's Act pursuant to Sections 112.3187-
promote accountability, integrity, efficiency, and 112.31895, Florida Statutes.
compliance.
(d) In accordance with the University' s Policy on
Organization, Independence, Authority Fraudulent and Dishonest Acts, receive and
consider complaints that do not meet the
The university president appoints the Chief Audit criteria for an investigation under the Whistle-
Executive. The OACR operates under the general blower's Act and conduct, supervise, or
oversight of the university president and reports to the coordinate such inquiries, investigations, or
Board of Trustees through its audit committee as to the reviews as appropriate.
process and content of its reports. This reporting
relationship promotes independence and assures (e) Keep the University president, vice president
adequate consideration of audit findings and planned for finance and administration, management
actions. and the audit committee for the University's
Board of Trustees informed concerning fraud,
In performing its function, the OACR has no direct abuses, and internal control deficiencies
responsibility or authority over any of the activities it relating to programs and operations, initiate
reviews. Therefore, the audit, review and appraisal do corrective actions, and report on the progress
not relieve other persons in the university of the made in implementing corrective actions.
responsibilities assigned to them. The OACR is
authorized full and unrestricted access to all areas and (f) Ensure effective coordination and cooperation
information sources necessary to carry out its activities. between the Auditor General, federal auditors,
Documents and information provided to OACR staff and other governmental bodies and external
during an engagement are handled in the same prudent auditors with a view toward avoiding
manner as by those employees normally accountable duplication.
for them.
(g) Review, as appropriate, rules and procedures
Professional Standards relating to the programs and operations of the
university and make recommendations
The OACR staff members have a responsibility to the conceming their impact.
interest of those they serve and should refrain from
entering into any activity that may create a conflict of In the performance of these services, Office of Audit and
interest. They have an obligation of self-discipline above Compliance Review will ensure that an appropriate
and beyond the requirements of laws and regulations. balance is maintained between audit, investigative, and
They should uphold and demonstrate qualities of other activities. Detailed operational procedures for
the OACR will be established and presented for the
approval of the president and the audit committee.


2005-2006 16











CONTACTS & RESOURCES Equal Opportunity Programs Office
http://www.hr.ufl.edu/eeo/default.htm
The Office of Audit & Compliance Review works (352) 392-6004
collaboratively and cooperatively with many other
offices. Below is a partial listing of the contacts and University Ombudsman
resources used frequently. http://www.ombudsman.ufl.edu/
(352) 392-1308
State Auditor General
http://www.state.fl.us/audgen/ University General Counsel
Gainesville Office: (352) 334-1740 http://www.generalcounsel.ufl.edu/
Campus Office: (352) 392-5255 (352) 392-1358

FL Department of Financial Services University Police Department
Consumer Helpline: 1-800-342-2762 http://www.police.ufl.edu/
Get Lean Hotline: 1-800-GET LEAN (352) 392-1111
www.fldfs.com
www.fldfs.com Shands Auditing
University Controller's Office (352) 265-7969
http://fa.ufl.edu/uco/
(352) 392-1321 University Vice President for Human Resources
http://www.hr.ufl.edu/
Board of Governors (352) 392-1075
http://www.fldcu.org/
p://www.fldcu.org/ University Vice-President for Finance &
UF Board of Trustees Administration
http://www.trustees.ufl.edu/ http://www.admin.ufl.edu/
(352) 392-1336
Health Science Center Compliance
http://www.med.ufl.edu/complian/
(352) 265-8359

Division of Sponsored Research
http://rgp.ufl.edu/research/
(352) 392-1582

Institutional Review Board
http://irb.ufl.edu/

University Contracts & Grants
http://fa.ufl.edu/cg/
(352) 392-1235

IFAS Sponsored Programs
http://grants.ifas.ufl.edu
(352) 392-2356

Engineering Contract & Grants
http://www.eng.ufl.edu/home/cng/
(352) 392-6626

University Athletic Association
http://www.uaa.ufl.edu/
(352) 375-4683





2005-2006 17




University of Florida Home Page
© 2004 - 2010 University of Florida George A. Smathers Libraries.
All rights reserved.

Acceptable Use, Copyright, and Disclaimer Statement
Last updated October 10, 2010 - - mvs