• TABLE OF CONTENTS
HIDE
 Front Cover
 Message from the Chief Audit Executive...
 Introduction
 Operations
 Audits and other planned revie...
 Audit report summaries
 Management advisory services
 Investigations
 Follow-up
 Other activities
 Reports issued
 Contacts and resources
 Back Cover














Group Title: University of Florida Office of Audit and Compliance Review annual report
Title: University of Florida Office of Audit and Compliance Review Annual Report
ALL VOLUMES CITATION PDF VIEWER THUMBNAILS PAGE IMAGE ZOOMABLE
Full Citation
STANDARD VIEW MARC VIEW
Permanent Link: http://ufdc.ufl.edu/UF00072255/00006
 Material Information
Title: University of Florida Office of Audit and Compliance Review Annual Report
Series Title: University of Florida Office of Audit and Compliance Review Annual Report
Physical Description: Serial
Language: English
Creator: University of Florida Office of Audit and Compliance Review
Publisher: University of Florida Office of Audit and Compliance Review
Place of Publication: Gainesville, Fla.
Publication Date: 2008
 Record Information
Bibliographic ID: UF00072255
Volume ID: VID00006
Source Institution: University of Florida
Rights Management: All rights reserved by the source institution and holding location.

Downloads

This item has the following downloads:

Annual_Report0708 ( PDF )


Table of Contents
    Front Cover
        Front Cover
    Message from the Chief Audit Executive Nur Erenguc, CPA, CFE
        Page 1
    Introduction
        Page 2
    Operations
        Page 2
        Page 3
        Page 4
        Page 5
    Audits and other planned reviews
        Page 6
    Audit report summaries
        Page 7
        Page 8
        Page 9
    Management advisory services
        Page 10
        Page 11
    Investigations
        Page 12
    Follow-up
        Page 13
    Other activities
        Page 14
    Reports issued
        Page 15
    Contacts and resources
        Page 16
    Back Cover
        Back Cover
Full Text












I I




UF UNIVERSITY of
UF FLORIDA








UNIVESITYOFFLORI OFFICE O AUDIT & COMPLIANCEREVI


In tro d u action ........................................ ...... ............. 2

O p eration s ........................................ ........ ............. 2
Goals and Objectives
St i ,ii, and Other Resources
Organization Chart
Staff Training
Expenditure Analysis
Time Analysis
Time Allocation

Audits and Other Planned Reviews ............................ 6
Trend Analysis
Client Surveys

Audit Report Summaries ......................................... 7

Management Advisory
Services ...................................... ............ .. 11

Investigations .................................. ...... .......... ..... 12

Follow -Up.............................................. 13

O their A activities ............................... ...... ............. 14

R reports Issued ................................. ...... .......... ..... 15

Contacts and Resources ........................... .......... 16


UF Butterfly Garden


Message from
the Chief
Audit Executive
Nur Erenguc,
CPA, CFE




The 2007-2008 Annual Report provides a summary of the Office of
Audit and Compliance Review's (OACR) activities for the year and
presents data for benchmarking the effectiveness of its operations.

One of the most significant activities of the period was the documen-
tation and assessment of campus wide business process controls and
control environment through validation visits conducted with 50
randomly selected units. In addition to identifying unit level internal
control improvement opportunities, this approach provided a basis to
evaluate the internal controls on an institutional basis.

During this period we also:

S Completed a significant portion of the planned projects and
responded to advisory review requests.
S Maintained an effective follow-up program.
S Participated in the internal control training and other orienta-
tion and training activities including the Research Administra-
tor Training series and New Chair/Dean orientation sessions
promoted by the Office of Research and the Office of the Provost,
respectively.
S Initiated a risk based long-term audit plan for the university, the
University of Florida Athletic Association and the University of
Florida Foundation.
S Facilitated the reviews for issues brought forward through the
24/7 anonymous hotline managed by a contracted provider.
S Initiated the audit of Facilities Planning and Construction as a
co-sourced arrangement with an external firm uniquely experi-
enced in performance of construction audits.

As change agents, we know that change is inevitable. During this
period, the OACR had its share of changes. We successfully recruited
for the senior audit manager position vacated through retirement; bid
farewell to a senior auditor and student auditors as their academic
association with the university came to an end; moved from Tigert
Hall to the Human Resources Building; and did not escape the budget
cuts implemented in response to state budget shortcomings.

We hope to continue serving the university and its affiliated organiza-
tions as promoters of positive change for improved accountability.


Nur Erenguc


Annual Report 2007-2008







IUNIVE SIT OF FOIDA


INTRODUCTION


The mission of the Office of Audit and Compliance
Review (OACR) is to serve the University of Florida and
its affiliated support organizations by providing a central
point for the coordination of activities that promote ac-
countability, integrity, and efficiency for the University of
Florida.

In 2007-2008, we moved our office from UF's main admin-
istration building to a newly renovated space off-campus;
we successfully
recruited per-
sonnel for four
key positions,
including a re- a`m
hire of a former
employee. We
coordinated the -
execution of an 'a
outsourced audit 7
in a specialized
area and contin-
ued to provide
audit support
for the major
direct support
organizations,
UF Foundation
and University
Athletic Asso-
ciation. In 2008-
2009, we expect OACR Staff (From left to right) Joe Cannella, Vito F
to continue to Marilyn Velez, Suzanne Newman, Roger Frank, Ch(
provide proac-
tive assistance
in strengthening internal controls in a decentralized
environment as well conducting audits to promote good
business practices.



OPERATIONS

Goals and Objectives

A key operational objective for the period was the
completion of the first year of the 2007-2010 audit work
plan. Our work plan included university audits as well
as audits of the university's direct support and affiliated
organizations.

We continued working on initiatives started during the
prior period, including the management of the compli-


ance hotline. We also validated the results of the Control
Self-Assessment and produced a report highlighting
areas for improving internal controls university-wide. As
part of the employee fiscal management certification
program, we co-facilitated with the University Control-
ler's Office eight sessions of Internal Controls at UF. We
were proactive in outreach to newly hired deans to intro-
duce them to the OACR's role in assisting academic
administrators.


Staffing and
U Other
Resources

During 2007-
2008 OACR
hired one
S1 senior audit
manager, two
W senior auditors
and a staff IT
auditor. In
order to
respond to
budget
cutbacks,
we left a staff
auditor posi
tion vacant and
Reinhart, Stan Anders, Nur Erenguc, Craig Reed, when a staff
Jeff Capehart, Brian Mikell auditor re-
signed, we left
that position
vacant to meet anticipated 2008-2009 budget cutbacks.
We expect to fill a senior auditor vacancy in the coming
year and recruit graduate students to help offset our staff
auditor position vacancies.

We moved off-campus from our office in Tigert Hall,
which housed the OACR for at least 30 years, to the Hu-
man Resource Services building at 903 West University
Avenue. This move provided better accommodations for
our entire staff in a newly furnished space with state-of-
the-art telecommunications equipment.

To better align audit resources with the university units
expecting and supporting audit efforts, we continued to
utilize a funding methodology that meets these needs and
expectations.


2 Annual Report


ite, Lily
ol Chol,







IUNIVE SIT OF FOIDA


INTRODUCTION


The mission of the Office of Audit and Compliance
Review (OACR) is to serve the University of Florida and
its affiliated support organizations by providing a central
point for the coordination of activities that promote ac-
countability, integrity, and efficiency for the University of
Florida.

In 2007-2008, we moved our office from UF's main admin-
istration building to a newly renovated space off-campus;
we successfully
recruited per-
sonnel for four
key positions,
including a re- a`m
hire of a former
employee. We
coordinated the -
execution of an 'a
outsourced audit 7
in a specialized
area and contin-
ued to provide
audit support
for the major
direct support
organizations,
UF Foundation
and University
Athletic Asso-
ciation. In 2008-
2009, we expect OACR Staff (From left to right) Joe Cannella, Vito F
to continue to Marilyn Velez, Suzanne Newman, Roger Frank, Ch(
provide proac-
tive assistance
in strengthening internal controls in a decentralized
environment as well conducting audits to promote good
business practices.



OPERATIONS

Goals and Objectives

A key operational objective for the period was the
completion of the first year of the 2007-2010 audit work
plan. Our work plan included university audits as well
as audits of the university's direct support and affiliated
organizations.

We continued working on initiatives started during the
prior period, including the management of the compli-


ance hotline. We also validated the results of the Control
Self-Assessment and produced a report highlighting
areas for improving internal controls university-wide. As
part of the employee fiscal management certification
program, we co-facilitated with the University Control-
ler's Office eight sessions of Internal Controls at UF. We
were proactive in outreach to newly hired deans to intro-
duce them to the OACR's role in assisting academic
administrators.


Staffing and
U Other
Resources

During 2007-
2008 OACR
hired one
S1 senior audit
manager, two
W senior auditors
and a staff IT
auditor. In
order to
respond to
budget
cutbacks,
we left a staff
auditor posi
tion vacant and
Reinhart, Stan Anders, Nur Erenguc, Craig Reed, when a staff
Jeff Capehart, Brian Mikell auditor re-
signed, we left
that position
vacant to meet anticipated 2008-2009 budget cutbacks.
We expect to fill a senior auditor vacancy in the coming
year and recruit graduate students to help offset our staff
auditor position vacancies.

We moved off-campus from our office in Tigert Hall,
which housed the OACR for at least 30 years, to the Hu-
man Resource Services building at 903 West University
Avenue. This move provided better accommodations for
our entire staff in a newly furnished space with state-of-
the-art telecommunications equipment.

To better align audit resources with the university units
expecting and supporting audit efforts, we continued to
utilize a funding methodology that meets these needs and
expectations.


2 Annual Report


ite, Lily
ol Chol,








I sFICE OFzAUDIT &COMPLIANCEREVIEW


ORGANIZATION CHART


Suzanne Newman
Administrative
Coordinator
..j


Staff Training

Continuing professional education is highly valued
and attendance to relevant conferences and seminars is
promoted. Table 1 reflects a listing of staff participation
in formal training programs in 2007-2008.


Table 1-Staff Trainin


Association of Certified Fraud
Examiners 20 1


Florida Institute of Certified Public
Accountants 32 4

Th _ntiteo I n al ,_'..1',1,,1 ti. ll._I !_i
The Institute of Internal Auditors 82 4
I_ _. ,t ..t j Il.. .. l'. 4 '. 1


2007-2008 3


I _







IUNIVE SIT OF FOIDA


Expenditure Analysis

The OACR expenditures by category are illustrated in
Table 2. Our primary budgetary commitment remains
professional staff salaries. This year, we purchased audit
services from an auditing firm and we renewed our con-
tract with a firm that provides intake services for anony-
mous compliance reporting.

Telephone represented the largest percentage of operat-
ing expense this year due the purchase of a new tele-
phone system.


Operating Expenses


" OfficeSupplies
" Personnel Expenses
STelephone/Postage
" Dues/Subscriptions
SMaintenance
* Computer Supplies
I Printing
E Travel/Other


Table 2 Analysis of Expenditures

I20062007 20072l00


Salaries
Other Personal Services (OPS)
Fixed Assets
Operating Expenses
Training
Consultants
Compliance Hotline
Personnel Recruitment


$1,085,247
34,733
2,951
28,713
17,990
15,811
9,500
4,408


$1,174,551
22,145
2,652
30,663
16,985
93,800
9,500


Toa $ 9 $,0


Time Analysis


Table 3 provides a comparison between time available
as planned and actual time available for projects. Actual
hours lost due to position vacancies exceeded the planned
amount, having an impact on project progress and com-


pletion. The impact was mitigated by the 1,194 hours of
overtime, resulting in available hours for the period being
only 5.1% less than planned.


Table 3 Planned/Actual Hours


Time Available 14 x 2,040 28,560 28,560


Less: Adjustment for Position Vacancies
Training/Leave Use/Operational Support
Total
Excess hours worked


(2,000)
(8,196)


(4,335)
(7,995)
(12,330)
1194


(2,335)
201

1,194


4 Annual Report








I OFFICE OFAUDIT* &mCOMPLIACEREVIE


Time Allocation


Chart A compares the planned activity mix for total
time available with actual effort expended, while Chart
B provides a comparison between prior year and cur-
rent allocation of time available for projects. Actual time
by category did not vary significantly from the plan. In
comparison with the prior year, time spent on follow up,
and operational support remained constant. The shift in
time from Management Advisory Services (MAS) to audit
projects and investigations resulted from an increase in
hotline and other complaints, and the lack of a major MAS
project such as the previous year's control self assessment
initiative.




Chart A Allocation of Total Time
Planned vs. Actual


Training/Leave
Use/OpSupp

Follow Up


Investigations


MAS


Audits


Direct time percentages are established as a productivity
goal for each professional position and for the office as a
whole. Direct time excludes administration, service sup-
port, leave and training.

Chart C compares direct time achieved in the last two fis-
cal years. An emphasis on training new staff and increase
in staff leave use did not allow us to achieve the targeted
goal of 72%.








Chart B Allocation of Time Available
for Projects Prior vs. Current Year


Operational
Support

Follow Up


Investigations


MAS


Audits


0% 10% 20% 30% 40% 50%

*Actual Planned


0% 20% 40% 60% 80%

2007-2008 2006-2007


Chart C Office Direct Time by Fiscal Years


75% 73%


68% 71%


Quarter


Quarter


Quarter
Goal 72%


I 2006-2007 I 2007-2008


71% 69%


Total Year


2007-2008 5


13/



56%





20%

J6%o


75%


Quarter










AUDITS AND OTHER
PLANNED REVIEWS Trend Analysis of Projects
Planned/Completed
Trend Analysis so
75
Table 4 reflects a three-year analysis of projects planned 70
and completed. The work plan includes planned audits 60
and advisory reviews.
50 -- 2007-2008
Over the last three years, 75 projects were planned and 63 40 2006-2007
have been completed. Internal audits and Management 0 2005-2006
Advisory Services were planned based on evaluation of
risk and included input from university management. 20

Many of the planned projects not completed are in 10
progress and are included with the following year's work o
plan. Planned MAS engagements do not always result Pl d
Planned Completed
in a project report that would be shown as a completed
project. During 2007-2008, 61% (12,171 hours) of avail-
able time was spent on audits and 13% (2,557 Hours) of
available time was spent on MAS.


Table 4 Trend Analysis of Projects
Planned/Completed




2005-2006 30 26 16 3 19
2006-2007 31 23 12 7 19
2007-2008 28 26 16 9 25


Client Surveys
(12 Responses)
Client Surveys
Audit 13%
In an effort to ensure that OACR services continue to add Performance 7% 70o
and maintain a high quality level, input from clients is
requested at the conclusion of each engagement. Feed- 1wo
back is obtained via client surveys on the overall perfor- Audit Report 2
mance of the engagement, the quality and usefulness of 29% 51%
the report, and the conduct of the audit team. Results
of our client surveys for the year reflect, for the most 1
part, OACR services were well received. Overall, 87% of Audit Team
survey responses from all categories indicated ratings of 7%7
good or excellent.
0% 20% 40% 60% 80% 100%
EPoor I Fair Good 0 Excellent

6 Annual Report


89 75 4 19 6


TOTAL







I OFFICE OFAUDIT* & COMPLIACEREVIE


AUDIT REPORT SUMMARIES


This summary of audit reports profiles major engage-
ments completed during this fiscal year. A major initia-
tive during 2007-2008 was validation of responses to the
Internal Control Self Assessment questionnaire by visiting
50 university units to evaluate the supporting documenta-
tion for selected controls. The subjects of other reports
illustrate our commitment to proactive and significant
coverage through audits of the Shands Cancer Center, En-
vironmental Health & Safety, the Division of Continuing
Education and the E-Learning online course management
system. Audits of other critical functions of the university
such as purchasing cards, fiscal closing procedures and
the tax reporting processes were also conducted during
the period. We continued to conduct audits in UF's larg-
est direct support organizations, the University of Florida
Foundation (UFF) and University Athletic Association
(UAA) as well as an audit of the Athletic Association fund
raising entity, Gator Boosters.

UFF Control Activities

We performed an internal control review of the Founda-
tion using the COSO framework where select control
points within the control environment, risk assessment,
control activities, information and communication,
and monitoring were evaluated. The focused activities
included budgeting, payroll and personnel, travel and
entertainment, procurement and contracts.

Fiscal Closing

At the end of each fiscal year, the university closes its
financial records to ensure that transactions are recorded
in the appropriate period and to promote timely and
accurate compilation of financial reports in accordance
with GAAP. A typical fiscal closing process spans several
months where management ensures that current year
funds are used to their maximum benefit, expenses and/or
revenues are accrued or deferred when necessary, and
funds are properly carried forward. The reliability of the
university financial statements is dependent upon the
adequacy, effectiveness, and completeness of the losing
process.

The objective of this audit was to evaluate the adequacy
and effectiveness of controls related to the closing of gen-
eral accounting and associated subsystems. Specifically,
we evaluated controls associated with:

SPlanning to ensure a timely and coordinated fiscal
closing process.


* Designed procedures to ensure transactions were
recorded in the appropriate period.
* Authorization and monitoring over each subsystem
losing.

UF Shands Cancer Center

The University of Florida Shands Cancer Center (Center)
is an interdisciplinary initiative under the University of
Florida and Shands with a mission to provide state-of-the-
art cancer treatment, to condud research and to foster co-
ordination and collaboration of clinical research findings.
The Center's administrative, research and educational ac-
tivities take place within the University of Florida Health
Sciences Division which indudes the colleges of Dentistry,
Public Health and Health Professions, Medicine, Nursing,
Pharmacy, and Veterinary Medicine. Center membership
includes research and clinical faculty from 2 campuses,
12 colleges and 41 departments. The Center's budgeted
revenue for the 2007 fiscal year was $11.2 million.

The primary objedive of this audit was to evaluate key
controls over the administrative processes of the Center.
Specifically, we focused on the following:

* Information management systems including project
accounting and budget administration
* Payroll and personnel administration
* Purchasing and disbursements
* Asset management including building security

Enivronmental Health & Safety

The university established the Environmental Health and
Safety (EH&S) program in April of 1974, the first program
of its kind within the Florida State University System.
EH&S initially began with a staff of 30 and has grown to
an organization of 78 employees and one of the most com-
prehensive university EH&S programs in the state.

The primary objedive of this audit was to evaluate key
controls in place to ensure compliance with local, state,
and federal laws and regulations for hazardous waste
management and biological safety. Our review focused on
the following specific areas:

* Compliance with current biological safety regulations
and guidelines
* Procedures for the handling and disposal of hazard-
ous waste materials
* Lab inspedions


2007-2008 7







IUNIVE SIT OF FOIDA


Food Vendor Contract

Business Services, organized under the Vice President for
Business Affairs, has oversight for the campus-wide food
services provided through Gator Dining Services. Ara-
mark Educational Services, Inc. (Aramark), a professional
food contractor, has operated Gator Dining Services since
May 1995. The current contract is scheduled to expire on
June 30, 2009. Gator Dining Services includes 32 dining
locations, 4 convenience stores, and the campus-wide
catering service. The university recognized almost $2.5
million from food sales commissions from this contract
during the 2007 fiscal year.

The objective of this audit was to evaluate the key controls
relative to the administrative oversight of the food vendor
contract with primary focus on accounting for sales com-
missions and rent revenues. Additional contract terms
reviewed included:


Food product pricing and portions
Maintenance of food service equipment
Insurance and performance bond
Satisfaction surveys


UAA Budget Control & Travel

The primary objectives of this audit were to evaluate key
controls over:

* Budget adoption, approval, and amendments
* Budget monitoring
* Processing of travel to ensure compliance with NCAA
and UAA policies

UAA utilized a planning calendar to control the budget
process, which begins each January when planning work
sheets are sent to all head coaches and department heads,
and culminates with final approval by the UAA Board of
Directors in June.

The majority of UAA travel expenses involved sports
teams. Coaches recruiting trips, which often included
use of the UAA aviation department, was another major
source of travel expenses.

Division of Continuing Education (DOCE)

DOCE, an auxiliary unit, was organized pursuant to Sec-
tion 6C-8.002, Florida Administrative Code to provide, or
assist units of the university with, a wide variety of con-
tinuing education programs, both credit and non-credit,
designed to meet personal and professional education


goals. The DOCE auxiliary is composed of 35 total units,
including the Dean's Office and five core units.

The primary objective of this audit was to evaluate key
controls in place to promote efficient and effective opera-
tions, accurate financial reporting and compliance with
applicable laws and regulations. Our audit focused on
the DOCE Dean's Office and its five core direct report
units of Conferences, Flexible Learning/Correspondence
Study, Distance Learning, Executive Education, and the
Center for Training, Research, and Education for Environ-
mental Occupations.

UFF Restricted Gifts

The primary objectives of this audit were to evaluate if:

* Restricted funds were appropriately established and
donor intent communicated
* Transfer of restricted funds from the foundation to
the university were authorized and deposited intact
and processed through the appropriate channels
* University units used restricted funds in accordance
with donor intent and university directives

Foundation endowed fund transfers to the university
during calendar year 2006 totaled approximately $16 mil-
lion. We tested 65 endowed restricted funds established
as eminent scholar funds, professorship funds, scholar-
ship funds, fellowship funds, and "other" funds for vari-
ous attributes including use of the funds in accordance
with donor intent. In addition, foundation procedures
were reviewed for 12 funds established during the audit
period.


Facilities Planning and Construction

This audit was conducted by RSM McGladrey, the fifth largest
accounting firm with specialized expertise in construction cost
accounting.

The primary objective of this audit was to assess the
design adequacy of the internal control structure in place
at the Facilities Planning and Construction Division (FPC)
for the construction of major projects and identify pro-
cess improvements. Additional outcomes expected were
a review of contractor compliance, knowledge transfer,
benchmarking, and process documentation. FPC is re-
sponsible to the Vice President for Business Affairs for the
planning and construction of all physical facilities of the
university and the management of its space and physical
resources.


8 Annual Report







I OFFICE OFAUDIT* &mCOMPLIACEREVIE


The key controls of the following processes were evalu-
ated: Budget and Project Setup, Qualifications-Based
Selection and Evaluations, Estimating and Guaranteed
Maximum Price Development, Payment Applications,
Change Orders, Project Monitoring and Communication,
and Project Reconciliation.

UF Internal Controls

The University of Florida's fiscal and administrative
structure is based on a decentralized model. Within this
structure, the deans, directors, and department heads
are responsible for unit-based internal controls. To assist
the units with the evaluation and understanding of their
internal controls, the Office of Audit and Compliance
Review launched a Control Self Assessment program. A
random sample of 50 units was selected to validate the
self assessment and evaluate the supporting documen-
tation for selected controls. A limited review of access
controls and segregation of duties through myUFL role
security was also performed. The review of controls
were in the categories of Control Environment; Budgeting,
Accounting and Financial Reporting; Collection, Deposits and
Cash Funds; Asset Management; Payroll; Human Resource
Management; Purchasing and Disbursements; Research Man-
agement and Support; and Information Technology.

Gator Boosters

Gator Boosters is a not for profit corporation and a Direct
Support Organization of the University of Florida cre-
ated pursuant to Chapter 1004.28, Florida Statutes. Gator
Boosters functions as the fund-raising arm for the Univer-
sity Athletic Association and its mission is to strengthen
the university's athletic program by encouraging private
giving and volunteer leadership. Gator Boosters report-
ed $37.6 million in revenue for the 2007 fiscal year.

We evaluated Gator Boosters' internal control structure
including their control environment, risk assessment,
control activities, information and communication, and
monitoring. Specifically, our audit focused on the poli-
cies and procedures over fundraising, accountability over
revenues and expenditures, and follow-up of prior audit
comments.

Purchasing Card

Significant dollar values and transactional volume make
purchasing card disbursements an area where strong
oversight and continuous auditing minimizes misuse.
To that end, we have implemented yearly audits of the
purchasing card.


As of October 31, 2007, there were approximately 5,000 ac-
tive purchasing cards (PCards). During the 2007 calendar
year, PCard purchases from over 385,000 transactions
totaled more than $77 million. The objective of this audit
was to evaluate the effectiveness of controls in place to de-
termine whether PCard usage was appropriate, including
proper approval of PCard transactions and compliance
with the PCard use guidelines.


Gator Mascot Albert


UAA Financial Aid & Scholarships


The objective of this audit was to evaluate key controls in
place to promote compliance with the National Collegiate
Athletic Association (NCAA) and Southeastern Confer-
ence (SEC) requirements for student-athlete scholarships
and financial aid. Our audit focused on compliance with
Article 15, Financial Aid, of the NCAA Division 1 Manual.

Compliance with the NCAA, SEC, and university rules
related to scholarships and financial aid is the responsibil-
ity of the athletic director. Compliance efforts are jointly
carried out by the UAA associate director of compliance,
the UAA Office of Student Life, the UAA Controller's
Office, and University of Florida Student Financial Affairs.

E-Learning

The Office of Information Technology is responsible for
the general oversight of the E-Learning online course
management system. Administration of the software
application is primarily performed by the Office of Aca-
demic Technology's E-Learning Support Services group.
Server and network administration is performed by the
Open Systems Group within Computing and Network
Services.


2007-2008 9







IUNIVE SIT OF FOIDA


The E-Learning system can be utilized to supplement
face-to-face courses with online materials and tools.
Courses can also be developed and delivered entirely over
the Internet. During the fall 2007 semester, E-Learning
was used by 36,692 students, or approximately 70% of the
entire student population. E-Learning was utilized by
approximately 2,300 faculty members in relation to 2,636
course sections.

The primary objective of this audit was to evaluate the
controls in place to determine whether the E-Learning on-
line course management system was effectively delivered
in a reliable and secure manner.

IFAS Research and Education Centers

We audited four of thirteen Research and Education
Centers: North Florida (located in Quincy, Marianna and
Live Oak), Mid-Florida (located in Apopka), Indian River
(located in Ft. Pierce) and Everglades (located in Belle
Glade). Research and Education Centers are under the
oversight of the university's Institute of Food and Agri-
cultural Sciences and operate in Florida counties for the
purpose of conducting research, teaching and disseminat-
ing information to improve Florida agriculture.

The primary objective of these audits was coverage of
areas where procedures and controls have been decentral-
ized. Specifically, we focused on revenues and collections;
payroll and personnel administration; purchasing and
expenditures; asset management; and fuel and vehicle
usage.

Tax Reporting

University Tax Services, an eight person unit of the Uni-
versity Controller's Office, is responsible for ensuring that
the university is in compliance with tax reporting for fed-
eral and state tax laws, rules, regulations, and procedures.
The Federal Internal Revenue Service and State Depart-
ment of Revenue routinely perform audits at universities.
Failure to comply with the various tax regulations that
affect universities are not only costly, but can be harmful
to the image and prestige of the university.

Average monthly sales tax remittances were $82,000
and $75,000 for fiscal years ending June 2007 and 2006,
respectively. For the last five years, the university has
recognized cumulative net losses and has not paid any
unrelated business income tax (UBIT). University payroll
tax returns reflect average quarterly tax deposits of ap-
proximately $68 million for 29,000 employees.


The primary objective of this audit was to evaluate the
adequacy of key controls in place to determine if the
university's tax reporting process is capable of generating
reports and information that is complete, timely, accurate,
and in compliance with applicable rules and regulations.
Our review focused primarily on sales and use taxes,
UBIT, and employment taxes.

MANAGEMENT ADVISORY
SERVICES

OACR is committed to provide proactive, preventive
advice on internal controls, operations and compliance.
Requests for management advisory services (MAS) usu-
ally come from various management levels throughout
the university. The information provided through these
services assists management in decision making and in
improving operations. Results of these types of services
are often communicated through management letters.

OACR actively provides advisory reviews, consulting
assistance, training and training tools, and post-audit
assistance. The following chart illustrates the MAS types
performed and the percentage of time spent on each.

During fiscal year 2007-2008, 2,557 hours were spent on
MAS, which represented 13% of available hours. A sig-
nificant portion of MAS effort was expended on advisory
reviews, consultations and general University service and
support. Following are summaries of MAS projects and
service/ support:

President's Reimbursable Expenses

The objective of this annual review is to evaluate the
effectiveness of processing controls over the president's
expenses and evaluate their propriety and compliance
with established policies and procedures.

Graduate School Alumni Awards

Alumni Graduate Awards are designed as a recruiting
tool to allow colleges to build a strong research program
at the University of Florida. These awards generally
include full four years of tuition waiver, and a stipend
to complete a PhD or MFA degree. All students must
be engaged during this four year period with either a
research or teaching assignment and all students must
be mentored during these four years. We reviewed key
processes including major program changes that occurred
in 2006-2007.


10 Annual Report







I OFFICE OFAUDIT* &mCOMPLIACEREVIE


MAS Effort Distribution


A1


General UniversityService and Support
UniversityGovernanceand Publications
DSOService
Consultationsand Advisory Reviews
SOther

UAA Ticketing System

We performed a review of the UAA process to purchase a
new ticketing system at the request of UAA management.
Our review objectives were to:

* Gain an understanding of the process and procedures
followed to date in the purchase of a new ticketing
system.
* Identify potential issues for UAA's consideration as the
purchase and contracting process moves forward.
* Identify potential issues for UAA's consideration dur-
ing the implementation of the new system.

UAA management had already selected Ticketmaster as
the vendor; therefore, our advisory review mainly focused
on identifying and suggesting best practices and control
issues to consider in the contracting and implementation.

Other MAS Projects

The Office of Audit and Compliance Review also par-
ticipates in projects and initiatives that do not result in
a released report. Examples of such projects during the
2007-2008 fiscal year includes:

* Data Security and Privacy SSN remediation initiative
* Initiative to develop an Institutional Compliance
Structure
* Direct Support Organization Financial Reporting and
Governance project annual survey of all affiliated
organizations to obtain information relative to the con-
duct and results of their annual financial audits


Internal Control Training

OACR has continued to present, in conjunction with the
university controller's office, an internal control train-
ing course. PRO 303 Internal Controls at UF is a course
designed to help UF administrative staff understand
internal control concepts and learn how to apply them
to their everyday business processes. Eight sessions
were conducted during the 2007-2008 fiscal year reach-
ing nearly 300 employees. The feedback on the training
program continued to be positive and it will be continued
into the 2008-2009 fiscal year.

General Consultation Services

During the fiscal year, OACR provided MAS consulting
services in response to requests from many university-
related persons and entities including, the University
President, the Senior Associate Vice President, the Vice
President for Business Affairs, the University of Florida
Foundation, and various academic college deans.

Newsletter

Quarterly newsletters were distributed campus-wide
with regular features that include highlights from projects
and campus-wide issues. Electronic copies are main-
tained at http://oacr.ufl.edu.

Post-Audit Assistance

OACR routinely provides support and guidance on the
implementation of planned actions.


OACR Staff at Lake Wauburg Retreat


2007-2008 11







IUNIVE SIT OF FOIDA


INVESTIGATIONS


The OACR receives complaints and allegations of fis-
cal improprieties from a variety of internal and external
sources, including direct correspondence and referrals
from other university offices and state agencies. The
OACR also is responsible for the oversight of the univer-
sity's compliance hotline. In 2007, the OACR contracted
with an independent third party to implement a new
compliance hotline to facilitate the reporting of issues
and university related concerns. The compliance hotline,
which is managed by The Network, a technology-based
company that aids its clients in the collection of confiden-
tial and sensitive information, allows for the reporting of
complaints and allegations by either telephone or inter-
net web page and is a key component of the compliance
process for the university.


The OACR is committed to assisting the University of
Florida in sustaining an operating environment whose core
attributes are honesty and integrity. We strive to achieve
the utmost objectivity in all reviews and strictly follow
professional standards that promote our independence and
objectivity. In 2008, the OACR received a total of 36 com-
plaints and allegations by the following methods.



Sourc of Numbe
Copait Reeie % of Tota


Compliance Hotline
Telephone
E-mail
Referral / Letter / Other


50%
22%
14%
14%


I oa 3 600


When complaints and allegations are received by the
OACR, they are assessed to determine the most appro-
priate response to the conditions that are reported. In
some allegations, the initial assessment indicates that the
allegations are not of a fiscal nature and that other uni-
versity departments would be the more appropriate body
to perform a review of the reported concerns. In cases
where a fiscal concern or impropriety may be present, the
OACR will initiate its review process.

The review process begins with a preliminary review
of the facts and information contained in the allegation
and, if that preliminary review indicates that there may
be merit to any allegation or complaint, then a full scale
investigative review is initiated. Of the 36 complaints
received in 2008, the assessments, preliminary and full
scale reviews performed resulted in the following classifi-
cations or breakdown of review activities:


**Numbe %.6of
Classification of Activities ofCasesTota


Referred for administrative review
Closed at preliminary assessment
Full scale review


53%
17%
30%


Tl 3 100


Where appropriate, recommendations for improvements
of internal controls were communicated to management
and were monitored for implementation. In 2008 a total
of 1,775 hours, or 9% of available hours, were committed
to investigative efforts. The significant issues addressed
with these reviews are listed in the following table.






Travel Expense Reporting 2
Purchasing Card Use 2
Research Funds Use 2
Outside Activities 1
Gift Card Use 1
Nepotism 1
Depository/Cash Handling Procedures 1


12 Annual Report


r~ntegril an Aco ift


http://www.compliance.ufl.edu








I OFFICE OFAUDIT* &mCOMPLIACEREVIE


FOLLOW-UP


Audit reports include auditor's comments and planned
actions developed and agreed to by the audit team and
management and the estimated time for their implementa-
tion. Reports issued by the external auditors, including the
Office of Auditor General, contain recommendations for
which university management also provides a corrective
implementation plan.

Standard 2500, Standardsfor the Professional Practice of Inter-
nal Auditing, promulgated by the Institute of Internal Audi-
tors, requires that the internal auditor determine that man-
agement has taken appropriate action regarding reported
audit comments.

Quarterly follow-up procedures were conducted through-
out the year and their results were communicated to uni-



Table 5-Follow Up Activities


versity management and the Board of Trustees Audit Com-
mittee. For the report period, the OACR staff expended 923
hours or 5% of available hours for follow-up activities.

As reflected by the summarized information, management
generally reacted in an effective manner to implement au-
dit recommendations and planned actions; however these
actions were not always completed timely.

The caption "in process" includes action plans that were
not fully implemented during our follow-up review pro-
cess for the year ending June 30, 2008. The caption "not
implemented" generally reflects actions that were not fully
implemented after our follow-up review procedures were
completed, or changing conditions that render the plan
obsolete.


n t to b
Ovrsgh bye(i Folowe Up [mleene prcs Impemete Impleente Implem[ented1 I(
~(1Prior Year


1 -Academic Affairs
2 Business Affairs
3 Health Affairs
4 Human Resources
5- IFAS
6 Sponsored Research
7 UAA
8 UFF


85%
71%
100%
67%
100%
50%
100%
83%


64%
84%
50%
N/A
N/A
100%
100%
89%


Toas 826 2 0


Planned Action Implementation Package


1 Academic Affairs
2 Business Affairs
3 Health Affairs
4 Human Resources
5 Institute of Food and Agricultural Sciences
6 Sponsored Research
7 University Athletic Association
8. University Florida Foundation


100%


67%


100%
E50%100%
9"00"


1 2 3 4 5 6 7 8


13


30

25

20

15

10







IUNIVE SIT OF FOIDA


OTHER ACTIVITIES

Professional Activities

OACR staff participated in various national initiatives,
training and organizations including:

* Member Association for College and University
Auditors (ACUA)

* Member Institute of Internal Auditors (IIA)

* Member Association of Healthcare Internal Audi-
tors (AHIA)

* Member American Institute of Certified Public Ac-
countants (AICPA)

* Member Florida Institute of Certified Public Ac-
countants (FICPA)

* Member Association of Certified Fraud Examiners
(ACFE)

* Member IIA North Central Florida Chapter

* Treasurer IIA North Central Florida Chapter

* Secretary IIA North Central Florida Chapter

* Program Committee IIA North Central Florida
Chapter

* Academic Relations Committee IIA North Central
Florida Chapter

* Board Member IIA North Central Florida Chapter

* Web Master IIA North Central Florida Chapter

* Volunteer Instructor Florida Institute of Certified
Public Accountants (FICPA)

* Member State University Auditors Consortium
(SUAC)

* Member AHIA Technology Committee

University Service

During 2007-2008, OACR members participated in vari-
ous university-wide initiatives and assignments
including:


* Member University Information Technology Advi-
sory Committee Information Security Management

* Member University Information Technology Advi-
sory Committee Data Infrastructure

* Member University Information Technology Advi-
sory Committee -- Network Infrastructure

* Audit Coordination (External)

* Member Auxiliary Review Committee

* Member University of Florida Communications
Network

* Presenter Division of Sponsored Research Re-
search Administration Training Series

* Presenter PRO3 Series Internal Controls at UF

* Direct Support Organization Audit Committee Coor-
dination (UAA, UFF & Gator Boosters)

* Participant UF Academy

* Liaisons PeopleSoft System Upgrade Committees

* Coordinator, Building Emergency Activities


Autumn Leaves at U-


14 Annual Report











Table 6-Reports Issued 2007-08


-em -*6*1


UFF Control Activities

Fiscal Closing

UF Shands Cancer Center
President's Reimbursable
Expenses
Graduate School Alumni
Awards
Environmental Health & Safety

Food Vendor Contract

UAA Budget Control & Travel
Division of Continuing
Education
UFF Restricted Gifts

UAA Ticketing System

Construction

UF Internal Controls

Gator Boosters

Purchasing Card
UAA Financial Aid &
Scholarships
*E-Learning

"IFAS REC North Florida

*IFAS REC Mid-Florida

*IFAS REC Everglades

*IFAS REC Indian River

*Tax Reporting

* Substantially completed as of June 30, 2008.


As of 2/28/07

As of 7/31/07

As of 3/31/07

7/1/06 6/30/07

As of 11/07

As of 11/30/07

As of 9/30/07

As of 6/30/07

As of 9/30/07

1/1/06- 12/31/06

As of 4/30/08

As of 3/26/08

As of 5/22/07

1/1/07- 12/31/07

As of 12/31/07

As of 8/21/07

As of 12/31/07

As of 1/31/08

As of 1/31/088

As of 1/31/08

As of 1/31/08

As of 12/31/07


9/10/07

10/5/07

10/15/07

10/23/07

1/10/07

1/24/08

2/1/08

2/28/08

3/24/08

4/1/08

4/30/08

5/9/08

5/19/08

6/4/08

6/24/08

6/30/08

7/31/08

8/4/08

8/4/08

8/4/08

8/4/08

8/5/08


UF-07-488-09

UF-07-493-14

UF-06-470-22

72.200701

71.200801

UF-07-497-18

UF-08-518-10

UF-07-481-02

UF-08-509-01

UF-07-485-06

71.200803

UF-07-505-26

UF-08-523-15

UF-08-526-18

UF-08-529-21

UF-08-525-17

UF-08-522-14

UF-08-512-04.1

UF-08-512-04.2

UF-08-512-04.3

UF-08-512-04.4

UF-07-494-15


Internal Audit

Internal Audit

Internal Audit

MAS

MAS

Internal Audit

Internal Audit

Internal Audit

Internal Audit

Internal Audit

MAS
Outsourced
Audit
Internal Audit

Internal Audit

Internal Audit

Internal Audil

Internal Audit

Internal Audit

Internal Audit

Internal Audil

Internal Audit

Internal Audil


2007-2008 15







IUNIVE SIT OF FOIDA


CONTACTS AND RESOURCES

The Office of Audit and Compliance Review works col-
laboratively and cooperatively with many other offices.
Below is a partial listing of the contacts and resources
frequently used.

State Auditor General
http://www.state.fl.us/audgen/
Gainesville Office: (352) 334-1740
Campus Office: (352) 392-5255

FL Department of Financial Services
Consumer Helpline: 1-800-342-2762
Get Lean Hotline: 1-800-GET-LEAN
www.fldfs.com

University Controller's Office
http://fa.ufl.edu/uco/
(352) 392-1321

Board of Governors
http://www.fldcu.org/

UF Board of Trustees
http://www.trustees.ufl.edu/

Health Science Center Compliance
http://www.med.ufl.edu/complian/
(352) 265-8359

Division of Sponsored Research
http://rgp.ufl.edu/research/
(352) 392-1582

Institutional Review Board
http://irb.ufl.edu/

Equal Opportunity Programs Office
http://www.hr.ufl.edu/eeo/default.htm
(352) 392-6004

University Ombudsman
http://www.ombudsman.ufl.edu/
(352) 392-1308

General Counsel and Vice President
http://www.generalcounsel.ufl.edu/
(352) 392-1358


University Police Department
http://www.police.ufl.edu/
(352) 392-1111

Shands Auditing
(352) 265-7969

Senior Vice President for Administration
http://www.hr.ufl.edu/
(352) 392-1075

Vice President for Business Affairs
http://www.admin.ufl.edu/
(352) 392-1336

HIPAA (Privacy Office)
http://privacy.health.ufl.edu/
(352) 273-5094

Vice President and Chief Financial Officer
http://cfo.ufl.edu/index.asp
(352) 392-2402

Chief Information Officer
http://www.it.edu/cio
(352) 392-1301


UF Century Tower


16 Annual Report





















































-ur kreng -

Ch0ief A it E cSutive

Post ffic Box 1302- A-

9030 West0UniversityAvenue

Gainesville, FL 32611-3-25

S.iorul~d




University of Florida Home Page
© 2004 - 2010 University of Florida George A. Smathers Libraries.
All rights reserved.

Acceptable Use, Copyright, and Disclaimer Statement
Last updated October 10, 2010 - - mvs