24
Internal Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University Fiscal Year Ending August 31, 2013

Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

  • Upload
    lamnga

  • View
    234

  • Download
    2

Embed Size (px)

Citation preview

Page 1: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

Internal Audit Annual Report Lamar Components

Lamar Institute of Technology

Lamar State College-Orange

Lamar State College-Port Arthur

Lamar University

Fiscal Year Ending August 31, 2013

Page 2: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

TABLE OF CONTENTS

I. Compliance with HB 16: Posting the Internal Audit Plan, Internal Audit Annual Report, and Other Audit Information on Internet Web Site ................................................................................................................ 1 II. Internal Audit Plan for Fiscal Year 2013.................................................................................................. 2 III. High-Level Consulting Engagement/Non-Audit Service Objective(s), Observations, and Results ..... 11 IV. External Quality Assurance Review (Peer Review) ............................................................................. 12 V. Internal Audit Plan for Fiscal Year 2014 ............................................................................................... 16 VI. External Audit Services Procured in Fiscal Year 2013 ........................................................................ 22 VII. Reporting Suspected Fraud and Abuse and Coordination of Investigations ...................................... 22

Page 3: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

1

I. Compliance with HB 16: Posting the Internal Audit Plan, Internal Audit Annual Report, and Other Audit Information on Internet Web Site House Bill 16 amends Chapter 2102, Texas Government Code, by adding Section 2102.015, which requires state agencies and higher education institutions to post certain information on their Internet Web sites. The Texas State University System (TSUS) Office of Audits & Analysis (Lamar Components) intends to ensure compliance with HB 16 through the following procedures: Posting its Annual Audit Plan to the Audits & Analysis page of the applicable Lamar component

website within 30 days after formal approval by the Board of Regents. The Audit Plans for 2014 have already been posted.

Posting its Annual Internal Audit Report to the Audits & Analysis pages of the Lamar component websites within 30 days of distributing the report to the Finance & Audit Committee of the TSUS Board of Regents.

Effective for fiscal year 2014, posting audit reports resulting from the Fiscal Year 2014 Audit Plan to the Audits & Analysis page of the applicable Lamar component website within 30 days of distributing the reports to the Finance & Audit Committee. This will satisfy HB 16 requirements that postings be updated to reflect a:

“detailed summary of the weaknesses, deficiencies, wrongdoings, or other concerns raised by the audit plan or annual report” and a

“summary of the action taken by the agency to address concerns, if any, that are raised by the audit plan or annual report.”

The TSUS Office of Audits & Analysis retains the right to not post information contained in the internal audit plan, audit reports, or annual internal audit report if the information is exempt from public disclosure under Chapter 552 of the Texas Government Code.

Page 4: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

2

II. Internal Audit Plan for Fiscal Year 2013 The TSUS Office of Audits and Analysis includes four qualified auditors based in Beaumont, Texas, to provide audit services for four TSUS institutions (collectively referred to as the “Lamar components”): Lamar University, Lamar Institute of Technology, Lamar State College-Orange, and Lamar State College-Port Arthur. These resources are allocated to audit activities according to risk and are subject to changing priorities. As a result, resources can be, and were in FY2013, re-assigned to higher priority audit activities amongst the Lamar components, and in some cases, at other TSUS components.

Lamar Institute of Technology

Lamar State College-Orange

Lamar State College-Port Arthur

Lamar University

Fiscal Year 2013 Audit Plans

Brian Biggin, CIA Component Director, Office of Audits and Analysis

Members of The Texas State University System

Page 5: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

3

LAMAR INSTITUTE OF TECHNOLOGY FISCAL YEAR 2013 AUDIT PLAN

AUDIT DESCRIPTION REPORT STATUS SYSTEM-WIDE INITIATIVES

ACH and Wire Transfers

To assess internal controls over the ACH and Wire Transfer processes at System Administration and the Components.

Status: In progress

IT Toolkit To implement standardized IT-related audit processes into non-IT audits.

Status: Not implemented. However, this project would not have resulted in a report.

Response to System Requests

To gather information as requested by the System Office.

Not applicable – this project does not result in a report.

RISK-BASED AUDITS Inter-Component Agreements

Review the adequacy of inter-agency agreements with other TSUS Components.

Status: report issued. Number: L-13-001 Date: 10/18/13.

Hourly Payroll & One-Time Payments

Evaluate controls, efficiency, and effectiveness of payments to hourly workers and use of one-time payments for all employees.

Status: Postponed

Student Services Fees

Evaluate appropriateness of expenditures from the Student Services Fees Fund.

Status: In progress

Scholarships Evaluate approvals and fund accounting for scholarships.

Status: Postponed

IT - Fixed Assets Evaluate controls over purchasing, tracking, and disposition of IT equipment.

Status: Postponed

IT - Help Desk Evaluate effectiveness and efficiency of the Help Desk function.

Status: In progress

IT - Networking Evaluate the maintenance and security of networking campus-wide.

Status: Postponed

IT - Server Administration

Evaluate controls over all servers attached to the University network.

Status: Postponed

IT - On-Going Maintain on-going review of significant activities such as disaster recovery tests and new application implementation.

Not applicable – this project does not result in a report.

Construction Review construction project risks. Cancelled. REQUIRED AUDITS AND ACTIVITIES

Follow-Up Procedures

Follow-up on management’s progress in implementing outstanding internal and external audit recommendations.

Status: complete Quarterly status reports are contained in the meeting materials for the TSUS Board of Regents’ meetings

Annual Internal Audit Report

This report, required by Government Code 2102, summarizes all audit activities of the preceding fiscal year.

Status: complete (This report.)

Self -Assessment On-going quality assurance compliance review. Status: Complete

Page 6: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

4

and Peer Review Date: 10/28/2012 Management Advisory Letter: Office of Audits & Analysis Self-Assessment Date: March 2013 Quality Assurance Review Report for the Internal Audit FunctionAt The Texas State University System

Continuing Education

Required by Government Code 2102 and auditing standards.

Not applicable – this activity does not result in a report.

OTHER Consultations / Reviews

Serving in an advisory capacity on committees; assisting with fraud prevention awareness efforts; communicating new compliance requirements; and liaison activities with external auditors.

Not applicable – this project does not result in a report.

Special Projects Management requests; reviews/audits to address unanticipated risks and EthicsPoint/SAO Special Investigations Unit allegations, and other activities.

Status: one unsubstantiated complaint was investigated.

OTHER AUDIT REPORTS ISSUED

IT Banner Security Evaluate the effectiveness of procedures authorizing user access to Banner data and implementation by the Data Base Administrator.

Status: report issued. Number: LIT-12-003 Date: 11/14/12

Procurement Evaluate controls over the procurement cycle. Status: report issued Number: LIT-11-017 Date: 11/14/12

TWC Christus Consortium Grant

Review administration of the Texas Workforce Commission grant for the training provided by a consortium, including Christus hospital.

Status: report issued Number: LIT-12-008 Date: 2/5/13

Perkins Grant Limited-scope review of Perkins Grant processes. Status: report issued Number: LIT-13-003 Date: 3/8/13

LAMAR STATE COLLEGE-ORANGE FISCAL YEAR 2013 AUDIT PLAN

AUDIT DESCRIPTION REPORT STATUS

SYSTEM-WIDE INITIATIVES ACH and Wire Transfers

To assess internal controls over the ACH and Wire Transfer processes at System Administration and the Components.

Status: In progress

IT Toolkit To implement standardized IT-related audit processes into non-IT audits.

Status: Not implemented.

Page 7: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

5

However, this project would not have resulted in a report.

Response to System Requests

To gather information as requested by the System Office.

Not applicable – this project does not result in a report.

RISK-BASED AUDITS Inter-Component Agreements

Review the adequacy of inter-agency agreements with other TSUS Components.

Status: report issued. Number: L-13-001 Date: 10/18/13.

Hourly Payroll & One-Time Payments

Evaluate controls, efficiency, and effectiveness of payments to hourly workers and use of one-time payments for all employees.

Status: Postponed

Student Services Fees

Evaluate appropriateness of expenditures from the Student Services Fees Fund.

Status: Postponed

Scholarships Evaluate approvals and fund accounting for scholarships.

Status: Postponed

IT - Fixed Assets Evaluate controls over purchasing, tracking, and disposition of IT equipment.

Status: Postponed

IT - Help Desk Evaluate effectiveness and efficiency of the Help Desk function.

Status: In progress

IT - Networking Evaluate the maintenance and security of networking campus-wide.

Status: Postponed

IT - Server Administration

Evaluate controls over all servers attached to the University network..

Status: Postponed

IT - On-Going Maintain on-going review of significant activities such as disaster recovery tests and new application implementation.

Not applicable – this project does not result in a report.

REQUIRED AUDITS AND ACTIVITIES Follow-Up Procedures

Follow-up on management’s progress in implementing outstanding internal and external audit recommendations.

Status: complete Quarterly status reports are contained in the meeting materials for the TSUS Board of Regents’ meetings

Annual Internal Audit Report

This report, required by Government Code 2102, summarizes all audit activities of the preceding fiscal year.

Status: complete (This report.)

Self -Assessment and Peer Review

On-going quality assurance compliance review. 10/28/2012 Management Advisory Letter: Office of Audits & Analysis Self-Assessment March 2013 Quality Assurance Review Report for the

Page 8: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

6

Internal Audit Function at The Texas State University System

Continuing Education

Required by Government Code 2102 and auditing standards.

Not applicable – this activity does not result in a report.

OTHER Consultations / Reviews

Serving in an advisory capacity on committees; assisting with fraud prevention awareness efforts; communicating new compliance requirements; and liaison activities with external auditors.

Not applicable – this project does not result in a report.

Special Projects Management requests; reviews/audits to address unanticipated risks and EthicsPoint/SAO Special Investigations Unit allegations, and other activities.

Status: No activities in these areas arose during the year

OTHER AUDIT REPORTS ISSUED

IT Banner Security

Evaluate the effectiveness of procedures authorizing user access to Banner data and implementation by the Data Base Administrator.

Status: report issued. Number: LSCO-11-010 Date: 10/9/12

Procurement Evaluate controls over the procurement cycle. Status: report issued Number: LSCO-11-026 Date: 3/13/13

LAMAR STATE COLLEGE-PORT ARTHUR FISCAL YEAR 2013 AUDIT PLAN

AUDIT DESCRIPTION REPORT STATUS

SYSTEM-WIDE INITIATIVES ACH and Wire Transfers

To assess internal controls over the ACH and Wire Transfer processes at System Administration and the Components.

Status: In progress

IT Toolkit To implement standardized IT-related audit processes into non-IT audits.

Status: Not implemented. However, this project would not have resulted in a report.

Response to System Requests

To gather information as requested by the System Office.

Not applicable – this project does not result in a report.

RISK-BASED AUDITS Inter-Component Agreements

Review the adequacy of inter-agency agreements with other TSUS Components.

Status: report issued. Number: L-13-001 Date: 10/18/13.

Hourly Payroll & One-Time Payments

Evaluate controls, efficiency, and effectiveness of payments to hourly workers and use of one-time payments for all employees.

Status: Postponed

Student Services Fees

Evaluate appropriateness of expenditures from the Student Services Fees Fund.

Status: Postponed

Page 9: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

7

Scholarships Evaluate approvals and fund accounting for scholarships.

Status: Postponed

Banner Security Evaluate the effectiveness of procedures authorizing user access to Banner data.

Status: Report issued Number: LSCPA-12-004 Date: 11/13/12

IT - Fixed Assets Evaluate controls over purchasing, tracking, and disposition of IT equipment.

Status: Postponed

IT - Help Desk Evaluate effectiveness and efficiency of the Help Desk function.

Status: Postponed

IT - Networking Evaluate the maintenance and security of networking campus-wide.

Status: Postponed

IT - Server Administration

Evaluate controls over all servers attached to the University network..

Status: Postponed

IT - On-Going Maintain on-going review of significant activities such as disaster recovery tests and new application implementation.

Not applicable – this project does not result in a report

REQUIRED AUDITS AND ACTIVITIES Follow-Up Procedures

Follow-up on management’s progress in implementing outstanding internal and external audit recommendations.

Status: complete Quarterly status reports are contained in the meeting materials for the TSUS Board of Regents’ meetings

Annual Internal Audit Report

This report, required by Government Code 2102, summarizes all audit activities of the preceding fiscal year.

Status: complete (This report.)

Self -Assessment and Peer Review

On-going quality assurance compliance review. 10/28/2012 Management Advisory Letter: Office of Audits & Analysis Self-Assessment March 2013 Quality Assurance Review Report for the Internal Audit Function At The Texas State University System

Continuing Education

Required by Government Code 2102 and auditing standards.

Not applicable – this activity does not result in a report.

OTHER Consultations / Reviews

Serving in an advisory capacity on committees; assisting with fraud prevention awareness efforts; communicating new compliance requirements; and liaison activities with external auditors.

Not applicable – this project does not result in a report.

Page 10: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

8

Special Projects Management requests; reviews/audits to address unanticipated risks and EthicsPoint/SAO Special Investigations Unit allegations, and other activities.

Status: one unsubstantiated complaint was investigated.

LAMAR UNIVERSITY FISCAL YEAR 2013 AUDIT PLAN

AUDIT DESCRIPTION REPORT STATUS

SYSTEM-WIDE INITIATIVES ACH and Wire Transfers

To assess internal controls over the ACH and Wire Transfer processes at System Administration and the Components.

Status: in progress

IT Toolkit To implement standardized IT-related audit processes into non-IT audits.

Status: Not implemented. However, this project would not have resulted in a report.

Response to System Requests

To gather information as requested by the System Office.

Not applicable – this project does not result in a report.

RISK-BASED AUDITS Inter-Component Agreements

Review the adequacy of inter-agency agreements with other TSUS Components.

Status: report issued. Number: L-13-001 Date: 10/18/13.

Dining Contracts Evaluate payments made under the contract with Chartwells for dining services.

Status: report issued Number: LU-12-017 Date: 9/3/13

Recreational Sports

Evaluate cash controls, safety, and conformance with rules and statute over Recreational Sports.

Status: Postponed

Residence Life Evaluate controls over Cardinal Village housing arrangements and meal plans.

Status: postponed

Student Services Fees

Evaluate appropriateness of expenditures from the Student Services Fees Fund.

Status: postponed

Scholarships Evaluate approvals and fund accounting for scholarships.

Status: Postponed

Hourly Payroll & One-Time Payments

Evaluate controls, efficiency, and effectiveness of payments to hourly workers and use of one-time payments for all employees.

Status: Postponed

Division of Distance Learning: Academic Partnership Program

Evaluate the financial and management controls over the University’s on-line Academic Partnership program with Higher Ed Holdings to determine if resources are used efficiently and effectively and in compliance with applicable laws, policies, and regulations.

Status: in progress

Division of Distance Learning: Center for Distance Education

Evaluate the financial and management controls over the University’s on-line education programs (interactive video, the Blackboard web-based system, and off-campus courses) to determine if resources are used efficiently and effectively and in compliance with applicable laws, policies, and regulations.

Status: in progress

Banner Determine and evaluate accounting controls over Status: report issued

Page 11: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

9

Banner.

Number: LU-12-005 Date: 5/17/13

IT - Fixed Assets Evaluate controls over purchasing, tracking, and disposition of IT equipment.

Status: postponed

IT - Help Desk Evaluate effectiveness and efficiency of the Help Desk function.

Status: postponed

IT - Networking Evaluate the maintenance and security of networking campus-wide.

Status: postponed

IT - Server Administration

Evaluate controls over all servers attached to the University network.

Status: postponed

IT - On-Going Maintain on-going review of significant activities such as disaster recovery tests and new application implementation.

Not applicable – this project does not result in a report

Construction Review construction project risks as required, including the reconstruction of the Brooks-Shivers building.

Cancelled

REQUIRED AUDITS AND ACTIVITIES KVLU-FM Radio Station

Assist the external auditor with a review of KVLU-FM Radio Station financial statement for the fiscal year ended August 31, 2012, as required by the Corporation of Public Broadcasting. (OUTSOURCED)

Status: Report issued Number: none Date: 2/26/13

NCAA Athletics Assist the external auditor with a review of the University’s NCAA Athletic financial statement for the fiscal year ended August 31, 2012, as required by the NCAA. (OUTSOURCED)

Status: Report issued Number: none Date: undated

Follow-Up Procedures

Follow-up on management’s progress in implementing outstanding internal and external audit recommendations.

Status: complete Quarterly status reports are contained in the meeting materials for the TSUS Board of Regents’ meetings

Annual Internal Audit Report

This report, required by Government Code 2102, summarizes all audit activities of the preceding fiscal year.

Status: complete (This report.)

Self -Assessment and Peer Review

On-going quality assurance compliance review. 10/28/2012 Management Advisory Letter: Office of Audits & Analysis Self-Assessment March 2013 Quality Assurance Review Report for the Internal Audit Function At The Texas State University System

Continuing Education

Required by Government Code 2102 and auditing standards.

Not applicable – this activity does not result

Page 12: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

10

in a report. OTHER

Consultations / Reviews

Serving in an advisory capacity on committees; assisting with fraud prevention awareness efforts; communicating new compliance requirements; and liaison activities with external auditors.

Not applicable – this project does not result in a report.

Special Projects Management requests; reviews/audits to address unanticipated risks and EthicsPoint/SAO Special Investigations Unit allegations, and other activities.

Status: No activities in these areas arose during the year

OTHER AUDIT REPORTS ISSUED

Cash Collection Functions

Evaluate the effectiveness of procedures over the collection of cash at all points where payments are collected.

Status: report issued. Number: LU-11-013 Date: 13/13/12

IT Organization & Physical Environment

Evaluate controls over the IT organization and physical environment.

Status: report issued Number: LU-11-002 Date: 10/31/12

Page 13: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

11

III. High-Level Consulting Engagement/Non-Audit Service Objective(s), Observations, and Results (where applicable)

Improved implementation of TeamMate software Implemented time reporting using the TeamMate Time & Expense module. Responded to a System Office request regarding employee tuition waivers. Investigated diversion of checks and loss of cash at one component (reports to be issued in

FY2014)

Page 14: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

12

IV. External Quality Assurance Review (Peer Review)

Quality Assurance Review Report for the

Internal Audit Function at

The Texas State University System

March 2013 Prepared by: Richard H. Tarr, CIA, CISA P.O. Box 560716 Orlando, FL 32856-0716 Ph: 407-896-2760 Fx: 407-843-5393 E-mail: [email protected]

Page 15: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

13

Executive Summary

Objectives and Scope

As required by the Texas Internal Auditing Act (article 6252-5d, V.A.C.S.) and the Institute of Internal Auditors’ (IIA) Standards for the Professional Practice of Internal Auditing (IIA Standards), an external quality assurance review (QAR) was conducted of The Texas State University System (TSUS) internal audit function. The principal objectives of the review were to assess whether the internal audit (IA) activities at the Office of Audits and Analysis (OAA) System Office and the four component locations, the Texas State University, Lamar University, Sam Houston State University, and Sul Ross State University, were conforming to the IIA Standards and the Texas Internal Auditing Act (TIAA). A secondary objective was to evaluate the effectiveness of each institution’s internal auditing activity in carrying out its mission, and where applicable, identify opportunities that would enhance the audit practices that are in place to improve the value of the services being provided to each of the universities and the System.

The scope of the review included an evaluation of:

• The department’s reporting relationship and its communication with the

Finance and Audit Committee, the Chancellor, and component Presidents; • The independence and the objectivity of the audit work performed; • Existing internal audit policies and procedures; • The Component and System-wide risk assessment and annual audit

planning process; • The planning process for individual audit projects; • The audit methodologies used in performing the work; • A representative sample of audit workpaper files and reports; • The workpaper documentation that supported the work performed; • The support in the workpapers for the conclusions and recommendations in the

audit reports; • How the results of audits are communicated; • The procedures for following up on audit recommendations; and • The knowledge, skills, discipline, and training of the staff.

As part of the preparation for the review, the System Audit Director and the IA Directors at each component location prepared a self-study document with detailed documentation on their policies and procedures. In addition, the System Audit Director and the IA Directors at each component location sent out confidential surveys to a representative sample of their audit customers and management. The responses to the survey were returned to the reviewer and a summary of the survey results and accompanying comments (without identifying the respondents) have been furnished to the System Audit Director.

Interviews were conducted with the current and former Chairmen and Chairs of the Finance and Audit Committee of the Board of Regents; the Chancellor of the Texas State University System; the Vice Chancellor and General Counsel; the Vice Chancellor for Finance; the Presidents and the Vice Presidents for Finance at each university; the System Audit Director, the Chief IT Auditor, and the IA Directors and audit staffs at each component location.

Page 16: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

14

Overall Opinion

The rating system that was used for expressing an opinion for this review provides for three levels of conformance:

• “Generally Conform” (the best) means that the OAA and its components have policies,

procedures, and a charter in place, and follow practices that were judged to be in accordance with applicable IIA Standards and the TIAA; however, opportunities for improvement may exist.

• “Partially Conform” means deficiencies in practice were found that deviated from professional standards; however, these deficiencies, while they might impair, did not prohibit, the OAA and its components from carrying out its responsibilities.

• “Does Not Conform,” means there were deficiencies in practices found that were considered so significant, as to seriously impair or prohibit the OAA and its components from carrying out its responsibilities.

Based on the work outlined above, it is the opinion of the reviewer that the internal audit activities at the System Office and at each of the component locations generally conform to the IIA’s Standards and the Texas Internal Auditing Act. This opinion, representing the best possible evaluation, means that an internal audit charter, policies, procedures, and/or practices are in place that implements the IIA Standards and comply with the requirements of the Texas Internal Auditing Act.

Observations

The internal audit function at each of the TSUS components reports to the System Director of Audits and Analysis (System Director), who has sole responsibility for all of the audit activities and functions at the System and component levels. The System Director is a CPA (Certified Public Accountant) with over 20 years of internal auditing experience and 10 years of external auditing experience; reports administratively to the Texas State University System Chancellor; and reports functionally to the Board of Regents through the Finance and Audit Committee, as required by the TIAA. She is well respected and has a good working relationship with the System’s senior management. This reporting structure provides the System Director and the Component Directors and staff with the independence and ability to be objective and render impartial and unbiased judgments essential to the proper planning and conduct of audit work.

As required by the IIA Standards, TSUS has a well-crafted Audit Charter that establishes the audit activity for the System as an independent and objective activity and clearly defines its purpose, authority and responsibility. The System Director and the Component Directors and audit staff have unrestricted access to all functions, records, property, and personnel. It also authorizes the System Director: to allocate departmental resources; set audit frequencies; select subjects; determine the scope of work; and apply the techniques necessary to accomplish the System- wide Audit Plan as approved by the Board. The System Director has full and free access to the Board Chairman, the Finance and Audit Committee Chair, and the Chancellor. The Chairman, the Finance and Audit Committee Chair, and the Chancellor are very knowledgeable of the internal audit function; they articulated audit’s duties and responsibilities and its value to the organization; additionally, they afford the System Director a level of accessibility which is commendable and which greatly contributes to an enhanced

Page 17: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

15

governance structure at the TSUS. The accessibility of the Presidents to the Component Directors is likewise to be commended. The System has four component audit staff locations each headed by a Component Director. The Component Directors have excellent professional credentials. All are either CPAs and/or CIAs (Certified Internal Auditor), who collectively have over 80 years of auditing experience. All are viewed by the presidents of their respective universities to be independent and objective. The audit staffs at the System Office and at each of the components also have extensive audit experience and, with one exception, have at least one audit related professional certification. The exception is close to obtaining a CIA certification.

The IIA Standards require that workpapers be maintained to document the audit work conducted by the audit staff. While there have been challenges in implementing t h e TeamMate automated workpaper tool that the auditors use for this purpose, there was sufficient evidence that the audit work is being appropriately documented. See the recommendation that addresses this below.

A review of a sample of audit workpapers verified that the audit work is being appropriately planned and supports the conclusions and opinions communicated in the audit reports that are issued. The workpapers contained evidence that the work was conducted with a level of professional care that was appropriate for the objectives of the work that was undertaken. The audit projects were well planned and the work performed was appropriately documented in accordance with IIA Standards. The audit programs in the workpapers were appropriately referenced to the audit steps. The tests performed during the audits and the conclusions contained in audit reports were supported by the work documented in the workpapers and the audit work was appropriately reviewed before audit reports were issued.

A confidential survey of audit customers conducted at the System Office and four component locations during the review indicated that 93% of those surveyed rated overall the internal audit activity either excellent or good on 18 different criteria. This is a very positive rating for an audit activity and speaks well of the professionalism and the ability of the System and Component Directors and the audit staffs. Richard Tarr, CIA, CISA

 

Page 18: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

16

V. Internal Audit Plan for Fiscal Year 2014 The 2014 Audit Plan was approved by the TSUS Board of Regents on August 15, 2013. Total budgeted hours, excluding supervision, planning, training, and time off, for all projects outlined in the Audit Plan below for all four Lamar components: 6,300.

INTRODUCTION AND PURPOSE

The purpose of the Audit Plan is to outline audits and other activities the Office of Audits and Analysis will conduct during fiscal year 2014. The Audit Plan satisfies responsibilities outlined in Section 2102.008 of the Government Code; the TSUS Rules and Regulations, and applicable auditing standards. Significant changes to the Audit Plan require approval by the Chair of the Finance and Audit Committee. The Audit Plan is developed through risk assessments deployed at the Components and System Administration. Component Audit Directors develop plans for their respective institutions, while the System Audit Director develops a plan for System Administration as well as system-wide initiatives. The risk assessments include consideration of fraud risks as required by state law and auditing standards. The collective risk assessments include the following activities: Soliciting input from the Board of Regents, the Chancellor, Vice-Chancellors, and

Component Presidents and management; Consulting with the Governor’s Office and State Auditor’s Office regarding “hot topic”

initiatives; Networking with other college and university internal audit directors regarding emerging

issues/concerns; Reviewing the Components’ and the System’s consolidated annual financial reports for the

most current fiscal year to identify significant financial items; Considering the impact of public scrutiny; and Utilizing professional judgment and knowledge gained from prior audits regarding the

effectiveness of governance, internal control, and risk assessment processes in mitigating risk.

The end result of the risk assessments is a list of projects that collectively form the System-wide Audit Plan. Projects fall into the following categories: System-Wide Initiatives: These projects will be performed at all Components for an

enterprise-wide assessment. Risk-Based Audits: These audits typically involve reviews of internal controls associated

with the reliability and integrity of information; compliance with policies, plans, procedures, laws, and regulations; safeguarding of assets; economical and efficient use of resources; and the accomplishment of established objectives and goals for operations or programs.

Required Audits and Activities: These audit projects and activities are required by law, grant agreements, TSUS Rules and Regulations, or auditing standards.

Other: These activities involve consulting/advisory services, management-requested reviews, assisting with fraud prevention awareness efforts; communicating new compliance requirements; liaison activities with external auditors; and reviews/audits to address unanticipated risks and EthicsPoint/SAO Special Investigations Unit projects forwarded to us for review.

Page 19: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

17

Lamar Institute of Technology

Lamar State College-Orange

Lamar State College-Port Arthur

Lamar University

Fiscal Year 2014 Audit Plans

Brian Biggin, CIA Component Director, Office of Audits and Analysis

Page 20: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

18

LAMAR INSTITUTE OF TECHNOLOGY FISCAL YEAR 2014 AUDIT PLAN

AUDIT DESCRIPTION SYSTEM-WIDE INITIATIVES

Basic Business Process Review: Bank Reconciliations

Review the adequacy of bank reconciliation procedures.

HIPAA Risk Assessment

Survey to identify organizational units where HIPAA compliance requirements exist.

Response to System Requests

To gather information as requested by System Administration.

RISK-BASED AUDITS SACS Accreditation Participate in required accreditation review activities. Faculty Workload Evaluate controls over the determination of workload and overload,

accuracy of faculty payroll, and compliance with statutes, polices, rules, and procedures.

Hourly Payroll & One-Time Payments

Evaluate controls, efficiency, and effectiveness of payments to hourly workers and use of one-time payments for all employees.

Scholarships Evaluate approvals and fund accounting for scholarships. IT - Support Services Evaluate help desk, fixed asset tracking, desktop services, and change

control. IT - Networking Evaluate server and network management practices. IT - Active Directory Evaluate controls surrounding the use of Windows Active Directory. IT - Oracle Perform security gap analysis between Oracle and Banner. IT - On-Going Maintain on-going review of significant activities such as disaster recovery

tests and new application implementation. Construction Review construction project risks.

REQUIRED AUDITS AND ACTIVITIES Investments Biennial review of compliance with the requirements of the Texas Public

Funds Investment Act. Follow-Up Procedures

Follow-up on management’s progress in implementing outstanding internal and external audit recommendations.

Annual Internal Audit Report

This report, required by Government Code 2102, summarizes all audit activities of the preceding fiscal year.

Continuing Education Required by Government Code 2102 and auditing standards. OTHER

Special Projects Management requested reviews; audits/reviews predicated by unanticipated risks and EthicsPoint/SAO Special Investigations Unit referrals, and other activities.

Audit Liaison Activities

Coordinating with external audit entities when they perform audits within the Texas State University System.

Page 21: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

19

LAMAR STATE COLLEGE-ORANGE FISCAL YEAR 2014 AUDIT PLAN

AUDIT DESCRIPTION SYSTEM-WIDE INITIATIVES

Basic Business Process Review: Bank Reconciliations

Review the adequacy of bank reconciliation procedures.

HIPAA Risk Assessment

Survey to identify organizational units where HIPAA compliance requirements exist.

Response to System Requests

To gather information as requested by System Administration.

RISK-BASED AUDITS SACS Accreditation Participate in required accreditation review activities. Hourly Payroll & One-Time Payments

Evaluate controls, efficiency, and effectiveness of payments to hourly workers and use of one-time payments for all employees.

Student Services Fees

Evaluate appropriateness of expenditures from the Student Services Fees Fund.

Scholarships Evaluate approvals and fund accounting for scholarships. IT - Support Services Evaluate help desk, fixed asset tracking, desktop services, and change

control. IT - Networking Evaluate server and network management practices. IT - Active Directory Evaluate controls surrounding the use of Windows Active Directory. IT - Oracle Perform security gap analysis between Oracle and Banner. IT - On-Going Maintain on-going review of significant activities such as disaster recovery

tests and new application implementation. Construction Review construction project risks.

REQUIRED AUDITS AND ACTIVITIES Investments Biennial review of compliance with the requirements of the Texas Public

Funds Investment Act. Follow-Up Procedures

Follow-up on management’s progress in implementing outstanding internal and external audit recommendations.

Annual Internal Audit Report

This report, required by Government Code 2102, summarizes all audit activities of the preceding fiscal year.

Continuing Education Required by Government Code 2102 and auditing standards. OTHER

Special Projects Management requested reviews; audits/reviews predicated by unanticipated risks and EthicsPoint/SAO Special Investigations Unit referrals, and other activities.

Audit Liaison Activities

Coordinating with external audit entities when they perform audits within the Texas State University System.

Page 22: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

20

LAMAR STATE COLLEGE-PORT ARTHUR FISCAL YEAR 2014 AUDIT PLAN

AUDIT DESCRIPTION SYSTEM-WIDE INITIATIVES

Basic Business Process Review: Bank Reconciliations

Review the adequacy of bank reconciliation procedures.

HIPAA Risk Assessment

Survey to identify organizational units where HIPAA compliance requirements exist.

Response to System Requests

To gather information as requested by System Administration.

RISK-BASED AUDITS Hourly Payroll & One-Time Payments

Evaluate controls, efficiency, and effectiveness of payments to hourly workers and use of one-time payments for all employees.

Student Services Fees

Evaluate appropriateness of expenditures from the Student Services Fees Fund.

Scholarships Evaluate approvals and fund accounting for scholarships. IT - Support Services Evaluate help desk, fixed asset tracking, desktop services, and change

control. IT - Networking Evaluate server and network management practices. IT - Active Directory Evaluate controls surrounding the use of Windows Active Directory. IT - Oracle Perform security gap analysis between Oracle and Banner. IT - On-Going Maintain on-going review of significant activities such as disaster recovery

tests and new application implementation. Construction Review construction project risks.

REQUIRED AUDITS AND ACTIVITIES Investments Biennial review of compliance with the requirements of the Texas Public

Funds Investment Act. Follow-Up Procedures

Follow-up on management’s progress in implementing outstanding internal and external audit recommendations.

Annual Internal Audit Report

This report, required by Government Code 2102, summarizes all audit activities of the preceding fiscal year.

Continuing Education Required by Government Code 2102 and auditing standards. OTHER

Special Projects Management requested reviews; audits/reviews predicated by unanticipated risks and EthicsPoint/SAO Special Investigations Unit referrals, and other activities.

Audit Liaison Activities

Coordinating with external audit entities when they perform audits within the Texas State University System.

Page 23: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

21

LAMAR UNIVERSITY FISCAL YEAR 2014 AUDIT PLAN

AUDIT DESCRIPTION SYSTEM-WIDE INITIATIVES

Basic Business Process Review: Bank Reconciliations

Review the adequacy of bank reconciliation procedures.

HIPAA Risk Assessment

Survey to identify organizational units where HIPAA compliance requirements exist.

Response to System Requests

To gather information as requested by System Administration.

RISK-BASED AUDITS Recreational Sports Evaluate cash controls, safety, and conformance with rules and statute over

Recreational Sports. Residence Life Evaluate controls over Cardinal Village housing arrangements and meal

plans. Hourly Payroll & One-Time Payments

Evaluate controls, efficiency, and effectiveness of payments to hourly workers and use of one-time payments for all employees.

Student Services Fees

Evaluate appropriateness of expenditures from the Student Services Fees Fund.

Scholarships Evaluate approvals and fund accounting for scholarships. IT - Networking Evaluate server and network management practices. IT - Active Directory Evaluate controls surrounding the use of Windows Active Directory. IT - Oracle Perform security gap analysis between Oracle and Banner. IT - On-Going Maintain on-going review of significant activities such as disaster recovery

tests and new application implementation. Construction Review construction project risks.

REQUIRED AUDITS AND ACTIVITIES Investments Biennial review of compliance with the requirements of the Texas Public

Funds Investment Act. Joint Admission Medical Program (JAMP) grants

Determine if JAMP is being administered in accordance with the requirements of the program.

KVLU-FM Radio Station

Assist the external auditor with a review of KVLU-FM Radio Station financial statement for the fiscal year ended August 31, 2012, as required by the Corporation of Public Broadcasting. (OUTSOURCED)

NCAA Athletics Assist the external auditor with a review of the University’s NCAA Athletic financial statement for the fiscal year ended August 31, 2012, as required by the NCAA. (OUTSOURCED)

Follow-Up Procedures

Follow-up on management’s progress in implementing outstanding internal and external audit recommendations.

Annual Internal Audit Report

This report, required by Government Code 2102, summarizes all audit activities of the preceding fiscal year.

Continuing Education Required by Government Code 2102 and auditing standards. OTHER

Special Projects Management requested reviews; audits/reviews predicated by unanticipated risks and EthicsPoint/SAO Special Investigations Unit referrals, and other activities.

Audit Liaison Activities

Coordinating with external audit entities when they perform audits within the Texas State University System.

Page 24: Internal Audit Annual Report Lamar Components Audit Annual Report Lamar Components Lamar Institute of Technology Lamar State College-Orange Lamar State College-Port Arthur Lamar University

22

VI. External Audit Services Procured in Fiscal Year 2013 At Lamar University, the services of an external CPA firm were obtained to perform the required audits of the KVLU public radio station and the financial audit of Athletics Department activities required by the NCAA. Appropriate delegation of authority was granted by the State Auditor’s Office.

VII. Reporting Suspected Fraud and Abuse and Coordination of Investigations The TSUS has taken the following actions to ensure compliance with requirements of Section 7.09, Fraud Reporting, General Appropriations Act (83rd Legislature, Conference Committee Report), Article IX: The System contracts with EthicsPoint, an internet-based fraud reporting hotline. The

following link provides information on the TSUS website for reporting suspected fraud, waste or abuse: https://secure.ethicspoint.com/domain/en/report_custom.asp?clientid=12867

The link also appears on each Lamar component’s homepage.

Additionally, there is a link to the State Auditor’s fraud reporting hotline on the TSUS webpage and the college’s webpage.

The TSUS Rules and Regulations place specific requirements for employees to report

suspected waste, fraud, or abuse and also include information on reporting such matters to the State Auditor’s Office. (CHAPTER VIII, ETHICS POLICY FOR REGENTS AND EMPLOYEES OF THE TEXAS STATE UNIVERSITY SYSTEM, Paragraph 1, ANTI-FRAUD POLICY AND REPORTING OF WRONGFUL OR FRAUDULENT CONDUCT).

The Lamar components are aware of, and comply with, the requirements of Texas Government Code, Section 321.022, regarding reporting to the State Auditor’s Office those situations where a reasonable cause to believe that money received from the state may have been lost, misappropriated, or misused, or that other fraudulent or unlawful conduct has occurred. The Office of Audits & Analysis conducts reviews into all complaints forwarded to the TSUS by the State Auditor’s Office and provides a written response summarizing the results of those reviews.