Slides

Min Xiao, OSP

Gail McDermott, RMAS

Greg Murray, RMAS

Miriam Vazquez, RMAS

Sarah T. Axelrod, FOA

HMS Audit TrainingJune 3, 2005

Agenda

• Introduction

• Types of Audits

• Preparation for Audits

• Tools

• Case Study

• Summary

Introduction

• Explain why these various audits happen, and how frequently we can expect them to occur

• Describe how you can prepare for the audits in a proactive way rather than reactive

• Highlight the tools available here at HMS to survive the audits

• Emphasize the partnership of the various service offices who are here to protect the interest of faculty and administrators, HMS, and HU.

Types of Audits

• Internal Audits (RMAS)

• Compliance Audits (A 133)

• Federal Audits– F&A (Indirect Cost) Audits

– Agency Audits

• Not for Case Audits

RMAS Mission Statement

“ Provide an independent, objective assurance and consulting service which is used within Harvard as an integral part of its risk management and control processes”

“ Help the University accomplish its objectives by bringing a systematic disciplined approach to evaluate and improve the effectiveness of risk management and control processes”

Services and Types of Audits

• Financial & Operational Audits

• Compliance Audits

• Information Systems

• Special Projects/Consulting

• Investigations

• Post Audit Appraisals (PAA)

• Training

Why Audits

• Part of Risk Management & Internal Control Processes

– Independent, objective assurance that risks are being managed in a cost effective manner

– Recommend changes to improve risk management

What is Risk?

• Anything that does not allow an organization to achieve its objectives– Risk is inherent in any business.– Example of risk: unallowable and unallocable spending on

an award causing sponsor to curtail future monies.

• Risk assessment considers:– Likelihood of an event occurring– Impact should the event occur

• Risk assessment leads to risk management

What is risk (cont.)

• External risk – such as– Economic changes– Natural disasters– Changes to Federal regulations

• Internal risk – such as – New systems– Untrained personnel– Unexpected turnover– Fraud

Internal Controls

• A process designed to provide reasonable assurance objectives are achieved:– Operational Objectives – efficient and effective operations,

safeguarding of assets, HR practices to hire quality personnel– Reporting Objectives- Accurate and complete financial

reports– Compliance Objectives – compliance with all legal, regulatory

and policy requirements

• Example: – Approval of web vouchers separate from person doing the

transaction– Monthly review of detailed listings– Approval of effort reports

Components of Internal Control

There are five interrelated components of internal control derived from basic operations and administrative processes. The control environment is at

the bottom because it is the foundation for all the others.

Control Environment(Policies, Style, and Ethics)

Risk Assessment

Control Activities

Monitoring

Info

rmati

on

Comm

unication

How Do We Determine What to audit?

• Annual evaluation based on RMAS risk assessment process:– Management input on concerns – Audit results – internal & external– Changes to operations including new systems– Regulatory Agency focus– Events at other Universities– JCI observations– Emerging issues

FY06 Risk Activities

• Stem Cell Research

• International Operations

• Student Travel Abroad

• Cross Faculty Initiatives

• Business Continuity Planning

• Information Systems Security

• Technology Transfer & Licensing

• Construction

How do we determine where to audit:

• Risk assessment results– Activities to audit– Groups that perform those activities

• Other factors such as:– Size, volume or complexity of activity– Date of last audit– University coverage– Management request

When will you know you are to be audited?

• Routine audit-– Audit plan is completed in the summer of the

fiscal year – Audit plan is shared with schools in the fall

• PAA’s– At time initial audit is complete

• Special Projects– When you ask

Audit Approach

• Understand the operations including risks• Understand business processes and risk

mitigating approach• Determine audit scope; agree with management• Focus is on “internal controls”

– What is in place to manage the operational and financial risks e.g. policies, review & approval practices, management and financial reports, monitoring, system controls and access privileges etc.

– Are the controls working effectively• Testing• Analytical review• Trends

• Audit Report Process

Common Activities in an Audit

• Tone at the top• Budgeting and

Management Reporting• HR processes e.g. hiring

and performance review practices

• International Operations• Transaction Processing

and Approval– Web Voucher, Pcard,

Payroll

• Post Award Management– Allocable costs, award

terms and conditions– Effort reporting and cost

transfers

• Service Centers– Costs, billing and rates

• Vendor management including use of contracts

• Cash and receivable processing

WHAT…is A-133?

• An Office of Management and Budget (OMB) Circular requiring an annual external audit of non-profits receiving federal funds for sponsored programs in excess of $500k (as of 12/31/03)

• Sample of federal awards & their direct cost transactions are selected for audit to determine if expenditures and procedures were appropriate according to the federal guidelines, sponsor terms/conditions & University policies

WHAT …IS A-133 ?

• Other testing includes:– effort reporting– internal control testing– cost transfers– program income– equipment testing– financial & non-financial reporting– sub-recipient monitoring– service centers– student financial aid– F&A rate application

A133 Audit Process

A-133 audit process involves the following:• External groups: PricewaterhouseCoopers

(PWC) and federal government• Internal groups: schools, OSP, RMAS,

Office of General Counsel, VP Finance

• FOA is HMS’s local liaison for the A-133 audit

• OSP coordinates the audit with PWC auditors and works with school liaisons for audit resolution

A133 Audit Schedule

• May - June: The planning & audit selection• July: The Orientation begins with PWC, OSP, and

departments• August - September: PWC auditors perform

direct cost & compliance testing, includes interview PI and grant administrators

• October - November: OSP and RMAS work with PWC and departments to clear findings before report is finalized

• December - January: PWC issues a final report; the schools submit a corrective action plan

Why Me?

• A-133 Audit departments are selected with the following criteria in mind:– Total Department Federal Dollars by audit year– Frequency of the last A-133 audit

• Departments are rotated, as are some schools with fewer federal dollars

• HMS is ALWAYS selected because it has the top federal $ ( HMS comprises 40% of the total sponsored expenditures in FY04 ( 238M )

– The award types and research locations – Rotation of service centers– High risk area that are determined by PWC ( e.g.

PEPFAR, Broad Institute, Stem Cell Research )

WHY…do we care?

• All Federal and increasingly more non-federal sponsors look at A-133 as a ‘report card’ of how we spend their money

• Findings are reported to federal government and become public record, distributed to all federal agencies through a clearing house– Harvard’s reports can be found at http://vpf-web.harvard.edu/osp/support/sup_osp_aud.shtml

• Each department performing sponsored research is accountable for demonstrating that the reported expenditures are appropriate with the terms and conditions of the award and federal costs principles ( A-21, A-110)

WHAT are the auditors looking for?

• Costs incurred for the same purpose in like circumstances should be treated consistently as either direct or as facilities and administrative costs

• Exceptions of different purpose and circumstance need to be documented

• Allowability and allocability of expenses• Costs identified specifically with a particular

sponsored project/activity, or can be directly assigned to such activity relatively easily with a high degree of accuracy

• Documentation completed at the time of transaction processing

Common A-133 Findings

• Unallowable costs charged to grants – Sales tax, travel expenses, office supplies

• Timely and Accurate Annual Financial Reporting – 90 calendar days after the end of the grant year

– In FY 04, 7 reports were late out of a selection of 60

• Timely and signed Effort Reporting– Evidence of timely review by someone with first-hand

knowledge

• Cost Transfers– Timeliness, justification, authorization

Federal Audits

• F & A Audit

• Agency Audits

F & A Audit

• What– DHHS audit of the HMS proposed F&A (indirect cost) rate

• Why– To test/verify HMS’s data that supports the proposed F&A

rate

• Who– 2 staff from the NY DHHS office

• When– HMS submits a rate proposal every 4 years

– DHHS auditors spend approximately one week on campus

F & A Audit - Cycle

• Prepare for base year (1/04-6/04)

• Base Year (7/04-6/05)

• Analysis and Proposal Preparation (7/05-1/06)

• DHHS Desk Review (Winter to Spring 06)

• DHHS Field Audit (Spring – 1 week)

• Requests for additional information (Spring 06)

• Negotiation Session in NY (Summer 06)

• Effective dates of negotiated rates (AY 07 – AY 10)

• Next base year (AY 09 – starts 7/1/08)

F & A Audits

• What is the audit focus– Space– General Ledger coding– Facilities Costs– Library Costs– Allocations

F&A Audits Departmental Involvement

How are departments involved?

• In June 2002 DHHS visited 4 departments and met with 3 PIs in each department

• Reviewed payroll detail for the 4 departments

• Auditor “walked the space”

• Interviewed each PI

• Physically inventoried all equipment listed as located within these labs

F&A Audits Other Data Requests

Sample of other information the auditors requested?

• Departmental space

– Room by room breakdown of the functionalization of space for the 4 departments reviewed

• O&M salary and cost details

• Specific questions relating to library costs

F&A Audits Other Data Requests

Sample of other information the auditors requested (continued)?

• Cost sharing detail

• Equipment location

• Documentation regarding expense reclassification

• Other occupants in research labs (visiting professors, students, admin staff)

What to do to Prepare for an Audit?

• Operations Self-Assessment• Continuously Assess your Business Processes

– Very often what you are worried about represents a control weakness• Practice Fiduciary Responsibility• Keep abreast of:

– HMS/University Policies– Award Terms and Conditions– System capabilities– Regulatory changes

• Document Transactions– Business purpose – who, what, when, where, why– Basis for allocating costs among awards– Reason for journal entries

• Review Financial Reports– The Devil is in the details

Tools Available for Survival

• Training – HMS Aspire sessions, HU sessions, external (NCURA,

SRA, RADG)

• Network – SPA, OSP, FOA, ORC, peers in other departments

• Policies– HMS, HU, Federal

• Websites– E-commons (FOA, OSP, H/R), SPA, OSP, ABLE, other

schools, government agency sites

• Data– Financial, sponsored (GMAS, HMS SPAR), Peopleview

Tools Available for Survival

Key data/reports for proactive reviews• PERs• Detail listings• E-tads and PeopleviewKey policies for grants management• HMS Sponsored expenditure policy• Cost transfer policy• Financial management guide to policies,

procedures and best practices

Tools Available for Survival

ASK QUESTIONS!

Do not assume that how something has always been done is the only way or the correct way

Case Study - One

• Sara, is the grants coordinator who is managing 10 grants ( 7 federal, 3 non-federal ) for several PI’s in the department. When she tries to approach the PI’s for assistance on the allocation of lab supplies costs, they are often out of the town or too busy for these matter. So Sara developed a strategy to allocate all costs first on to the federal grants, but with the intention of journaling out portion of costs later when she can figure out how much should be re-allocated to non-federal grants. Sara thinks this is a better approach because a 90 days cost transfer policy does not apply to journals transferring costs from federal grants to non-federal grants.

• One day she received a call from OSP and learned that one of her federal grants has been selected by PWC for the annual A-133 audit.

Case Study - Two

• Dr. Globe made his own flight arrangements for a trip to conferences in Washington DC. His travel expenses were selected for an A-133 audit, by now though, Dr. Globe had left Harvard for a west coast institution.

David, the Harvard department administrator, contacted Dr. Globe and asked him to document how he had selected the lowest available fares for his journey. He emailed in response that he booked airfares through Travelocity.Com because it was the lowest airfares he could find at the time. But he didn’t keep any documentation to support his claim.

• What should David do now ?

Questions?

Comments?