TOOLS AND TIPS FOR MINIMIZING RISKS CES WEST DISTRICT NOVEMBER 29, 2012 1
TOPICS NCSU Internal Audit: Who are We and How Can We Help? Self Assessments: Why Do Them? Fraud Awareness and How to Report Suspected Fraud at NCSU IT Security Tips Questions 2
Preparation for Provide tools for future agency or you to assess sponsor audits your offices Assistance in Recommendations potential misuse for process cases improvements Operational and Assistance in IT audits to identifying improve business & efficiency and technology risks effectiveness HOW CAN WE HELP? 3
WHAT CAN WE NOT DO? Establish Develop or requirements write policies Assume responsibility or Make ownership of management WHY NOT? processes and decisions Maintain procedures independence AND Avoid conflict of interest 4
CES SELF ASSESSMENT TOOLS http://internalaudit.ncsu.edu/campus-tools/self- assessment-tools/ces/ 5
SELF ASSESSMENTS: WHY DO THEM? Heighten your awareness – Identify risks especially of “gray areas” Identify training Help to avoid needs potential fraud Increased awareness of Improved CED policies and oversight procedures 6
CONDUCTING SELF ASSESSMENTS Slide • Receipt Self Assessment Tool 8 • Disbursement Self Assessment Tool 9 • Timesheet Self Assessment Tool 10 • Contracts and Grants Self Assessment Tool 11 • Business Practices Self Assessment Tool 12 7
RECEIPT PROCESS Goals • Keep track of receipts • Involvement of enough people to limit potential or perception of misuse • Sufficient documentation to support compliance to NCSU and County guidelines, as appropriate How To’s • Self Assessment Tool • Monthly Reconciliations • Online Training Opportunities (Course Handouts and Resources): – http://www.fis.ncsu.edu/controller/training/class_resources.asp 8
DISBURSEMENT PROCESS Goals • Ensure that money is being spent according to respective guidelines with sufficient supporting documentation (5 W’s) • Accurately reflect travel expenses, including completing a travel authorization (when applicable) How To’s • Self Assessment Tool • Monthly Reconciliations • Online Training Opportunities (Course Handouts and Resources): – http://www.fis.ncsu.edu/controller/training/class_resources.asp – http://www.fis.ncsu.edu/FinTraining/FocusGroup/job_aids/ 9
TIMESHEETS AND LEAVE Goals • Appropriate review by the supervisor to identify and correct errors that could result in University violation of FLSA • Record all types of leave in the University’s Web Leave System • Understand the importance of compensatory time http://www.ncsu.edu/human_resources/hrim/comp_time.php How To’s • Self Assessment Tool • Online Training Opportunities (Supervisor and employee training and guidance): http://www.ncsu.edu/human_resources/classcomp/timerecdefault.php 10
CONTRACTS AND GRANTS Goals • Meet sponsors’ requirements and increase preparedness for external audits • Thorough documentation (Always provide the 5 W’S): • WHO, WHAT, WHEN, WHERE, and WHY How To’s • Self Assessment Tool • Reconcile contract or grant expenditures just as you would any other account • Online Training Opportunities: • Sponsored Programs and Regulatory Compliance Service (SPARCS): http://www.ncsu.edu/sparcs/training/index.html • Contracts and Grants: http://www.ncsu.edu/cng/training/index.php 11
BUSINESS PRACTICES Goals • Avoid common issues such as not redacting employee’s information (personal or financial) or entire purchase card number from Office forms or documentation loaded into the financial system • Promote an environment of solid controls over business processes to prevent and detect errors How To’s • Self Assessment Tool • Online Training Opportunities: Office of General Counsel “Public Records: Preservation, Release, and Disposition” http://www.ncsu.edu/general_counsel/training/PublicRecords Tutorial.html 12
FRAUD AWARENESS Occupational Fraud: “the use of one’s occupation for personal enrichment through the deliberate misuse or misapplication of the employing organization’s resources or assets.” Source: The Association of Certified Fraud Examiners, 2002 Report to the Nations on Occupational Fraud and Abuse 13
HOW OCCUPATIONAL FRAUD IS COMMITTED The Fraud Triangle Source: TheIIA.org 14
PROFILE OF A FRAUDSTER • Intelligent • Inquisitive • Risk taker • Hard worker • Between 31 and 45 years old • With organization 1-5 years • No criminal history • Most likely in 1 of 6 departments Who is most likely to commit fraud? About 80% of the population, given the right combination of opportunity, motive and ability to rationalize the act. Source: ACFE.com 15
Fraud Reported in Higher Education • Former Georgia Tech worker gets jail time for mail fraud; pleads guilty to 22 counts (2008) – Access to P-cards – April 2002 – 2007 – Bought more than 3,800 personal items, costing over $316,000 – Created fake receipts, submitted to supervisor, and made false entries Video in the accounting records Source: http://www.bizjournals.com/atlanta/stories/2008/08/18/daily29.html 16
FRAUD REPORTED IN HIGHER EDUCATION • Box office and business operation of UNC Performing Arts series cannot account for $123,500 (2012) • Occurred from 2007 to 2011 • Audit found $121,000 in cash revenue and $2,500 in checks missing • Same employee prepared, deposited, and recorded cash from ticket sales • Deposits were delayed at times for two or three weeks • The SBI is currently investigating; a definitive suspect has not yet been determined Source: http://www.newsobserver.com/2012/11/13/2481665/unc-audit-uncovers-123500-missing.html 17
Fraud at NCSU • Fictitious or inflated business/travel expenses • Employees performing work for personal companies during University work hours • Use of University funds for personal benefit/purchases • Theft of University assets • Use of University resources for personal benefit
WARNING SIGNS, RED FLAGS, AND COMMON INDICATORS Source: ACFE.com 19
WARNING SIGNS, RED FLAGS, AND COMMON INDICATORS • Missing documents • Patterns of • Lost receipts “honest errors” • Credit card slip only • Blames vendor • Order form only • Blames system Deflect Avoid • Shipped off • Changes subject Issue Oversight campus • “When I get time” Hide Delay Delay • Illegible receipt • “Will request new Nature of Oversight Oversight • Altered receipt receipt” Transaction • Substitute receipt • “Have requested • Summary receipt credit” • “Will look into” 20 Source: University of South Florida Internal Audit
DETECTION OF FRAUD SCHEMES pennyscribbler.wordpress.com jimunro.blogspot.com Source: ACFE.com 21
DETECTION OF FRAUD SCHEMES Initial Detection of Occupational Frauds Source: ACFE.com 22
HOW TO REPORT SUSPECTED FRAUD AT NCSU • NC State Internal Audit Hotline • Phone: 919-515-8355 and leave a detailed voicemail • Phone: 919-515-8862 to speak with the Director • Fax: 919-513-2122 to provide a written report • Website: http://www.ncsu.edu/internal_audit/hotline/ – Complete form in detail – Can be anonymous • Office of the State Auditor • 919-730-TIPS Source: http://www.ncsu.edu/internal_audit/hotline/ 23
IT SECURITY TIPS 24
IT SECURITY TIPS • University Security Policies • Physical Security • Password Security • Desktop Firewall • System Update • Basic Security Hardening • Remote Connection • Mobile Device Security • Secure Cloud Computing • Safe Social Interaction 25
UNIVERSITY SECURITY POLICIES • Computer Use Policy ( POL 08.00.01) http://policies.ncsu.edu/policy/pol-08-00-01 – Broad outline of acceptable use of university IT resources • Computer Use Regulation (REG 08.00.02) http://policies.ncsu.edu/regulation/reg-08-00-02 – More details on acceptable use – Limited personal use allowed; expect no privacy – No commercial gain; no University endorsement • Data Management Procedures (REG 08.00.03) http://policies.ncsu.edu/regulation/reg-08-00-03 – Assigns data stewards and data custodians – Makes you responsible for data security, privacy, appropriate use, disposition of data in your custody 26
PHYSICAL SECURITY • Protect laptops, iPads, … under lock and key • Never leave mobile devices unattended • Avoid shoulder surfing • Use password-protected screen savers • Practice CTRL+ALT+DELETE password locking • Use privacy screens • Safely store software media • Work with IT to backup important data • Prevent fire/water damage to hardware/media • Protect mobile devices like your wallet/purse! 27
PASSWORD SECURITY • NC State Password Standard www.ncsu.edu/security/prr/computer-use/PasswordStandard20070509.doc – Min Password Length: 8 – Max Password Age: 30, 90, 365 – Allow password re-use: No • Pick strong, complex passwords that you can remember, but “impossible” for others to guess • No dictionary words or well-known phrases • Use passphrases instead of passwords • Use separate work and personal passwords • Never send passwords in email • Never share passwords with anyone, ever! 28
Recommend
More recommend
