FROM HINDSIGHT TO FORESIGHT REPOSITIONING INTERNAL AUDIT TO DELIVER - - PowerPoint PPT Presentation
FROM HINDSIGHT TO FORESIGHT REPOSITIONING INTERNAL AUDIT TO DELIVER HIGHER VALUE Repositioning Internal Audit FY 2016-FY2017 Audit Resource Deployment Plan Resources and Staffing Supplemental Materials Repositioning
We deliver insight and foresight to our colleagues and stakeholders through: Professional competence. Business acumen. Focus on Cornerstone Plan and Health System strategy. Data-driven analyses. Our network of colleagues and connections throughout the University and the profession. We serve the audit profession in the Commonwealth of Virginia, the higher education industry, and around the globe. We collaborate and share our knowledge generously. We set the bar for excellence and leading practice in internal auditing. Our relationships embody respect, insight, balance, trust, and care. We value: Leadership development. Civility. The voices of our stakeholders. We operate transparently. We are aware of our impact. We have an enterprise view.
2
Industry Risks:
Higher Ed Healthcare Peer Benchmarking Hot Topics
Enterprise Risks:
risks
Strategic Objectives:
Cornerstone Plan U.Va. Health System Strategy
TO BUILD THE AUDIT PLAN WE ESTABLISHED AN “AUDIT UNIVERSE” AND ASSIGNED RISK WEIGHTINGS:
Stakeholder input including: ACR Chairman, MC Cabinet, EVP/COO, IT Leadership, Provost’s Office
Academic Div: U.Va.’s Budget System Hierarchical Org Data (Unit, Expenditure $, Grant $, FTEs) MC/Health System: May 2015 Operating Margin Report
Audit Universe
3
Risks
Compliance
(e.g. ACO, Value Based Care)
Clinical Engineering Charge Capture
Cybersecurity IT Governance and Standards IT Asset Management Change Control and System Configuration
Faculty Recruitment and Retention Research Expansion Initiative
Fiscal Stewardship (Pan-University) EPIC Phase 2 Implementation Managerial Reporting Implementation PeopleSoft Upgrade Physical Safety and Security Integrated Assurance: Compliance Oversight Verification Data Privacy Segregation of Duties (Oracle, PeopleSoft, EPIC)
4
Chief Audit Executive Director IT Audit Assoc Dir IT Senior IT Auditor New Hire Senior IT Auditor IT Auditor Special Projects (all areas) Director HS and University Audits Manager Senior Auditor Senior Auditor Staff Auditor Manager HS Audits Senior HS Auditor New Hire HS Auditor New Hire HS Auditor Office Manager
Current vacancies in red Redeployment of resources in green
Health System (HS) Auditors depends on skill sets of TBD Director
position headcount while increasing Managers’ span
not replaced)
where specialization of audit skills is required as we make new hires/shift current resources/co- source
Monitoring/Fraud Risk
using pooled resource approach where possible. Administrative reporting would remain as shown. 5
6
Curry School of Education In progress from prior year plan
background checks, patient health data, revenue generation/charge capture
Faculty Recruitment and Retention
Assemble and Support a Distinguishing Faculty
Human Capital
management for strategically critical program Research Expansion Initiative
Knowledge
Goals; Keeping Pace
management for strategically critical program
7
Pyxis Medstation Access Review In progress from prior year plan
usage Clinical Engineering
Information
Compliance
practices
scheduling and equipment monitoring procedures
evaluation Charge Capture
fee billing by the MC for nurse
Administration Value Based Care
Trend
leadership
8
Information Security, Policy, and Records Office
Assessment
Cybersecurity
Leveraging IT
Assessment
Change Control and System Configuration
controls
Assessment
(SIS)
modules
9
PeopleSoft
IT Asset Management KPMG 2015 IT Security Assessment
Central and Non-Central Assets and Systems
Disaster Recovery
controls
10
Fiscal Stewardship Cornerstone Pillar V: Steward the University's Resources to Promote Academic Excellence and Affordable Access
Financial Model EPIC Phase 2 Implementation (HS Revenue Module)
application
Managerial Reporting Implementation
Physical Safety and Security ERM Risk: Safety/security of students, faculty and staff
11
Integrated Assurance
Compliance
Effectiveness of 2nd line of defense compliance functions:
Privacy
Compliance
Data)
environments Segregation of Duties
12