Business Operations Meeting

1
Business Operations Meeting Audit Updates
David Cutri, CPA, CISA, CIA (Dave) Director of
Internal Audit The University of Toledo The
University of Toledo Medical Center November 17,
2010
2
Agenda

• Upcoming Accounts Payable Audit
• Internal Controls/Risk Assessment/Risk Management
  Training
• Departmental Field Audits
• Internal Audit Website (20 Questions for
  Internal Audit)
• FY2011 Internal Audit Plan

3
Upcoming Accounts Payable Audit

• Profit Recovery Systems, Inc. PRS, based in
  Lyndhurst, Ohio has been engaged to perform a
  review of our accounts payable disbursement
  transactions for the period July 1, 2007 through
  June 30, 2010.
• PRS will be analyzing data from our accounts
  payable system to identify duplicate payments,
  overpayments, and other recovery opportunities.
• PRS will also be requesting certain account
  information from our suppliers and reconciling
  that information to transactional information
  from our accounts payable system.
• PRS will be performing most of their work offsite
  and they will be corresponding directly with our
  suppliers primarily by phone and fax.

4
Upcoming Accounts Payable Audit (continued)

• PRS will be representing themselves as members of
  The University of Toledo internal audit staff,
  and any fax correspondence they send to our
  suppliers will be on The University of Toledo
  letterhead.
• The primary PRS auditors working on this project
  are Jim Fenker, Neal Morrison, and Gary Butzback.
  
• If you receive inquiries from any of our
  suppliers as to the work PRS is performing,
  please confirm that their work is fully
  authorized and encourage our suppliers to provide
  whatever information is requested.
• If you have any questions about this project,
  please contact David Cutri (Director of Internal
  Audit, [phone])).

5
Internal Control Training/Departmental Audits

• Scope of Training
• To encompass internal control, risk management,
  and risk assessment topics
• Refining course content to be considered for UT
  certificate-level training.
• Also considering delivery to departments on a
  scheduled/as requested basis.
• Departmental Audits
• Scope being refined will address issues such as
  A/P, procurement, p-card compliance, records
  management, IT compliance, etc.
• Open to other areas of interest/concern from
  Business Operations.
• Departmental audits will commence after internal
  control training has been sufficiently rolled
  out.

6
Internal Audit Website
7
20 Questions for Internal Audit (hard copy
being routed)

• How can I benefit from an internal audit?
• Who gets copies of the audit report? What about
  confidentiality? Can anyone see the auditors
  report?
• What can I do to help Internal Audit achieve its
  mission?
• Will I get in trouble should issues be identified
  during an internal audit?
• Why did I get selected to be audited? Does it
  mean Im in trouble?
• Can I prepare for an internal audit? How?
• Who can request an internal audit at UT?
• Do you ever follow up on findings raised during
  previous internal audits?
• I understand that Internal Audit will help me
  manage the risks in the area. So what exactly is
  a business risk?
• What is the purpose of the UT Athletics
  Compliance function?

8
20 Questions for Internal Audit (hard copy
being routed)

• Shouldnt the UT Internal Audit and Compliance
  functions be separate? In what ways can they
  collaborate?
• What are the lines of business within UT
  Internal Audit?
• What is a Control Self-Assessment? How does it
  differ from an audit?
• What performance measures does UT Internal Audit
  have in place to measure its success?
• What is the process for communicating audit
  results and issuing a UT audit report?
• What does UT Internal Audit do to ensure that it
  is not perceived as the police?
• Does UT Internal Audit ever get audited? If so,
  by whom?
• What qualifications are required to become an
  internal auditor?
• What is the difference between internal auditors
  and external auditors? Dont they look at the
  same stuff?
• What is the Anonymous Reporting Line? When could
  I/should I use it?

9
FY2011 Internal Audit Plan (in progress)
10
(No Transcript)