Internal Control Update

FY 2011 Unit Certification Resultsand

FY 2012 Plans

April 10, 2012 BAG Meeting

FY 2011 Unit Certification Results

“Yes” Response:1st Year – Gap analysis completed and plans in place for addressing control gaps within the next 12 monthsOn-Going – Unit has completed annual gap analysis and proper controls are in place

2

FY

20

07

FY

20

08

FY

20

08

FY

20

09

FY

20

09

FY

20

10

FY

20

11

FY

20

10

FY

20

11

FY

20

10

FY

20

11

FY

20

10

FY

20

11

FY

20

10

FY

20

11

FY

20

11

FY

20

11

FY

20

09

FY

20

09

3

FY2007 FY2008 FY2009 FY2010 FY201160%

65%

70%

75%

80%

85%

90%

95%

100%

63%

74%

83%

77%

89%

81%

92%93%

94% 96%

78%

87%89%

87%

93%

FY 2011 Unit Certification Results

All Other Categories

Overall Total

Internal Controls

Trend of “Yes” Responses

3

(1 Process)

(7 Processes)

Internal Controls – Processes that require units to perform annual gap analysis of key controlsAll Other – Attestation topics such as Stewardship, Financial Results, IT Security and other key risk related topics

Compliance Hotline Availablein Wolverine Access

4 4

FY 2012 Internal Control Plans

5

New for FY 2012• Compliance Hotline – Increasing awareness:

“I am promoting the University Compliance Hotline within my unit by ensuring Compliance Hotline posters are prominently displayed and have sent a communication to my unit on the process for reporting incidents or concerns at U-M”

• Unit Administered Financial Aid – tools available on website • Data driven insight to improve controls and accountability

On-Going Financial Related Processes• Minor updates (changes highlighted in red) – tools available on

website• Human Subject Incentive Payments (HSIP) and Employee Travel

and Expense (Concur) – “have proper controls in place”

MReports• Added additional MReports Internal Control access role:

‒ Everything including Employment reports (current)‒ Everything except Employment reports (new access option)

• On-Line Sub-Certification and Gap Analysis functionality available in MReports (FY2012 Gap Analysis updates in progress)

5

Recent Audit Findings

6

• “University Audits reviewed the gap analysis for credit cards and determined that TBD department was not included in the self assessment process. TBD department is logistically separate from the main unit and was inadvertently not included in the annual process.”

• “In prior years, annual certifications were signed as fully compliant without performing the underlying assessment and detecting existing internal control gaps that are highlighted as part of this report.”

• TBD Department’s gap analysis was completed by only one individual who did not have complete knowledge of processes within all areas of the department. As a result, some procedures were not accurately described and existing control weaknesses were not identified.”

• “TBD unit prepares the internal controls certification centrally. Individual departments do not provide input or participate in the process. University Audits identified multiple scenarios where the control environment within a particular department did not match the overall controls documented in the unit-wide certification.”

6

FY 2012 Unit Certification Timeline

• Roll-out control matrixes and FY2012 plans to units– Confirm internal control data/metrics

• Units complete gap analysis• Distribute internal control data/metrics

to certifying Deans/VPs• Issue FY2012 Certification Requests• Signed Unit Certification Forms due• Present FY2012 Unit Certification

Results to Audit Committee

Jan – Jun

Apr - Jun

Jan – Sept

July - Aug

Early Sept

End Sept

November

Event Timing

77