Officers & Directors - ACUA & Directors President Marsha Payne University of California Irvine, CA [email protected] (949) 824-7855 Vice President Mike …

Officers & Directors

President

Marsha Payne

University of CaliforniaIrvine, CA

[email protected](949) 824-7855

Vice President

Mike Peppers

University of Texas Medical BranchGalveston, Tx


Immediate Past President

Raymond M. Cochran

Columbia UniversityNew York, NY


Secretary/Treasurer

Maureen Cassidy

Loyola Marymount UniversityLos Angeles, CA


Board Member-At-Large

Mary Barnett

University of RichmondRichmond, VA



Kathy Burgmeier

The University of MontanaMissoula, MT



Rob Clark

Georgia Institute of TechnologyAtlanta, GA



Seth Kornetsky

Tufts UniversitySomerville, MA



Alex Tzoumas

University of ColoradoBoulder, CO


Standing Committees

Accounting Principles

Rick Whitfield

University of PennsylvaniaPhiladelphia, PA


Audit Committee

Patrick Reed

University of CaliforniaOakland, CA


Best Practices

Steve Jung

Stanford UniversityStanford, CA


Governmental Affairs

Kent Kay

University of Alabama SystemBirmingham, AL


Information & Technology

Rich Peper

Bowling Green UniversityBowling Green, OH


Midyear Seminar

Mark Good

Wake Forest UniversityWinston-Salem, [email protected]

(336) 758-4811

Professional Education

Seth Kornetsky

Tufts UniversitySomerville, MA


Publications

Victoria S. Escalera

Brown UniversityProvidence, RI


Web Site

Camille Rigney

Brown UniversityProvidence, RI

[email protected] (401) 863-2438

Executive Office

Executive Director

Brad L. Feldman

[email protected]

Managing Director

Jenny Stocker

[email protected]

Member Services Coordinator

Barb Zimmerman

[email protected]

5008-03 Pine Creek DriveWesterville, OH 43081-4899

Phone: (614) 891-7720Fax: (614) 895-3466

www.acua.orgEmail: [email protected]

Contents

Features

An ACUA Couple: Les and Linda Clark . . . . . . . . . . . . . . . . . .6

Human Subject Research Compliance:

Part of the Audit Universe . . . . . . . . . . . . . . . . . . . . . . . .9

Seth Kornetsky and Susan Kornetsky

ACUA Best Practice Aid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14

Michael Trefusis-Paynter and Brian Bartsh

An Approach to Limited Scope Audits . . . . . . . . . . . . . . . . . .16

David Swanberg

Departments

Officers, Directors

and Standing Committees . . . . . 2

The President’s View . . . . . . . . . 4

Marsha Payne

From the Editor . . . . . . . . . . . . . . 4


Heard on ACUA-L . . . . . . . . . . . 21

Spotlight on ABACUS . . . . . . . . 23

Membership

Call for Nominations . . . . . . . . 19

Member News . . . . . . . . . . . . . . 20

Welcome to the Newest

Members of ACUA . . . . . . . . . . 21

Resources

Position Announcements . . . . 22

The College & University Auditor is the official publication of the Association ofCollege & University Auditors. It is published four times a year in Westerville, Ohio as

a benefit of membership. Articles in the College & University Auditor represent theopinion of the authors and do not necessarily represent the opinion of governance,

members or the staff of the Association of College & University Auditors. Acceptanceof advertising does not imply endorsement by ACUA.

Editor


Brown University

Managing Editor

Jenny Stocker

Art Director

Rebecca C. Popovich

Design Firm

Bannister Communications Group

Printer

J. F. Hopkins & Associates

DEPARTMENTS 3

4 College & University Auditor

From the EditorBy Victoria S. Escalera, Publications Committee Chair

It's often said that a picture tells a thousand words. Inthis issue, a picture inspired approximately that manywords in an interview with Linda and Les Clark. Theyare two ACUA members from Arizona who happen tobe married to one another and who spoke recently(electronically, of course) with PublicationsCommittee member Annette Stojeck of CornellUniversity and me. The result seems a fitting featurefor a magazine published around Valentine's Day.

This issue features another type of ACUA couple, too.Seth and Susan Kornetsky teamed up years ago tomarry and raise a family, but last fall saw their firstjoint endeavor on ACUA's behalf. Seth, Audit Directorat Tufts University and an active ACUA leader,recruited Susan, the Director of Clinical ResearchCompliance at Children's Hospital in Boston andactive in her profession's circles, to team-teach a

seminar about institutional review boards (IRBs) atthe annual conference in Montreal. It was athoroughly substantive, interesting presentation, justlike their article on IRBs in this issue.

CandU Auditor's primary goal is to bring readers aselection of informative and well-written articles ondifferent audit-related topics in each issue. Readerswill find that Dave Swanberg of the University ofCalifornia at Irvine has contributed to achieving thatgoal in these pages with his article about an approachUCI uses to provide audit coverage to limited riskentities. Dave is an editor's dream of what acontributing author should be, volunteering an articleexcellently written at its first submission, and wellbefore the suggested deadline. I hope that otherACUA members will be inspired by his example andconsider becoming CandU Auditor authors, too.

On behalf of the ACUA Board of Directors, I wouldlike to thank all of you who participated in our onlinesurvey of your thoughts about the future of ACUA.We will be using the results of this survey in ourstrategic planning meeting in February (which willlikely be over by the time you read this!). I had achance to review the summarized results, and wasstruck by a few things I wanted to share with you.

I was quite pleased that the responses werepredominantly positive, and many of you hadsuggestions for improvements. Your ideas will be veryhelpful to the board as we consider our plans for thefuture.

I was struck by the similarity in responses. When weasked open-ended questions about how you seeACUA and how you want to see ACUA, certain wordskept appearing: professionalism, learning,networking, camaraderie. A large number of youseem to think these terms either already define us,or should define us.

I was struck by the differences in responses. Thisreminds us that we will never be able to be all thingsto all people. We are all individuals, and what wewant or need from an organization varies among us,as well as within us at different times.

Please remember that we on the board are just likeyou. We are not an elite force, we are not a clique,

and we are not a club. We are auditors like you, whovolunteered to serve, or agreed to serve when asked.Most of us did not know each other when we wereelected, but all became friends as we workedtogether. Over the years I have served on the board,we have encouraged the nominating committee topresent nominees for election to represent our variedconstituency - public/private, large/small, single-/multi-campus. I believe that effort has beensuccessful. Our purpose as a board is to guide theorganization into the future, to set goals that areconsistent with the needs and desires of our variousmember institutions, and to plan actions that willenable us to achieve those goals. While the ninemembers of the board are the ones charged withsuch planning at any given time, the board itselfchanges over time. In fact, none of the current boardmembers were on the board when I first was elected.Elsewhere in this issue, you will see a call fornominations for open positions next year. Iencourage any of you who have an interest indetermining the future of our organization, to comeforward to offer your services. If you cannot makesuch a large commitment, volunteer to chair or serveon a committee. If you can do neither of these, thencome talk to us and share your ideas. Or, just cometalk to us and make a new friend.

I look forward to seeing many of you again, andmeeting others of you for the first time, at theMidyear Seminar in Phoenix, April 1-4.

The President’s ViewBy Marsha Payne, President

DEPARTMENTS 5

Thank You to ACUA’s Conference Sponsors

The photo taken of Les and Linda Clark atthe annual ACUA conference in Montrealinspired this article. They are both auditorsat educational institutions in Arizona. Theyhave the same initials and same magnificentsmiles. And from the looks of the cards onthe table, they can each count to twenty-one! What else do they have in common?Let's find out...

CandU Auditor: How did the two of youmeet?

Linda: We met at a mutual friend's SuperBowl party.

Les: Is that all you remember? I didn't makemore of a first impression? I'm crushed! Tosay it wasn't love at first sight is prettyaccurate. Our paths crossed numerous timesafter that. (Something about keeping anopen mind.)

CandU Auditor: How long have you beenmarried?

Linda: Nine and one-half years.

Les: Linda went from a sweet, never-been-married lady to a mother and grandmother

with the two little words "I do." About a yearbefore we were married, I informed her that Ihad a daughter in college and a grown sonwho had one child. Linda told me later that atthe time, her knees buckled from the news.

CandU Auditor: How long have you beeninvolved in auditing, internal auditing, andhigher education?

Linda: Twelve years in auditing altogether,ten of them in higher ed.

Les: It depends upon what and how youcount. After graduating in '68, the first twoyears of my career were with the Bostonoffice of Arthur Young & Company, followedby one year with a local CPA firm. For thesix years between '75 and '81, I wasemployed by the controller's office of TheUniversity of Arizona, where four out of thesix years I was the audit coordinator to theoutside CPA firm. Between '81 and '95, Iworked for a software developmentcompany, was controller for a businessschool and a financial analyst for a savingsand loan. In '95, when the universityreopened the internal audit department, Iwas fortunate to return to the university as astaff auditor. This works out to at least eightyears of full-time audit work, five years inhigher ed. Audit skills have served me verywell throughout my career.

CandU Auditor: Les, what brought you backto higher ed and as an auditor?

Les: Linda kept talking about the great ACUAconferences and I couldn't take it any longer!First it was Salt Lake City ('91) shortly afterwe were married, then Birmingham ('92),then Oakland ('93), and by Raleigh ('94) itwas too much! I just had to find a valid wayto be included. There were reports ofauditors that not only dance, they dancetogether although not married to each otherwith music played by a DJ whose last nameis also Clark. And I heard of optional tours toplaces of interest in the locales and earningCPE credits as well! Could this be true? Howdo I get such a deal? Oh no, not back to myformer employer! There's almost no onethere who remembers me, so I hope myreputation is intact.

The truth is I missed the university verymuch, and underwriting real estate for theResolution Trust Corporation (Savings &Loan assets) was about to end. Additionally,internal audit would bring me in contact


An ACUA Couple: Les and Linda Clark

Linda Clark is theInternal Auditor for the Pima CountyCommunity CollegeDistrict, and Les Clarkis a staff auditor forthe University ofArizona.

FEATURES 7

with individual departments with which Ihad little contact during my earlier stint.

CandU Auditor: What's it like to be marriedto someone in the same profession?

Linda: We never see each other and whenwe do, we can't talk about anything. We dogive each other lots of permission to have"private auditor moods" when confidentialor sensitive issues are going on at the office.Most of all, we make a great effort to leavework at the office and not bring it home.

Les: Right-on. We respect each other's"professional privacy space."

CandU Auditor: Do you talk shop at home?

Linda: Only generically until the auditreport is issued. Since we both work forpublic institutions and audit reports arepublic information, sometimes we dodiscuss particularly interesting issues afteraudit reports are issued.

Les: What you're probably asking is how werelieve workplace stress if we can't comehome and discuss office "problems." Wetake an early-morning walk of about 40minutes through the neighborhood, usingseveral routes for variety. This is ourmorning "quality time." To start out theevening, we try to be home by 6:30 p.m. towatch Vanna turn the letters on the Wheelof Fortune. This might sound silly, but it is aword puzzle instead of a number puzzle andwe try to solve the word problem togetherbefore the contestant does. We also try torelieve stress and avoid feelings of beingoverwhelmed by sharing household duties.On an alternating basis, evening meals arecooked by one of us who also does theshopping. The other sets the table andcleans the dishes and cookware after themeal. I do windows and run a really fastvacuum cleaner, too. Oh yes, I bought aMiata last March, and that sports-carcommute is a real blast. Some say I'm in mysecond childhood. I enjoy model trains (N-Scale), too.

Linda: Being married to Les who alwaysmakes me laugh is a great stress reliever. Ialso enjoy reading and traveling.

CandU Auditor: Do you have any children,and if so, are any of them auditors orthinking of becoming auditors?

Linda: Les has two wonderful children andthree delightful grandchildren. I feel blessedto be part of their lives.

Les: My daughter is an intensive care nurseand my son was an executive chef at acountry club but now installs home theatersfor people with the big bucks needed to payhim. He once told me that he didn't want tobe an accountant because of the long hours.He worked more hours as a chef than I everdid as an accountant, except during taxseason.

CandU Auditor: How are your respectiveschools different?

Linda: I work for the Pima CountyCommunity College District, the fifth-largestmulti-campus community college in thecountry. We have six campuses, serving astudent headcount of 74,079, whichtranslates to 17,819 FTEs. I am the internalauditor and I have a half-time staff auditor.Additional auditor resources are addedwhen we need them.

Les: I work for the University of Arizona. It'sa single-campus, Research I Institution(ranked about 13th) that includes a medicalcenter and a law school. The universityemploys roughly 12,000 and has an FTE inthe neighborhood of 34,000 students. Ouroffice includes a chief auditor, anadministrative assistant, and two staffauditors, of which I am one.

CandU Auditor: Do your schools' auditdepartments follow similar approaches?

Les: I cannot say with any kind of certainty(we don't talk a lot about this either), but Iwould guess they do as we both follow IIA'sStandards for the Professional Practice ofInternal Auditing and strive to audit for thebenefit of our respective institutions. Thismeans that our audit work is typicallyoriented to assisting departments complywith policies and good business practices,operate more efficiently and effectively, andbetter serve their customers.

Linda: We both attend ACUA trainingsessions, so our similarities are probablyfrom that training. Lots of good informationon successful communication styles andcollaborative audit approaches have servedmy institution well.

continued...


CandU Auditor: Do you follow similaraudit approaches personally?

Linda: I believe we both listen carefully andrespectfully to our auditees. We also try toinstill a sense of humor into the proceedingsor otherwise make some humanconnection. My tendency is to listen to themanagerial/supervisory explanation andthen involve the lowest level technical staffin the fieldwork so audit testing is valid allalong the reporting line. Unless a fraud issueis involved, technicians typically receiveverbal feedback during the fieldwork. Draftreports are fluid until the Chancellor blessesthem. My findings are not negotiable but thelanguage sometimes is.

Les: Yep! (Who said I couldn't be brief.)The only refinement I would make is thatat the University of Arizona, Chancellor-level management (president and variouslevel vice presidents) does not typicallyparticipate in findings and report wording.But as in Linda's shop, the senior managerover the audited area is provided with adraft copy of the audit report to review forfactual accuracy and language choices.

CandU Auditor: Any strong differences ofopinion between you in the audit arena?

Linda: No, because Les doesn't work forme. He works for a fine chief auditornamed Fran Foy and can go to her foradvice and direction.

Les: I can't think of any at this point. I feelvery fortunate to have a strong andknowledgeable supervisor to discussapproaches to audit engagements with.

CandU Auditor: Are you both operationalauditors, or do you have differentspecialties from each other?

Linda: My background is operational andcompliance auditing. I am also a certifiedfraud examiner, so some of my fieldwork isdone with evidentiary rules in mind. Onceor twice a year I give "heads up"presentations to our campus executiveteams on such topics as the COSOframework and supervisory survival tips towhistleblower complaints.

Les: My background includes financialauditing as well as operational andcompliance. Since coming back to theuniversity in '95, I have not been faced witha financial auditing engagement, per se.

CandU Auditor: Are you on the samedaily schedules? Are your institutions closeenough that you can commute together?Linda: We work similar daily schedules,however, unless one of our cars is in forrepairs, we drive separately. Les can walkacross campus or use the U of A shuttle,but my territory covers a 30-square milearea. I use my car to travel betweencampuses and never know for sure justwhen I may need to do that.

Les: In addition, our base offices areapproximately six miles apart. If wecommuted together, we would have todovetail work schedules with each other—especially the travel time between offices.One might have to wait for the other tofinish work, in which case one of us wouldfeel rushed while the other would bewaiting. Then there are stops for groceriesor other errands. Wow! A daily commutetogether would be a real stress contributor.We don't need that!

CandU Auditor: Do you always attend theACUA conferences together? When you do,do you attend the same sessions?

Linda: We sometimes attend the sameconferences together and sometimes attendthe same sessions. The last memorablesession we attended together was TomSalzman's class at the Tampa mid-year. Iwent to St. Louis and San Antonio on myown and Les went to the mid-year in SanDiego without me. We DEFINITELY went toNorfolk, Hilton Head, and Montrealtogether but attended separate sessions forthe most part. By the way, if you see useating our meals separately, it's notbecause we are mad at each other butbecause we didn't happen to run into eachother in the chow line or want to networkwith other auditors.

Les: I never would have believed Lindatelling me that Tom Salzman throws candyand other delightful prizes to his seminarattendees had I not been there in personwith her to witness this phenomenon.ACUA seminars are as enjoyable as theyare informative. We both evaluateconference offerings and the subject'srelevance to our separate workenvironments. In my case, Fran has beenvery supportive and super about all of usauditors from the U of A attending ACUAconferences. Our respective institutionspay only one-half the room rate, so it iseconomical for us both to go.

AN ACUA COUPLE...continued from page 7

FEATURES 9

Human Subject Research Compliance: Part of the Audit UniverseBy Seth Kornetsky, CIA, CFE, and Susan Kornetsky, MPH

Introduction

Human subject research in the United States has becomeincreasingly regulated over the past thirty years. Sinceauditors are charged with the responsibility of identifyingand, if possible, mitigating risk, human subject researchcompliance should not be excluded from the audit universe.

The genesis of the regulatory environment for human subjectresearch can be traced to three significant events. The first isthe Nuremberg Code that resulted from the 1946-47 NaziDoctor Trial. The Nuremberg Code established the principleof informed consent for individuals who wished to volunteeras participants in human subject research. The NurembergCode was followed by the Helsinki Declaration which, in 1964,called for increased oversight of human subject research. Thelast major influencing event was a federally funded studybegun in 1932 that followed 300 poor rural black syphiliticmales and the natural course of their disease. When penicillinbecame widely available in 1951, a decision was made to denythis drug to these men, and they were not told of itsavailability. In 1970, an investigative report made this decisionpublic, and finally in 1998, President Clinton offered an officialapology.

The Office for Human Research Protections (OHRP), formerlyknown as the Office for the Protection of Research Risks(OPRR), reports under the Department of Health and HumanServices (DHHS). OHRP is responsible for the generaladministration and coordination of policies involving theprotection of human research subjects as outlined in theDHHS 45 Code of Federal Regulations (CFR) Part 46. The CFRcovers institutional responsibilities for reviewing proposedprojects that will involve human subjects, evaluatingprograms, inspecting facilities, record keeping, and reporting.In addition, the regulations outline specific criteria forinstitutional review board (IRB) protocol reviews, includingthe frequency, methodology, and requirements for informedconsent. Any institution engaged in federally funded humansubject research must have an established IRB and have filedan assurance document with OHRP that describes its humansubject research program and related policies and proceduresfor ensuring compliance with CFR Part 46.

In addition to establishing policies for the protection ofhuman research subjects, OHRP is responsible for evaluatingcompliance. It has recently been stepping up compliancereviews at universities and academic medical centersthroughout the United States concerning the activities of IRBsand documentation supporting protocol reviews andeducational outreach efforts. The outcome of some OHRPreviews has been the immediate, temporary suspension ofhuman subject research activities at certain major researchinstitutions due to issues of noncompliance. Human subjectresearch compliance has therefore become a hot topic atmany ACUA member institutions. When a university oracademic medical center's human subject research issuspended, the news usually reaches the media and adversepublicity results.

Seth T. Kornetsky, CIA,CFE, is the director ofaudit & managementadvisory services atTufts University. He hasworked for the past 15years as an internalauditor, first at BrownUniversity, then BostonCollege, and now at

Tufts. Seth is responsible for audit coverage of three separatecampuses that provide programs in undergraduate studies,medicine, dentistry, and veterinary medicine. Seth has been anannual conference presenter and midyear seminar chair forACUA. He currently co-chairs the professional educationcommittee. He also serves as an ACUA Board Member-At-Large. Seth's interest in the area of human subject researchissues developed over the dinner table with his wife Susan,and resulted in a commitment to include this area as part ofTufts' audit universe. Seth received his Bachelor's Degree inEconomics and Psychology from Brandeis University andearned a Master of Business Administration at Babson College.

Susan Kornetsky, MPH, is the director of clinical researchcompliance at Children's Hospital in Boston. Herresponsibilities include directing an IRB administrative office,educating principal investigators regarding IRB regulations,assisting investigators with protocol development, assuringinstitutional compliance with all federal and state regulationspertaining to human research, and establishing appropriatepolicies and procedures. She is the immediate past president ofthe Applied Research Ethics National Association and hasparticipated in many national conferences and task forcesdedicated to protection of human subjects. She is co-chair ofthe Council for Certification of IRB Professionals. Susan is alsoon the Board of Directors of the Association for theAccreditation of Human Research Protection Programs, anewly formed organization that is establishing an accreditationprogram for institutions with human subjects protectionprograms. She is faculty for IRB 101, an educational effortestablished to bring IRB training to individual institutions. Sheis a current member on the Dana Farber Cancer Institute IRBand New England Research Institute IRB. Susan received herBachelor's Degree in Biology from Brandeis University andearned her Master of Public Health at Boston University.

continued...


What Can Trigger an OHRPInvestigation?

Complaints to OHRP concerning howhuman subject research is beingconducted can originate from the subjectsthemselves, family members,whistleblowers, and colleagues of theprincipal investigators conducting theresearch. These complaints may be due toundisclosed adverse physical (orpsychological) reactions that resulted fromthe experimental treatments. They couldalso be due to assertions that a subject wasnot sufficiently informed of his or her rightsas a participant in the research. Othercomplaints could result if a subjectpopulation is viewed as particularlyvulnerable (e.g. prisoners, children, thedisabled) and not sufficiently informed oftheir rights and the details concerning thecourse of an experimental treatment.Reactions based on peer reviews ofpublished research and press releasesresulting from an adverse event could alsoprompt OHRP to launch investigations. Ifthe results of an investigation aresufficiently serious, OHRP is empowered tosuspend all federally funded humansubject research at the institution until theissues of noncompliance are addressed.

What Causes Suspensions to Occur?

In addition to providing a slow response toOHRP inquiries, the findings that mostcommonly prompt suspensions of humansubject research are the following:

• absence of written IRB policies and procedures,

• failure to maintain sufficiently detailed minutes of IRB meetings,

• poorly maintained IRB files,• failure to review continuing research

protocols at least annually, • lack of formal training for both

researchers and committee members on regulations covering human subjects in research,

• failure to obtain required informed consent for research involving childrenand other compromised individuals,

• inadequate IRB resources, and • overburdened IRBs.

Once a suspension occurs, all federalresearch funding involving human subjectsis suspended, including related payroll,operational support, and indirect costrecovery. All activities related to thisresearch are halted except treating enrolledsubjects whose health would be placed in

significant jeopardy if certain procedureswere discontinued. (These instances mustbe negotiated on a case-by-case basis.) Theinstitution's IRB must once again review allprotocols that fall under the suspension.Some costs to the institution aremeasurable; a sudden investment in IRBresources and training typically results.Other adverse results are less tangible butjust as significant: a loss of public trust,adverse publicity, and more difficulty inrecruiting human subject volunteers andnotable research faculty who bringsignificant grant dollars with them.

Necessary Components of a HumanSubject Protection Program

The management team of a human subjectprotection program comprises severalplayers. The Institutional Official is the"CEO" who is responsible for signing theassurance document and takesresponsibility for program compliance.This individual must set the proper toneand establish the institutional culturenecessary to ensure sufficient regulatorycompliance. To maintain objectivity, theInstitutional Official should not be includedas a voting member of the IRB. However,the Institutional Official should understandthe protocol review process, have anappreciation for resource and staffingneeds, and understand the ramifications ofnoncompliance since he or she is the maincontact for OHRP.

Next in line in the chain-of-command arethe IRB Chairperson and members.Representation on the IRB should resultfrom peer recognition of each member'saccomplishments and understanding of theregulations that apply to the human subjectresearch protocol review process. Thechairperson has ultimate authority inreviewing, approving, and suspending eachresearch protocol. Assisting the IRB areseveral professionals and administratorswho are responsible for the day-to-dayoperations of the IRB office. Theseindividuals maintain records, act asliaisons between principal investigators andthe IRB, and are instrumental in assistingwith regulatory compliance andresponding to inquiries by investigators.Education and training programs forinvestigators and IRB members are alsotypically provided by IRB Office personnel.

Ultimately, however, it is the researchersthemselves who must be held accountablefor regulatory compliance as they provide

HUMAN SUBJECT RESEARCH COMPLIANCE...continued from page 9

FEATURES 11

the direct interaction with the humansubject research participants. Therefore, it isimportant that an institution providesufficient resources to ensure theseindividuals are well-versed in the federalregulations and understand IRB officeexpectations concerning documentingprotocol procedures and interactions withtheir subjects.

The Ten Commandments of a HumanSubject Protection Program ThatAuditors Should Evaluate DuringPerformance Reviews

1. The IRB must be appropriatelyconstituted and understand its role. Thecommittee must have at least fivemembers, include men and women, andrepresent varied scientific andnonscientific professions. One membershould not be affiliated with theinstitution. The IRB together should havethe requisite knowledge of regulationsand applicable laws and sensitivity toattitudes of the community from whichresearch participants are being drawn.Auditors should review the compositionof the IRB to ensure the adequacy ofrepresentation and knowledge base ofthe committee. In addition to relying ontheir own judgment, auditors can meetwith institutional officials and highlyregarded principal investigators to obtaintheir opinions.

2. The IRB and principal investigators mustrecognize which activities constituteresearch with human subjects. Humansubject data can be gleaned throughdirect interaction with study volunteersor by being provided access toidentifiable private information. Bothactivities are subject to IRB review. It isalso important to recognize that researchsubjects are not limited to patients butcan include staff and medical students.Certain data originating from non-medicalenvironments such as anthropology andsociology may fall under the definition ofhuman subject research if it meets theaforementioned criteria. Auditors shouldreview a sample of research projects thatinvolve human subjects to determine ifall populations have been included underIRB review.

3. The IRB must comply with applicablefederal and state regulations and othercompliance policies. The regulation thatprovides primary governance overhuman subject research was issued in

August 1991 by the Department of Healthand Human Services and has beenadopted by 16 federal agencies. It is listedas DHHS 45 CFR 46 and is also known asthe "Common Rule." DHHS 45 CFR 46 isdivided into four subparts thatindividually address core requirementsand special rules for research protocoladministration involving fetuses/pregnantwomen, prisoners, and children. Auditorscontemplating a review of theirinstitution's IRB process should obtainand become familiar with this document.Any time human subject researchinvolves the use of experimental drugs,FDA jurisdiction must also be considered.FDA regulations that address clinical trialdrug studies are 21 CFR's 50, 56, 312, and812. They respectively address issues ofinformed consent, the IRB, investigationaldrugs, and investigational devices.Individual states may also have their ownguidelines governing human subjectresearch that must be considered duringan audit review.

4. The IRB must know and apply theappropriate methods of protocol review.

There exist three categories of protocolreview: exempt, expedited and full IRBreview. The DHHS 45 CFR 46 documentdefines several types of research thatwould be considered exempt from IRBreview. A proposed research protocolmust fall into one or more of thesecategories to be considered exempt.Procedures to evaluate and categorize asubmitted protocol as exempt must beclear and not left up to the responsibleprincipal investigator. Only the IRBchairperson or a designated IRB memberconducts expedited reviews. Thesereviews must involve minimal risk andmust also fall into one or more of thefederally specified categories outlined forexpedited reviews. Minor changes inpreviously approved research can alsofollow an expedited review process.

A full IRB review applies to all othercategories of human subject research thatdo not qualify for exemption or expeditedreviews. A full IRB review is conducted ata convened meeting by the IRB andrequires a quorum. Majority approvalrules, and any IRB members who have aconflict of interest related to a proposedstudy protocol must abstain from votingand leave the room. Principalinvestigators must be notified of thevoting results in writing. To be approved,the protocol description must indicate

continued...


how risks to subjects will be minimized,informed consent will occur,confidentiality will be maintained, andstudy results will be monitored.Auditors should review a sample ofhuman subject research projects thatreceived an expedited review anddetermine if they complied with theparameters governing this process.

5. The IRB must ensure that all informedconsent documents include all requiredelements and apply waivers andalterations appropriately.

Informed consent is a process, not justa document. Throughout performanceof a protocol, informed consent remainsan on-going process between theprincipal investigator and the humansubjects participating in the study. Thedocument that is signed by each subjectmust be dated, explain that the study isresearch, and describe its purpose,experimental procedures, risks,benefits, and duration. Issues ofconfidentiality and subject rights arealso included. Auditors can explore thiscompliance issue by asking if the IRBperiodically performs its own "audits" ofsigned consent forms to determine if (1)the forms have been properly signed byall participating subjects and (2) thesigned forms agree with the IRB-approved format for them.

6. IRBs must determine that a researchprotocol has a favorable risk/benefitratio.

IRBs must consider more than the riskof physical harm when considering aprotocol approval. Other risks such asemotional distress, impact on personalrelationships, and socio-economiceffects (such as loss of healthinsurance) must also be addressed.Risk to data confidentiality must also beconsidered. Possible benefits of theprotocol include the impact on societyin general as well as positive outcomesfor individuals, including the researchsubjects themselves. To determine if therationale for a decision on eachproposed protocol in a sample isevident, the auditor should review IRBcommittee meeting minutes. If therationale is not clear, then the auditorcan interview the IRB chair and/orcommittee members and ask theindividuals to explain the rationale forapproving or disapproving/modifyingthe selected protocols.

7. The IRB must review all amendments,revisions, and modifications toapproved protocols prior to principalinvestigators implementing them.

The degree of change to an existingprotocol will determine whether itqualifies for an expedited review by theIRB chair or a designate or will requirefull-board review. The auditor shoulddetermine if the IRB has guidelines inplace for determining this. A samplereview of continuing protocols that aremore than 12 months old can be usedby the auditor to determine if properIRB review and approval of proposedchanges occurred.

8. The IRB must conduct continuingreviews within appropriate intervalsand apply appropriate criteria to thereview process.

Continuing protocols must be reviewedat intervals appropriate to the degree ofrisk in the research, but not less thanonce per year. A lapse in this schedulewill be construed by OHRP as noapproval should they note it during aninvestigation. The auditor should reviewfor compliance by sampling ongoingprotocols more than 12 months old andtracing back to determine if theprincipal investigators and the IRBfollowed procedures for the renewalprocess.

9. The IRB and principal investigatorsmust comply with reportingrequirements.

Principal investigators are obligated toreport back to the IRB any adverse orunexpected events concerning theirhuman subject research. Any changesto a protocol that fall outside the rangeof IRB approval or complaints made bysubjects must also be reported. Anyserious or continuing noncomplianceevent must also be reported to OHRPalong with any instance when a trialhad to be suspended. The auditorshould inquire of the IRB concerningany instances of adverse events andwhen and how they were reported andresolved. The auditor should alsodetermine if formal policies andprocedures have been established toinvestigate issues of noncompliance andwhether or not an adequatewhistleblower policy exists.

HUMAN SUBJECT RESEARCH COMPLIANCE...continued from page 11

Audit ItemResources to promote compliance

Written procedures for IRB operations and compliance

IRB meeting minutes

Continuing reviews

Expedited reviews

Contingent approvals

Procedures for reporting non-compliance internally and externally

Meeting quorums

Protocol files that provide a trail of IRB actions

Database or other filing system to track submitted and approvedprotocols and renewal dates

Adequacy of training and expertise

Issue• Inadequate resources and institutional support

• No documentation of IRB office procedures

• Meeting minutes, votes, and discussion not properly documented • Grants not reviewed, waived consent not supported

• Failure to conduct annually

• Improper application of process

• No evidence of follow-up to ensure IRB-directed changes occurred

• Absence of any adverse event reports in the IRB files or in IRB minutes• No whistleblower policy

• Meetings convened without a proper quorum, IRB member mix• Conflict of interest issues• Votes not numerically recorded

• Poorly maintained and organized files

• No formal tracking and record-keeping systems for newly submitted and existing protocols

• No evidence of training programs for IRB members, principal investigators• Absence of IRB member-specific population expertise

(children, prisoners, pregnant women, etc.)

FEATURES 13

10. Document! Document! Document!

OHRP takes the view that if an IRBactivity or decision-making process hasnot been documented, it did not occur.The adequacy of IRB minutes is acritical component of any humansubject research compliance program.IRB minutes should indicate the namesof members present and absent, that aquorum was achieved, and anyinstances of members leaving adiscussion or vote due to a conflict ofinterest. The minutes should also reflectdiscussion summaries and findings andactions taken by the committee. IRBcommittee votes should also bedocumented with the numerical results.All correspondence between principal

investigators and IRB administrators,including memoranda, protocolapplications and approvals, continuingreviews, and signed consent forms,should be on file somewhere within theinstitution.

In conclusion, internal auditors at researchinstitutions and academic medical centersare well advised to consider including theirhuman subject research complianceprograms as one component of their riskmatrices and audit plan. Once an auditorbecomes familiar with the compliance andreporting issues, auditing human subjectresearch is no different than reviewingother more traditional institutionalactivities.

Human Subject Research ProgramAudit Issues


ACUA Best Practice AidBy Michael Trefusis-Paynter, CPA, CIA, FCCA and Brian Bartsh, FCPA, AAIBE

Michael Trefusis-Paynter, CPA, CIA,FCCA, heads up theManagement Reviewand Audit Branch ofEdith CowanUniversity (ECU) inPerth, WesternAustralia. Michael hasworked in various

accounting and auditing roles in a number ofcountries across five continents. He co-presented with Denys Martin at the 1997 ACUAconference in Norfolk, Virginia, on "Managingthe Internet as an Integral Tool of your AuditDepartment."

Brian Bartsh, FCPA, AAIBF (Sen) has over 12years experience in internal audit, half ofwhich was at management level. He is amember of the Institute of Internal Auditorsand also possesses a real estate license. He iscurrently an audit contractor for a WesternAustralia state government department calledAGWEST (standing for Agriculture, WesternAustralia).

As part of a recently completed audit entitled "IT Backup and Disaster RecoveryManagement," the Management Review and Audit Branch at Edith CowanUniversity (ECU), in Perth, Western Australia, identified the potential threats toIT operations that could cause a disaster at ECU. The Branch evaluated theinternal controls aimed at mitigating those threats, and tabled all relevant detailsin a schedule headed Potential Threats, Probabilities and Mitigation Strategies,which was added as an appendix to the audit report. For "best practice" controlsthat were already in place, the auditors placed a check-tick in the last column.For controls that were not in place, a cross-mark (X) was recorded. A keyrecommendation that emerged from the audit was for management to ensurethat mitigation strategies identified with cross-marks in the table wereimplemented by ECU.

How does your college or university fare against this table?

FEATURES 15

PROBABILITY

High

Moderate

Moderate

Low

High

High

Moderate

Moderate

Moderate

High

High

POTENTIAL THREATS

Poor management practices

Fire

Flood

Hardware failure

Software failure

Power disruption

Disgruntled employeesSabotage/vandalism

Fraudulent input or useof information

Hacking

Viruses

Physical loss

MITIGATION STRATEGIESBEST PRACTICE YOUR PRACTICE

Service Level AgreementsKey Performance IndicatorsClear policies & proceduresAdequate resources (staffing levels/training)Regular testing, monitoring and reviewEffective record keeping (asset register/logs/changes made)

No smoking policyAdequate sprinkler systems or equivalentRegular testing of fire fighting equipment and

smoke/heat detectorsEnsure no build up of rubbishDaily removal of backup to remote site

- critical systems - other systems

Adequate drainageUncluttered access to exitsEnvironmental safeguards

Documented procedures to access and restoreMultiple vendors that stock mission critical hardwareBackup or test server for all critical systemsMaintenance of adequate hardware records (location of assets)

Documented procedures to access and restoreDaily automated backup of all data filesCopy available of latest version held at remote siteRegular restoration testing from backupSoftware change controlMaintenance of adequate software records

(what applications reside on which host)

Uninterrupted Power Supply (UPS) - battery operatedon some servers

Independent external testing to ensure tight access controlsTight security measuresEnsure no unsupervised access to sensitive areasPersonnel policy - employee indemnity declarationRegular management supervision of duties

Access limited to job responsibilitiesReview physical security, especially after hoursPersonnel policy - employee indemnity declaration

Tight access controlsEffective firewalls

Monitor and enforce computer virus policiesMaintain latest effective virus prevention and

elimination software on all University hardwareEnsure regular backup to the NetworkRegular communication with all staff on latest virus

developments

Tight physical securityRegular stocktakes Maintain up-to-date records of assets and location detailsMaintain and review access log to computer roomUse of video surveillance camerasUse of alarms

Information Technology Backup and Disaster Recovery ManagementSchedule of Potential Threats, Probabilities and Mitigation Strategies


An Approach to Limited Scope AuditsBy David Swanberg, CPA, CFE

Overview

The University of California, Irvine (UCI)initiated a program of limited-scope auditsfor lower risk auditable entities in 1998 toaccomplish the following objectives:

• Expand internal audit coverage to entities seldom audited

• Provide recommendations addressing risk related issues

• Conclude on overall sufficiency ofcompliance with UCI policy

The purpose of this article is to share ourexperience in the development and imple-mentation of this well-received program.

Background

UCI has identified approximately 340separate auditable entities on the campusand at the UCI Medical Center for riskranking. Under the direction of theUniversity of California's (UC) Office of thePresident, every two years the UC's ninecampuses, of which Irvine is one, perform adetailed risk assessment of the auditableentities. At the time the program wasdeveloped, risk assessment at the UCaddressed the following five predictivefactors:

• Management control and accountabilitystructure

• Public and political sensitivity• Regulatory compliance• Dollar amount, materiality, and liquidity of

resources• Organizational change and growth trends

The risk assessment is used as a guide inselecting entities for audit plans in thefollowing two years.

After performing the risk assessmentprocess over several two-year periods, wenoted that a pattern existed. Some of theunits consistently fell in the lower one-half ofthe risk rankings. Two examples follow:

• Department of English and ComparativeLiterature -- This is a nationally acclaimeddepartment in the School of Humanities,with approximately $5,200,000 inexpenditures. It scored as a low-risk unitin the ranking for four of the five criteria:management control, public and politicalsensitivity, regulatory compliance, andorganizational changes.

• Office of Academic Personnel -- This well-respected administrative office incurredexpenditures of approximately $600,000,of which 95% were payroll related. Theexperienced staff in 11 full-time positionshad an overall average of 17 yearsexperience at UCI and 11 years inAcademic Personnel.

As we examined the prior risk assessmenthistory, we realized that some of the unitshad never experienced the pleasure of aninternal audit (not that they weredemonstrating in front of the administrationbuilding, demanding one). Implementing thelimited-scope audit concept enabled InternalAudit Services at the University of Californiato expand audit coverage so that moreauditable entities realize the possibility of anaudit.

Program Development

UCI's first challenge was to develop astandardized questionnaire that wouldaddress critical issues universal to many ofthe university's operating units. UCI's officeof internal audit services assigned a taskforce of three experienced auditors todevelop a questionnaire, which wassegmented into the five previouslymentioned predictive risk factors: (1)management control and accountabilitystructure; (2) public and political sensitivity;(3) regulatory compliance; (4) dollaramount, materiality, and liquidity ofresources; and (5) organizational change andgrowth trends.

The task force initially obtained limited-scope audit questionnaires from severalother universities, including the Universityof Texas and the University of California, SanDiego, that proved useful in developing aprogram for UCI.

The task force process went relatively well,but not without some heated input. Forexample, one of the members who had astrong background in contracts and grantswas continually advocating the importanceof proper handling of hazardous materialsand wastes. These issues were addressed inour audit questionnaire, and theirimportance was acknowledged.

The program development culminated witha questionnaire of 108 different questionsthat were organized by predictive risk factor.Some of the questions led to limited audit

DavidSwanberg,CPA, CFE isa principalauditor at theUniversity ofCalifornia,Irvine. Hespecializes inoperational

audits at both the campus and UCIMedical Center. His email address is:[email protected]

FEATURES 17

tests. For example, the question "What isyour process for time and attendancereporting?" led to a limited audit test thatexamined a small sample of documents. A representative sample of additionalquestions for the five predictive factorsfollows:

• Management Control and

Accountability Structure

- Who reviews the general ledger? Whatother financial reports are there, and whoreceives them?- How do you evaluate significant budgetvariances and unusual items?- What are the procedures for procuringlow-value items (under $2,500 at UCI)?- Does your unit have any "private" bankaccounts?- Does your unit have a documentedmission statement? Obtain a copy of thestatement.- Are there documented internal policiesand procedures unique to the unit?

• Public and Political Sensitivity

- What is the approval process that mustbe followed before research on humansor animals can occur?- What controls are in place to ensure thateach principal investigator follows theresearch on humans or animals approvalprocess?- What are the special rules associatedwith hazardous materials?- What controls are in place to ensure thatsensitive or confidential information issafeguarded from unauthorizeddisclosure?- How do you ensure that each facultyand staff member has a workingknowledge of the conflict of interestpolicies at the university?

• Regulatory Compliance

- How do you ensure that supervisors inthe department are aware of and incompliance with union policies andprocedures if they have union employees?- How do you ensure compliance with thesponsor's contract or grant regulationsconcerning the submitting of financial andprogram reports to the sponsoringagency?

• Dollar Amount, Materiality, and

Liquidity of Resources

- Do you have any cash or cashequivalents in the office?

- Where and how is cash stored?- Does the department have any theft-sensitive items, and what is their totalvalue?- What precautions are taken to safeguardtheft-sensitive assets?

• Organizational Changes and

Growth Trends

- Has there been a change in the reportingstructure?- Have there been any changes in theorganizational structure?

In addition to the questionnaire, thetaskforce also developed a "Separation ofDuties Matrix." This internal-controlevaluation form listed key duties fordepartmental budgeting, accounting,payroll/personnel administration,procurement, asset control, and oversight offederal contracts and grants. It also providedspace to identify the primary and secondaryemployees responsible for the function andthe reviewing/approving employees. Theresulting grid facilitated an easily understoodmethod of identifying internal controlweaknesses.

A copy of the complete questionnaire andinternal control matrix is presented in theUCI Internal Audit Services' web site athttp://www.audit.uci.edu under LimitedScope Audits.

Departmental Review

The director of internal audit services wouldfirst send an announcement letter to theaudit entity's department head and businessmanager about two weeks before thescheduled fieldwork. The letter explainedthe audit objectives, identified the assignedauditor, discussed the proposed audit timeframe, and highlighted the limited-scopeaudit process.

At the assigned auditor's first meeting withthe entity's business manager, the auditorfurther discussed the limited-scope auditprocess and then started working throughthe questionnaire. Frequently, the businessmanager requested that other staff members,e.g. payroll or purchasing assistants, join inthe meeting to ensure accurate responses.Additional meetings of two-hour durationwere scheduled in weekly intervals until theprocess was completed. After each meeting, we completed audit tests on-site that were

continued...


related to specific questions that wereaddressed in that meeting. The abovescheduling arrangement allowed the auditorto work on other projects simultaneouslyand not completely consume a businessmanager's time in one very long session.

At the completion of the audit fieldwork, theauditor rated each of the five predictive riskfactors on a scale of one to five, with fiverepresenting high-risk areas. The ratingshelped the auditor develop an overallconclusion about adverse exposure for theuniversity within the unit.

Audit Report

We address a five-to-six-page report in letterformat to the department head with copiesto other appropriate senior management. AtUCI, copies of audit reports are also sent tomembers of the Audit Committee. The auditreport includes the following sections:

•Scope and Objectives of the Limited ScopeAudit

• Background of the Audit Entity• Audit Comments (including areas of

strength, as well as recommendations)• Conclusion

Some examples of recommendations devel-oped during limited scope audits at UCI are:

• Closing a "private" bank account in anacademic unit that was used for essaycontest awards

• Securing theft-sensitive inventory storedin an open storage area in a research unit

• Re-evaluating the separation of dutiesbetween the placing, approving, andreceiving of orders, as well asmaintenance of the departmentalaccounting system

• Reminding principal investigators in aresearch unit before required projectstatus reports are due to the sponsoringparty

• Issuing comparative monthly revenuetracking reports for the Library CopyCenter

Estimated Hours

The entire process, including planning,interviewing, substantive testing, and reportwriting, consumed approximately 60 to 80direct audit hours per entity.

Audited Entity Response

We requested a written response to the auditreport from the department head andincluded it in final distribution of the auditreport. Departmental response to the limited-scope audit concept was very favorable at

UCI, as shown in the following representativeremarks.

• From a UCI Medical Center supportdepartment:

This is the first internal audit that I havehad the opportunity to participate in, and itwas an enlightening experience. Theexercise reinforced the need to assure thatadequate audit controls are in place anduniformly followed in daily operations. Iappreciated the structured approach to theaudit process as well as the free exchangeof information and feel that I benefited as adepartment manager from this experience.

• From a UCI Medical Center clinicaldepartment:

Thank you for the limited-scope audit of ourdepartment. The auditor was veryprofessional and the entire auditing processwas helpful. It gave us a chance to validatewhat we are doing right and gave us anopportunity to improve our performance.

The recommendation to reconcile cashreceipts with the appointment logs is agood one, and we have implemented therecommendation.

• From a campus administrative department:

I have read and concur with the findings ofthe Limited Scope Audit of our Office.

I appreciate the time and effort your Officeput into the audit process as well as thepreparation of the report. The process hasbeen a useful tool for assessing our currentmanagement practices and has helpedidentify an area where improvement ispossible. Thank you.

• From a UCI Medical Center supportdepartment:

The process gave us the opportunity to stepback and view our procedures andperformance in an objective non-biasedmanner. We are very encouraged by theoutcome.

Conclusion

Limited-scope audits accomplish theoriginally stated objectives of increasinginternal audit coverage, developing risk-related recommendations, and concludingon sufficiency of policy compliance. Theconcept of limited-scope audits for low-riskauditable entities has been well received atUCI.

AN APPROACH TO LIMITED SCOPE AUDITS...continued from page 15

Call For Nominations

MEMBERSHIP 19

Identifying and electing future volunteerleaders is critical to ACUA's future andmaintaining our position as the leadingprofessional association representingcollege and university internal auditors. As chairperson of the ACUA nominatingcommittee, I solicit your input to identify"regular members' representatives" asnominees for the two board member at-large positions; and the secretary/treasurerposition, which will be open as ofSeptember 2001. Nominees will bepresented to the board for approval andrecommended to the members for election.To allow the nominating committee time toconsider nominee qualifications, confirmtheir commitment to volunteer service, andmeet the timelines prescribed by Article V(Nominations and Elections) of the Bylaws,all submissions must be received byFriday, March 2, 2001.

A board member at-large serves for a termof three years and shall perform duties andtasks assigned by the president as deemednecessary in the administration of ACUA.Current members at-large are overseeingand/or chairing standing committees,analyzing and drafting ACUA positionresponses to exposure drafts from otherprofessional and regulatory authorities,

assessing the content and quality ofmaterials in the ACUA library, providingoversight and monitoring of advanceplanning, and providing strategic input atboard meetings on how ACUA can improveits member services. Members at-large arevoting board members. ACUA reimbursesexpenses incurred while conducting ACUAvolunteer efforts and when attending mid-year and annual board meetings (ACUAhas reasonable restrictions which apply tosuch travel expenses).

The secretary/treasurer is expected to: a) maintain accurate membership recordsof ACUA; b) maintain accurate minutes ofthe annual conference business meetingsand all board meetings; c) assure thefulfillment of approved operational andfiscal reporting requirements and theadherence to appropriate fiscal policy; d) prepare a budget for submission to the board; e) assure the preparation of the annual financial statements; and f) chair the investment committee.

Along with the nominee's name andstatement about the nominee'squalifications, please include the nominee'semail address, phone number, and faxnumber. Additionally, if you have

personally spoken to the nominee aboutserving and have confirmed theirwillingness to serve, please indicate this inyour submission. Please include yourname and contact information.

The nominating committee will make itsrecommendations to the board in April atits midyear meeting. The nominatingcommittee consists of Ray Cochran, Chairand Past President of ACUA (ColumbiaUniversity), Mary Lee Brown (University ofPennsylvania), Steve Jung (StanfordUniversity), and Tom Salzman (IllinoisState University).

Please let us know of your nominees bycontacting Ray Cochran, Chair, either viaemail, fax, phone, or letter. The officialrules for nominations are printed belowfrom the ACUA Bylaws.

Raymond M. Cochran Director of Internal AuditColumbia University475 Riverside Drive, Room 510Mail Code 7712New York, NY 10115 USA Voice: 212-851-5768Fax: 212-851-5779Email: [email protected]

ARTICLE V - NOMINATIONS AND ELECTIONS

Section 1. An annual mail ballot shall be held to elect officers who havebeen nominated in accord with these bylaws.

Section 2. Only regular members' representatives shall be eligible tohold office. No representative shall hold more than one elective officeat a time.

Section 3. Nominating procedures shall be as follows:

a) The nominating committee shall solicit the membership fornominations of eligible members to serve on the board as boardmember at-large, and for the office of secretary/treasurer. A minimumslate of one or more names shall be approved by the board andrecommended to the members for each open position.

b) The nominating committee shall propose one or more nominees forvice-president to the board for approval and recommendation to themembership. The position of president will automatically be filled bythe preceding year's vice-president.

c) Nominations may also be made by signature petition of 25 regularmembers' official representatives. The petition must be presented to thechair of the nominating committee by a date determined by the board.

d) After approval by the board, the membership shall be notified.

Section 4. Ballots and information about the candidates shall be mailedto all official representatives of regular members in good standing nolater than 90 days prior to the annual business meeting of ACUA. Theofficial representative of each regular member shall be entitled to castone vote for each open position. Mail ballots shall be valid and countedonly if received within 30 days after the date of the mailing of the ballot.

Section 5. Officers shall be elected by a plurality of votes cast.

Section 6. The membership shall be notified of the election results 45days prior to the annual business meeting.

Section 7. Any challenge to the final vote count must be presented toACUA's president no later than 30 days following the announcement ofthe election results and must be accompanied by a petition bearing thesignatures of 25 ACUA regular member official representatives. In theevent of such a challenge, the board shall retain an independent refereeto conduct an investigation and recount the ballots, if necessary. Theresults of such an investigation and/or recount shall be consideredconclusive and final.

Extract from the ACUA Bylaws:


Member News

Congratulations to Peter Cheng and Carol

Vuckovich of Wright State University

(WSU) for their recent recognition asrecipients of a national award from theAmerican Institute of Certified PublicAccountants and the American AccountingAssociation. (See sidebar article about thisaward, provided to CandU Auditor courtesyof Stephanie James Ely, CommunicationsManager, WSU.)

Brooke Afsah-Mohallatee of Eastern

Kentucky University passed the final twoparts of the Certified Internal Auditorexamination in November 2000, tocomplete all requirements for the Instituteof Internal Auditors' primary professionalcertification. Brooke has been the seniorstaff auditor at Eastern Kentucky Universityin Richmond, Kentucky, since June 1998.She is a graduate of Temple University,where she earned a Bachelor's degree inGerman and Spanish with certification inmultilingual business & government and aMaster in Business Administration with aconcentration in accounting. She currentlyserves as the president of the CentralKentucky Chapter of the IIA.

J. Betsy Bowers, Inspector General of theUniversity of West Florida, was electedsecretary of the newly formed NorthwestFlorida Chapter of the Association ofCertified Fraud Examiners. She was alsoappointed to serve on the Board ofGovernors for the Northwest FloridaChapter of the Institute of Internal Auditors.

Michelle A. Cocco, Internal Auditor at theUniversity of West Florida, was electedtreasurer of the Northwest Florida Chapterof the Institute of Internal Auditors.Michelle was also one of the recipients ofthe ACUA Scholarship in 2000.

Brian Ford of the University of Maryland

recently passed the Certified GovernmentAuditor Professional (CGAP) exam, whichis a new professional designationadministered by the Institute of InternalAuditors. A pilot exam was conducted lastfall, and Brian successfully passed it toearn this new designation.

According to Randy Ross of theUniversity of North Carolina-Charlotte,

the following ACUA members were namedin October as new officers of the NorthCarolina University Auditors Association(NCUAA), an organization of internal

auditors within the UNC System that holdsan annual conference and provides trainingopportunities for its members on an "asneeded" basis: Phyllis Petree of theUniversity of North Carolina at Chapel

Hill was named president; Nikki Howard

of the University of North Carolina at

Wilmington was named vice president;the secretary is Lisa Stallings of East

Carolina University; and the treasurer isMonique Taylor-Broome of Winston-

Salem State University.

At The University of Alabama in

Huntsville (UAH), Rhonda Saylor waspromoted from internal audit assistant tointernal auditor in November 2000.Rhonda, a graduate of Mississippi StateUniversity, served three years as a board ofeducation accountant before joining theUAH audit staff in March 1999.

Pamela Jerskey of Boston College waspromoted to assistant director of internalaudit as of January 1, 2001.

Comings and Goings

Lennox Brown has joined the internalaudit staff of the University of Maryland

System as manager of audits, informationsystems. He holds seven professionalcertifications, including CA, CIA, CISA, andCFE, and he earned a Master of Sciencedegree in accounting from the University ofWest Indies. He has worked previously foran IT banking service provider inWisconsin and a research institute inTrinidad.

The University of Maryland system hasalso recently welcomed two new membersof the University's traditional audit staff.Natalie Beckwith joins the departmentafter working as an auditor with the FederalElections Commission, and Margaret

Duggan, CPA, CFE, and a very recent CIA,has experience as an internal auditor forboth the Maryland Judiciary and the StateComptroller and as a committee reporterfor the State General Assembly. She hasalso worked in the real estate industry.

Lara Mitchell, CPA, CIA, started work atThe University of Alabama in Huntsville

(UAH) as an internal auditor in January2001. Before joining the UAH audit staff,Lara compiled over five years of externalauditing and accounting experience,

Wright State University's AuditingClass Receives National Award

It was a calculated risk. Wright State Universityteamed up an accountancy professor with twoauditors to come up with an award-winningcombination that turns accounting students intoauditors. For its innovative program combiningacademic information with hands-on experience,the university received a national award inNovember from the American Institute of CertifiedPublic Accountants (AICPA) and the AmericanAccounting Association (AAA).

The Joint AICPA/AAA Collaboration Award waspresented to Susan Lightle, Associate Professor ofAccountancy in the Raj Soin College of Business,Peter Cheng, Director of WSU's Department ofInternal Controls and Audit Services (ICAS), andCarol Vuckovich, Internal Auditor for the programthey designed and administer. More than 80students have taken their class, Auditing II, asenior level auditing class offered during thespring quarter, in the last five years.

The students in Auditing II perform actual auditsfor the university, giving them the opportunity todevelop auditing skills such as interviewing auditcustomers, flowcharting a system, and presentingan audit report in a teamwork environment.Thirty audit projects have been completed,including a financial audit of Wright State'sstudent newspaper, a review of the university'sexcess and surplus property managementoperation, and a follow-up review of theuniversity's pharmacy inventory control andoperation. One student commented that "thehands-on experience should be implemented inmore accounting courses. This course was anexcellent way to give us a chance to actually do areal-life audit."

Accepting the award in Atlanta, Lightle, Chengand Vuckovich presented the format of theAuditing II class to over 300 university faculty,staff, and CPA practitioners. Along with theaward, the three accepted a check for $3,000,presented to them by the AICPA/AAA. With it,they have established a scholarship that will paythe professional certification fees of Auditing IIstudents.

MEMBERSHIP 21

covering both business and nonprofitorganizations. She also served two years asan internal auditor in the insuranceindustry.

Dezie W. Peters, Assistant InspectorGeneral of the University of West Florida,

has been promoted to budget specialist forthe university. Dezie had been with theUWF Office of Inspector General for sevenyears prior to this promotion.

Bernie Trinne of Northern Territory

University in Australia recentlyannounced, "It is with great regret that Itender my resignation from ACUA effectivefrom 22 December 2000. My wife and I havebought a business that we will be takingover around the end of February. ... I thankyou all for your support and assistanceover the years, and wish you all, all thebest for the future."

ACUA received word in late Novemberthat one of its former presidents, FrankParks, passed away on November 4, 2000,at the age of 72. Frank was ACUA'spresident in 1986 when he was thedirector of internal audit at the Universityof North Texas. According to Tim Edwardsof the University of North Texas System,Frank worked at the University of NorthTexas for 26 years, and at the time of hisretirement in 1990, was the first internalauditor and the only director of internalaudit that UNT had ever had. Frank hadalso served in the U.S. Air Force and theNaval Reserve.

Frank's wife, Dorothy, thanked ACUA forher husband's honorary membership inthe association. She stated that he hadenjoyed being president of such a fineorganization and that they made many life-long friends through ACUA. According toone of those friends, Rick Whitfield of theUniversity of Pennsylvania, "For those ofyou who did not cross paths with Frank,

you missed meeting and knowing a trulywonderful and caring human being." Herecently recalled that Frank had beenACUA's vice president and program chairfor the 1984 ACUA conference in Nashville-- a year when Vanderbilt Universityhosted the conference; the group"Alabama" performed at the Grand OleOpry on the Saturday night that manyACUA members happened to attend; andthe conference's keynote speakersincluded both a former Miss America fromTexas that Frank had lined up for theevent, and Larry Sawyer, the reputed"father of internal auditing." Fred Chavezof the University of Maryland rememberedone of his first experiences as an ACUAcommittee chair when he sat down withFrank in San Diego, and Frank explainedthe ACUA "way" to him. Fred said, "It wasin just such ways that the traditions westill follow were developed and handeddown, and Frank was unequalled in thatrespect. I will miss him."

Welcome to the Newest Members of ACUANovember, 2000 through January, 2001

James D'ArcangeloD'Arcangelo & Co., LLP3020 Westchester AvenuePurchase, NY 10577-2538

Michael GardnerHillenbrand Industries968 Santa Maria DriveIndianapolis, IN 46143

Christin TanThe Hong Kong Institute of Education10 Lo Ping RoadTai Po, New Territories, Hong Kong

Daniel WickehamMedical College of Wisconsin8701 W. Watertown Plank RoadMilwaukee, WI 53226

Keith WindsorCollege of the North Atlantic1 Prince Philip DriveP.O. Box 1693St. John's, New Foundland, Canada A1C5P7

"Great Auditor, Great Man."

-- Tim Edwards of the University of North Texas System, aboutFrank Parks, former ACUA President and UNT's first auditdirector, who passed away in early November.

"Take arms against a sea of troubles, and in so doing, endthem."

-- Slemo Warigon of Gallaudet University, quoting Shakespearewhen complimenting Sterling Roth of the University of Alabamain Huntsville on the latter's "mea culpa" message about acomputer virus that affected the ACUA list in early December.

Heard on ACUA-L

In Memorium

Associate Audit Director

The Cornell University Audit Office is seekingan individual to join our audit managementteam. The audit office is responsible forauditing a large, complex institution withapproximately $1.9 billion in revenues and $5.5billion in assets.

This individual will plan, supervise, monitorand execute financial, compliance, operational,and special project audits of all university'scentral administration and operating units.

Requirements: Candidates should have aminimum five years experience in afinancial/compliance audit environment.Minimum 2 years supervisory experience andCPA required. CIA and MBA preferred. Mustdemonstrate strong interpersonal andcommunication skills as well as providecreative solutions and be a self-motivated,organized, and an effective team member.

Interested applicants should submit a coverletter and resume to: Michael B. Dickinson,University Audit Office, Toboggan Lodge,Cornell University, Ithaca, NY 14853-1702.

CORNELL UNIVERSITYCornell University is an Equal Opportunity, Affirmative Action Employer & Educator.

East Tennessee State University

Assistant Director of Internal Audit

Responsible to the director of internal audit forplanning and performing audits (financial,compliance, and operational) on all phases ofuniversity operations, including the College ofMedicine. Provide management with analyses,appraisals, recommendations, and specialreviews as requested. Direct the activities ofothers assigned to audits. Audit activitiesconsist of determining accuracy of financialtransactions, adequacy of internal controls,and degree of compliance with policies,procedures, laws, and regulations. Must beable to develop and revise audit programs andinternal control questionnaires, and preparewritten audit reports. Qualifications: Bachelor'sdegree in accounting (or equivalent) requiredwith CPA or CIA certification, three yearsexperience in public accounting, internalauditing, or governmental accounting, andexperience with computer-based informationsystems. Successful candidate must possessstrong communication (oral and written),analytical, and computer skills. Submitapplications by February 15, 2001 to: EastTennessee State University, Director of InternalAudit, Box 70566, Johnson City, TN 37614-1707.ETSU is an AA/EOE

Internal Audit Manager

The Medical College of Wisconsin (MCW) isseeking a manager to develop and lead anewly created internal audit office. Thisposition will be responsible for all aspects of

internal audit at MCW includinghiring/supervising staff, developing a strategicplan, identifying risk and opportunity areas,and coordinating all audit activities. The scopeof internal audit will include identifying andrecommending improvements in procedures,processes and operation across multipledepartments and areas includingadministrative, operational, clinical,educational, and research.

A Bachelor's degree in business or a relatedfield is required. A Masters in businessadministration, healthcare administration, anda CIA is preferred. Additional requirementsinclude strong analytical, audit andcommunication skills, and a minimum of sixyears progressive responsibility. Experience ina group practice, hospital or other healthcareenvironment is preferred.

The Medical College of Wisconsin, a teachinginstitution with a practice of over 650physicians, is located in Milwaukee,Wisconsin. For confidential consideration,please fax resume to (414) 805-6372 or mail to:

Compliance Office Medical College of Wisconsin 9200 W. Wisconsin Ave. Milwaukee, WI 53226

Texas A&M University System Internal Audit

Internal Auditor, Posting #01008Prefer some experience in governmental,higher education, or commercial accounting orauditing. Also, prefer candidate certified (oractively pursuing) CPA, CIA, or CISA. Otherrequirements: Strong oral and writtencommunication skills. Minimal travel on auditassignments is required.

Senior Internal Auditor, Posting #00043One to three years in governmental orcommercial accounting or auditing, includingsupervisory experience. Also, prefer candidatecertified (or actively pursuing) CPA, CIA, orCISA. Other requirements: Strong oral andwritten communication skills. Minimal travelon audit assignments is required.

Information Systems Analyst, Posting #01021Perform complex computer systems analysiswork. Work involves analyzing informationsystem needs for the department, developingIT plans and budgets, developing and/ormodifying, implementing, maintaining andmonitoring departmental information systemsand databases. Develops computerapplications and analyzes and documentsoverall system concepts/operations. Provideguidance and support for the department'shardware and software needs. Provide and/oroversee administrative support for departmentcomputers and software applications. Developand maintain web page. Supervise one ormore assistants in the accomplishment ofassigned responsibilities. Education required:

Graduation from an accredited four-yearcollege or university with major course workin computer science, data processing, ormanagement information systems; or anyequivalent combination of training andexperience. Experience required: Two or moreyears in information system operations oranalysis; and operation and support ofmicrocomputers. Prefer some experience withNovell networks, web page development andsupport, and application support.Programming/analysis skills are required andknowledge working with connectivity issuesassociated with remote network accesspreferred.

All applicants must complete a Texas A&MUniversity System application, available onlinein PDF form athttp://sago.tamu.edu/shro/jobs/jobs.HTM or e-mail us at [email protected] have an application mailed to you. You canpick up an application in person at the HumanResource Services Office, John B. ConnallyBldg., 301 Tarrow, Room 531, College Station,TX 77840-7896, (979) 458-6160.

The Texas A&M University System is anAffirmative Action/Equal EmploymentOpportunity Employer committed toexcellence through diversity.

Information Systems Auditors

The University of Massachusetts is seekingthree information systems auditors from entryto supervisor manager level for the universityauditor's office. The university consists of fivecampuses and a central office and is in theprocess of implementing financial, humanresources and student systems.

Successful candidates will perform challengingreviews throughout the university and playkey roles in the PeopleSoft project. In addition,the IS auditors will provide technical supportto the professional staff.

Positions require Bachelor's degrees, andcertification as CIA, CISA or related ispreferred. One to five years of relatedexperience is desirable. The university offersfull state benefits, including dental insuranceand tuition waivers.

Salary commensurate with experience. Pleasesend cover letter and resume to:

Human Resources Office The University of MassachusettsPresident's Office, 26th FloorOne Beacon StreetBoston, MA 02108Attn: Anna Petrillo

The University is an equalopportunity/affirmative action employer.

For information about the University, visit ourweb site at www.massachusetts.edu.

Position Announcements


23

All but the newest ACUA members willrecall that since 1995, ACUA's bestpractices committee has carried out avoluntary benchmarking service forcollege and university auditors calledABACUS: Analytical Benchmarking forAuditors in the College and UniversitySector. Comprehensive results werepublished in 1996 and again in 1999,with the results of a separate electronic"best practices" survey published lastyear. ACUA members who wish to get acopy of the 1999 comprehensive report

may do so by contacting the ACUAexecutive office. The best practicesreport remains available on theUniversity of Florida web sitehttp://oig.ufl.edu/abacus/reports.html

This periodic column will highlightsome of the more interesting findingsfrom the 1999 ABACUS survey. Inaddition, in future columns we willdiscuss the plans ACUA is making toprovide future benchmarking servicesto its members.

DEPARTMENTS

Spotlight on ABACUSBy Steve Jung, Chair, Best Practices Committee

Next time: Audit staff experience, credentialing, and training.

The chair of the Best Practices Committee is soliciting both input andassistance from the ACUA membership in planning for and offering futurebenchmarking services. In particular, if you have participated in the mostrecent IIA GAIN program and have thoughts about the usefulness of GAIN'sonline survey model for ACUA, please contact Steve Jung via email [email protected].

Staff Size

Reporting Relationship

Based on 1999 responses by 259member institutions, we know that thebulk of ACUA's member internal auditdepartments serve public institutions(72%), and on average are relativelysmall (62% had three or fewerprofessional staff).

In terms of location within ourinstitutions, 70% of us report to thepresident or chancellor, executive vicepresident, or vice president. Many ofour institutions (64%) have some sortof audit committee, and almost all of us

whose schools do have auditcommittees (96%) have a directreporting relationship to thatcommittee.

Departmental budgets averaged$287,000 per year, although thisnumber was skewed to the high sideby a few large departments, asdemonstrated by the fact that themedian annual budget was $186,000.Eighty-six percent of budgeted fundswent toward staff salaries.

Who are the ACUA members?

President/Chancellor

37%

Board of Trustees

21%

Other8%

Controller1%

Senior orExec VP

14%

VicePresident

19%

1 or Fewer31%

2-331%

4-823%

9 or more15%

PRESORTEDSTANDARD

U.S. POSTAGEPAID

COLUMBUS, OHIONO. 14295008-03 Pine Creek Drive

Westerville, OH 43081-4899

Change Service Requested

Documents

Officers & Directors - ACUA & Directors President Marsha Payne University of California Irvine, CA [email protected] (949) 824-7855 Vice President Mike …