WIXLIB

Internal Audit Annual ReportFor the Fiscal Year EndedAugust 31, 2018Office of Audit and Consulting Services800 West Campbell Rd., SPN 32Richardson, TX 75080972-883-4876www.utdallas.edu/audit/An Equal Opportunity/Affirmative Action Employer

The University of Texas at DallasFY18 Annual Internal Audit ReportOctober 25, 2018Dr. Richard Benson, PresidentMs. Lisa Choate, Chair of the Institutional Audit Committee:We are pleased to submit the annual report of the Office of Audit and Consulting Services for thefiscal year ended August 31, 2018. This report is required by the Texas Internal Auditing Act andprovides information on the assurance services, consulting services, and other activities of theinternal audit function.During fiscal year 2018, we issued 19 reports related to audits, consulting reviews, andinvestigations. We believe the work of our office has enhanced university operations andprovided value to management with recommendations relating to governance, riskmanagement, and control processes at the University of Texas at Dallas.If you have any questions about the contents of this report, please do not hesitate to contact me.Respectfully submitted,Toni Stephens, CPA, CIA, CRMAChief Audit ExecutiveReport Distribution: State Auditor’s Office Governor’s Office of Budget, Planning, and Policy Legislative Budget Board Sunset Advisory Commission Members of the UT Dallas Audit Committee UT System Audit Office2

The University of Texas at DallasFY18 Annual Internal Audit ReportTable of ContentsPurpose of the Annual Internal Audit Report . 4I.II.III.IV.V.VI.VII.VIII.Compliance with Texas Government Code, Section 2102.015. 5Internal Audit Plan for FY18 . 5Consulting Services and Nonaudit Services Completed . 6External Quality Assurance Review . 6Internal Audit Plan for FY19 . 6External Audit Services Procured in Fiscal Year 2018 . 9Reporting Suspect Fraud and Abuse . 9A. Fraud Reporting . 9B. Coordination of Investigations. 10Office of Internal Audit . 11A. Staff Size and Organization Chart . 11B. Staff Experiences and Certifications . 11C. Training . 11D. Contributions to the Profession. 12AppendicesAppendix 1:Appendix 2:Appendix 3:Appendix 4:FY18 Audit PlanExternal Quality Assurance ReviewFY19 Audit PlanStatus of FY18 Audit Recommendations3

The University of Texas at DallasFY18 Annual Internal Audit ReportPurpose of the Annual Internal Audit ReportThe purpose of this annual report is to provide information on the assurance services,consulting services, and other activities of the internal audit function. In addition, the annualinternal audit report assists oversight agencies in their planning and coordination efforts.The Texas Internal Auditing Act, Texas Government Code, Chapter 2102, requires that anannual report on internal audit activity be filed by November 1st of each year and submitted tothe Governor, the Legislative Budget Board, the Sunset Advisory Commission, the Texas StateAuditor’s Office (SAO), and the entities’ governing boards and chief executives. The SAOprescribes the form and content of the report.The annual report was prepared using the guidelines provided by the Texas State Auditor’sOffice. In addition to the minimum requirements, we also included other information we feltwas important to the internal audit operations during fiscal year (FY) 2018. Additionalinformation regarding the UT Dallas Office of Audit and Consulting Services can be found at thefollowing website: www.utdallas.edu/audit/.4

The University of Texas at DallasFY18 Annual Internal Audit ReportI.Compliance with Texas Government Code, Section 2102.015II.Internal Audit Plan for FY18The Texas Internal Auditing Act (Texas Government Code, Section 2102.015: Publication ofAudit Plan and Annual Report on Internet) requires that the internal audit plan and the internalaudit annual report be posted on the institution’s website. Accordingly, the Office of Audit andConsulting Services has posted its FY18 Annual Internal Audit Report and the approved FY19Audit Plan at the following website: ans/.The UT Dallas 2018 Audit Plan outlined the internal audit activities to be performed by InternalAudit during FY18 in accordance with responsibilities established by the UT System, the TexasInternal Auditing Act, the Institute of Internal Auditors’ International Standards for theProfessional Practice of Internal Auditing, and Generally Accepted Government AuditingStandards, consistent with the UT Dallas Audit Charter. The plan was prepared using a riskbased approach to ensure that areas and activities specific to UT Dallas with the greatest riskare identified for consideration to be audited.The information in Appendix 1 contains the Internal Audit Plan for FY18, including the status ofthe plan at October 31, 2018. Audits that were postponed or deleted were approved by the UTDallas Institutional Internal Audit Committee.As required by the State Auditor’s Office FY18 guidelines for submitting this report, thefollowing audit was performed to address the benefits proportionality audit requirementprescribed in Rider 8, page III-45, the General Appropriations Act (85th Legislature):A compliance audit of Benefits Proportionality Funding was issued on August 28, 2018.The audit examined fiscal years 2015 – 2017, and was conducted using a methodologyapproved by the State Auditor’s Office. The audit resulted in no significant issues orrecommendations.5

The University of Texas at DallasFY18 Annual Internal Audit ReportAn assessment regarding compliance with purchasing authority, required by the TexasEducation Code, Section 51.9337(h), is in process as of October 31, 2018. To satisfy therequirements in the Code regarding risk-based audits of contract administration, an audit ofpurchasing is also in process. These reports are being combined and will be issued inNovember 2018. The State Auditor’s Office will receive a copy of this report when issued.III.Consulting Services and Nonaudit Services CompletedThe following is a list of consulting services completed in FY18, as defined in the Institute ofInternal Auditors’ International Standards for the Professional Practice of Internal Auditing.Consulting services are advisory in nature and are generally performed at the specific request ofan engagement client.Date IssuedTitleHigh-Level ObjectivesJuly 18, 2018Internal Report No.CR1801, MonthlyFinancial ReportingConsulting ReviewEnsure accuracy and reliabilityof the monthly financialreports.Observations, Results, andRecommendationsNo recommendations.Management has implementedseveral process improvements overthe past two years.The Office of Internal Audit did not perform any non-audit services as defined in GovernmentAuditing Standards, 2011 Revision, Sections 3.33 – 3.58, during FY18.IV.External Quality Assurance ReviewV.Internal Audit Plan for Fiscal Year 2019In accordance with IIA Standards and the Texas Internal Auditing Act, an external qualityassurance review was conducted during FY17. A copy of the report is included at Appendix 2.The FY19 Internal Audit Plan was approved by the UT Dallas Institutional Audit Committee withfinal approval by the UT System Board of Regents’ Audit, Compliance, and Risk ManagementCommittee on August 9, 2018. A copy of the plan, including budgeted hours, the riskassessment methodology, and audits addressing certain State requirements, is included atAppendix 3.6

The University of Texas at DallasFY18 Annual Internal Audit ReportThe risk assessment process identified critical and high risks that are not on the plan. Thefollowing is a list of these risks and the mitigation plan for each risk.Risk Mitigation – Other Assurance Providedfor the RiskRiskLack of funding from requested tuition increasesand student fees not sufficient for growth andinfrastructure demandsReduced enrollment in graduate courses frominternational studentsSystem platform and application datacompromise due to social engineering exploitsLack of definitive DMZ increases institutionalexposure to data or device compromiseConsistent, periodic backups that providestakeholders the capability to restore and resumebusiness operations are underutilized/notrequired exposing the institution to potentialdata loss and extended service disruptions.Two Factor Authentication is not utilized on allhigh risk assets potentially permittingunauthorized access/use of informationresourcesLack of a predictable funding model/strategy tosustain IT serviceTitle IX and EEO - noncompliance could result inlosses in funding, reputational harm, and inabilityto attract faculty, staff, and studentsIncreasing incidents reported to Title IX couldresult in inefficiency and noncomplianceNoncompliance with tax provisions (UBIT, NRA,etc.) resulting in fines and penalties andnoncomplianceRisk of inaccurate financial reporting could resultin poor decision-making and reputational risksLack of reserves resulting in risk of financialviabilityPayroll confirmation (formerly time and effortreporting) not in compliance with federalregulationsNoncompliance with federal regulations overcontracts and grants, Uniform Guidance couldresult in loss of fundingCabinet is addressing budget issuesCabinet is addressing budget issuesCISO coverage (two-factor authentication andphishing initiatives)Coverage by OIT and/or ISO: Firewall UpgradeProjectFY18 Disaster Recovery Audit; Coverage by OITand/or ISO - Backup expansion projectCoverage by OIT and/or ISO - Two FactorAuthentication ProjectCabinet is addressing budget issuesFY17 audit of Title IXFY17 audit of Title IXFY17 Audit and FY18 follow-up workExternal Audit of financial statementsFY18 consulting review of reserves; Cabinet isaddressing budget issuesFY18 audit of payroll (compensation)confirmationAudits by SAO; will also cover during School,Department, and Division reviews to ensurecompliance with federal regulations7