WIXLIB

2017-18 ANNUAL REPORTUSF System Audit

MESSAGE FROM THE EXECUTIVE DIRECTORA year of transition Has it been a year already? Each and every member ofthe audit team, as well as senior leadership and theBoard of Trustees, especially the Audit andCompliance Committee (ACC), has been invaluable inmy transition to the university. It’s great to be homeagain!It was a very productive year, despite some personnelvacancies. USF System Audit (Audit) completed yeartwo of its two-year work plan with ten audits, includingthree Information Technology (IT) audits, threeconsulting projects, and sixteen investigations. Theteam’s efforts throughout the year assisted universityleadership with ensuring the appropriate internal controlstructure was in place to minimize the risk of asset loss,including fraud; promote effectiveness and efficiency ofinstitutional resources; comply with applicable laws,rules, and regulations; and ensure data supporting thepath to preeminence and performance-based metricscould be relied upon. Summaries of the work performedare included within this report.Demonstrating their commitment to excellence, universityleadership was proactive in responding to improve thecontrol environment. Semi-annual reports were producedsummarizing university leadership’s implementation of55% of the audit recommendations open during the fiscalyear.provided at the request of USF Health Care forapproximately 0.6 full-time resource equivalent.As part of the Quality and Assurance ImprovementProgram, Audit underwent an intensive, externalquality assessment, which is required at least once everyfive years. This was Audit’s third such review and thedepartment has progressively improved with eachassessment performed. This year’s external assessmentconfirmed the department “generally conforms” with theInstitute of Internal Auditors International Standardsfor the Professional Practice of Internal Auditing andCode of Ethics. “Generally conforms” is the highestlevel of achievement in the assessment process and for thefirst time no conformance gaps were identified. This wasa great accomplishment for the team!What an exciting, productive, and successful year forUSF System Audit! We appreciate the unwaveringsupport received from the President, senior leadership,and the ACC. A special thank you goes out to theAudit team, as well, for their expertise, persistence, andpursuit of excellence in making this year’s successpossible!Virginia L. KalilCIA, CFE, CISA, CRISCAlong with the internal work performed, the teamcontinued to support external services received from theState Auditor General and the Office of InspectorGeneral and Compliance. Also, IT audit services wereAUDIT 2017-182

USF SYSTEM AUDITVirginia Kalil, Executive Director/Chief InternalAuditor Certified Internal AuditorCertified Fraud ExaminerCertified Information Systems AuditorCertified in Risk and Information SystemsControlBS Accounting, USFKate Head, Associate Director Certified Public AccountantCertified Fraud ExaminerCertified Information Systems AuditorBS Accounting, Oklahoma StateSteve Cuppett, Assistant Director Certified Public AccountantCertified Internal AuditorCertified Information Systems AuditorMaster of Accountancy, USFBS Accounting, USFAmy Rollie, Assistant Director Certified Public AccountantCertified Fraud ExaminerMaster of Accountancy, USFBS Accounting, USFMariana Souza, Senior Audit Consultant Certified Accountant, BrazilMaster of Control/Finance, Universidad deBrasilia, BrazilBachelor of Accounting, Universidad deBrasilia, BrazilBS Bus Admin/Accounting, CampbellsvilleUniversityOlu Abiose, Senior Information TechnologyAudit Consultant Certified Information Systems AuditorMicrosoft Certified Systems EngineerCertified in Risk and Information SystemsControlCertified Information Security ManagerHealthCare Information Security and PrivacyPractitionerMBA, Creighton UniversityMS Information Technology Management,Creighton UniversityBS Accounting, University of IlorinLena Huggett, Senior Information TechnologyAudit Consultant Certified Information Systems AuditorMS, Information Systems, University ofSheffieldBA, Accounting and Finance, ManchesterMetropolitan UniversityEric Harmon, Audit Consultant Certified Public AccountantCertified Internal AuditorCertification in Control Self-AssessmentMBA, University of FloridaBSBA Finance, University of FloridaKethessa Carpenter, Audit Consultant Certified Public AccountantBA Business Administration & Accounting,St. Leo UniversityJolanda Thompson, Administrative Specialist BSBA Management, Northwood University2018 Audit TeamSitting (L-R): Amy Rollie, Steve Cuppett, Olu Abiose, EricHarmon, Kethessa Carpenter; Standing (L-R): Lena Huggett,Mariana Souza, Virginia Kalil, Kate Head, and Jolanda ThompsonAUDIT 2017-183

TABLE OF CONTENTS MISSION, PURPOSE, AND ORGANIZATION . 5AUDITS . 5oooooooooo USF HEALTH OFFICE OF CLINICAL RESEARCHUSF HEALTH INFORMATION TECHNOLOGY - EPIC SYSTEM INTERFACESVISITING SCHOLAR VISA PROCESSINGEXEMPT/NONEXEMPT EMPLOYEE CLASSIFICATIONPERFORMANCE-BASED FUNDING DATA INTEGRITYCOLLEGE OF THE ARTS BUSINESS OPERATIONSUNIVERSITY TREASURER'S OFFICERESEARCH EXPENDITURESBANNER ACCESS CONTROLSHEALTH CARE AFFILIATE HEALTH INSURANCE PORTABILITY ANDACCOUNTABILITY ACT (HIPAA) RISK ASSESSMENT REVIEWINFORMATION TECHNOLOGY . 7CONSULTING SERVICES . 8ADVISORY SERVICES . 8INVESTIGATIONS . 8FOLLOW-UP ACTIVITY . 9ACTIVITY ANALYSIS .11QUALITY ASSURANCE AND IMPROVEMENT PROGRAM .12PROFESSIONAL ACTIVITIES .12UPCOMING YEAR .12AUDIT FY 2019 AND 2020 WORK PLAN .13AUDIT 2017-184

MISSION, PURPOSE, ANDORGANIZATIONUSF System Audit (Audit) is responsible forproviding the University of South FloridaSystem with independent and objectiveassurance and advisory services that ency, and compliance. These servicesassist the university in evaluating andimproving governance, risk management, andcontrol processes.In order to effectively fulfill its responsibilities,Audit is organizationally independent from lly reports at an appropriate levelwithin the organization.Audit reportsfunctionally to the Audit and ComplianceCommittee (ACC) of the Board of Trustees(BOT) and administratively to the universityPresident. This reporting relationship ensuresresponsibilities are carried out in a manner freefrom actual or perceived impairment.The nature and scope of services provided byAudit include audits, compliance reviews,management advisory services, consulting, andinvestigations.Audit is committed toupholding the values of integrity, respect,excellence, and service in the performance ofour duties.AUDITSAudit projects are performed in accordancewith the Institute of Internal Auditors (IIA)International Standards for the Professional Practice ofInternal Auditing (the “IIA Standards”). The IIAis the recognized authority for those in theinternal audit profession and the IIA standardsare required by the Florida Board ofGovernor’s Regulation 4.002 (6)(a) StateUniversity System Chief Audit Executives.The USF System has adopted the Committeeof Sponsoring Organizations of the TreadwayAUDIT 2017-18Commission (COSO) Control Frameworkwhich is utilized by Audit to assess theeffectiveness of the internal control systems inplace. The USF System’s internal controlobjectives are communicated to all USFSystem employees via USF System Policy 0023 Internal Control.USF Health Office of astructure surrounding clinical trials. Theaudit focused on the internal control structureover non-federally sponsored clinical trialstudies managed by the USF Health (USFH)Office of Clinical Research (OCR), with anemphasis on post-award administration.Specific objectives evaluated the design andeffectiveness of controls in place related to:budget and project account setup in theuniversity’s Financial Accounting SysTem(FAST); OCR fees and interdepartmentalcharges; sponsor billings; study participantpayments; project closure; and system accesscontrols.Based on the review, Audit concluded therewas an adequate system of internal controls inplace, assuming corrective actions are takentimely to address the seven risks identifiedrelated to effective and efficient operations, IT,reporting, and safeguarding of assets.USF Health InformationTechnology – Epic SystemInterfacesAudit reviewed the controls over USFH’s Epicsystem interfaces, their electronic health recordsystem. Epic is hosted by and shared withTampa General Hospital (TGH).Based on the review, recommendations weremade to address three risks identified. Thisreport was classified as confidential due to thesensitive nature of the IT issues disclosed.5

Visiting Scholar Visa ProcessingAudit reviewed the controls over visitingscholar visa processing. The audit focused ona review of the procedures used by the USFWorld Office of International Services (OIS)to process non-student J visas, utilized byvisiting scholars hosted by the USF System.The audit included a review of the controlsover data entered into the Student andExchange Visitor Information System(SEVIS), a web-based system maintained bythe United States (U.S.) Department of Stateand the U.S. Department of HomelandSecurity, to collect information on exchangevisitors.Based on the review, Audit concluded therewas an adequate system of internal controls inplace, assuming corrective actions are takentimely to address the five risks identifiedrelated to authorization, compliance withfederal laws, effective and efficient operations,IT, and reporting.Exempt/Nonexempt EmployeeClassificationAudit reviewed exempt/nonexempt employeeclassification. The audit focused on theprocesses by which USF System employees areclassified as exempt or nonexempt andcompliance with the Fair Labor Standards Act(FLSA), as well as other applicable federal andstate regulations, industry best practices,guidance from the Society for HumanResource Management (SHRM), and relevantUSF policies and procedures.Based on the review, Audit concluded therewas an adequate system of internal controls inplace, assuming corrective actions are takentimely to address the five risks nce, IT, reporting, and separation ofduties.AUDIT 2017-18Performance-Based Funding DataIntegrityAudit reviewed the processes and controlsestablished to ensure the completeness,accuracy, and timeliness of data submissions tothe Board of Governors (BOG) in support ofthe Performance-Based Funding measures.Based on the review, Audit concluded therewas an adequate system of internal controls inplace, assuming corrective actions are takentimely to address the two risks identifiedrelated to IT and reporting.College of The Arts BusinessOperationsAudit reviewed the design and effectiveness ofthe administrative and financial controlsrelated to the College of The Arts BusinessOperations. The audit focused on thosecontrols performed by the college, ures, journal entries, property, payrolland human resources, research, USFFoundation activity, and USF ResearchFoundation activity.Based on the review, Audit concluded therewas an adequate system of internal controls inplace, assuming corrective actions are takentimely to address the five risks identifiedrelated to IT, reporting, safeguarding of assets,and separation of duties.University Treasurer’s OfficeAudit reviewed the design and effectiveness ofthe University Treasurer’s Office (UTO)control structure related to investments anddebt management.Based on the review, Audit concluded therewas an adequate system of internal controls inplace, assuming corrective actions are taken6