registrar’s office audit oh no!!! presented by: carol harrison, college of southern maryland...

Registrar’s Office Audit OH NO!!!

Presented by: Carol Harrison, College of Southern Maryland

Wednesday, April 15 9:15 am – 10:15 am

Session ID 2917

AACRAO – Baltimore 2015 Session ID: ####

Session Rules of Etiquette• Please silence your cell phone/pager

• Please complete the session evaluation using the AACRAO mobile app or the paper form in your registration packet, drop boxes are available throughout the convention center.

• If you must leave the session early, please do so as discreetly as possible

• Please avoid side conversation during the session

Thank you for your cooperation!


Introduction• An Audit of your office is not always cause for

panic! Find out how to prepare for an audit of your office, what gaps and risks were found at CSM and how this is a great learning experience.


Learning Outcomes of this session:

• How to prepare for an audit of your office

• What risks and gaps need to be reviewed

• How to make your office better in security and services

You have to Joke, instead of…What do you get if you cross a wild, ferocious, man-eating tiger with an internal auditor?A very dull tiger

What happens when you lock a wild hyena in a room with an internal auditor?The hyena stops laughing


What happens when the chair of the board is a Banker?

Create an Audit Committee!

• This committee has oversight responsibilities

• Financial reporting process

• Systems of internal controls

• The audit process

• The process for monitoring compliance with laws, regulations, and applicable codes of conduct, ethics and conflicts of interest.


Specific Roles and ResponsibilitiesThe primary roles and responsibilities of this Committee shall include:

External/Internal Audit

1. Recommending to the Board of Trustees the appointment of the external/internal auditors, review and approve fees paid to the external auditors and review and approve the dismissal of the external auditors.

2. Approve the use of any “non-audit services” performed by any external auditor.

3. Review the proposed external audit scope and approach for the current year in light of the college’s present circumstances, risk profiles, and changes in the regulatory environment.

4. Meet with the external/internal auditors.


First Steps 2010

1. Financial Audit – always done

2. Internal and external IT penetration into hardware and software systems

3. Internal control and risk audit

4. Specific departmental audits


Risk Assessment• High (H) – Material/Critical: Indicates a high level of

inherent risk, and it is critical that the risk is managed and controlled to achieve the strategic business objectives

• Moderate (M) – Significant/Important: Indicates a moderate level of inherent risk, and it is important that the risk is managed and controlled to achieve the strategic business objectives of the area.


Risk Assessment• Low (L) – Inconsequential/Potential Enhancement:

Indicates a lower level of inherent risk, whereas these conditions may not have a significant impact on operations, accurate financial reporting or the control environment, but should be considered as potential improvement opportunities. They do not represent the same level of risk as the other factors.


Risk Audit FindingsStrategic

Functional Area Governance & Communication

Products/Services External/Environmental Factors

Reputational-Stakeholder Relations/Students

Registrar L L H H

Operational & Process Functional Area Human

Resources Process Knowledge Capital Health & Safety

Registrar L H M L

Operational & Process Functional Area Outsourcing Performance Information

Technology Integrity-Fraud & Illegal Acts

Registrar LL M H L

Financial Functional Area Cash Flow Funding Internal Controls Post-Employment

Benefit Registrar L L M L

Compliance Functional Area

Grant & Regulatory Compliance

Health & Safety

Contractual Corporate Responsibility

Accreditation

Registrar L M L M H

Overall Functional Area

Risk Direction Risk Ranking Audit Priority

Registrar Static H H


Yikes! What can we start to fix?• Registration forms with credit card information

• Signatures required for forms

• Personal payroll information

• Petty Cash Process

• Internal reports to review changes in SIS

• Grades

• Students who have been graduated

• Registration overrides

• Exceptions for degree audit

EMPLOYEE STATEMENT – SECURING CSM SUPPLIES AND EQUIPMENT REGISTRAR’S OFFICE

I, ________________________________________, understand that all the secure paper and equipment used in coordination with the Registrar’s Office could be compromised. I will not use or abuse or take lightly my duties of securing these items while working at College of Southern Maryland to include, but not limited to:

I will secure all transcript paper, transcript envelopes, college sealer, and stamps in a locked room or cabinet when they are not in use.

I will keep these items out of areas where students or customers could easily walk away with them.

I will keep an inventory of the paper and envelopes and will notify the Registrar immediately, if I believe anything has been compromised.

Employee Signature:

Date:


Yikes! What can we start to fix?• Implement electronic forms

• Course substitutions

• Academic clemency

• Pre-req Waivers

• Review document disposal time line

• Review employee access in SIS

• Review inventory of transcript paper and envelopes.


SC&H Consulting• Reviewed seven processes:

• Credit Registration

• Continuing Education Registration

• De-registration of zero pay credit students

• De-registration of partial pay credit students

• De-registration of continuing education students

• Issuance of Transcripts

• Graduation


Gaps1. Documentation acknowledging charges is not obtained

by advisors when a student registers for classes in person with the advisor. This could cause issues with the state collections which requires this type of acknowledgement prior to collection.

Management response

Advisors always print a registration statement when registering a student in person. This indicates to the student their tuition and fee bill.


Gaps2. Student’s who request transcripts though mail or fax are only required to sign for the request and do not present photo ID as they do for an in person request. These signatures are not verified and are assumed to be that of the student which may legally protect the college in the event of a fraudulent request however it does nothing to prevent a fraudulent request.

Management response

Did not change process.


Gaps

3. Student records from 1958 to 1984 are stored on microfilm which are not easily retrievable and can deteriorate or be lost over time.

Management response

The Registrar’s office is currently working with an outside company to transfer all microfilm records to a better storage media.


Gaps

4. Professor grade reports and attendance records are manually kept, it lost there would be no record of student attendance or grades.

Management response

Currently researching the use of black board or web advisor to maintain G & A sheets electronically. The goal is to have G & A sheets maintained electronically by December 2014.

Risk

• A student is inappropriately dropped from courses.

Control• Colleague will

automatically detect student’s who have paid and will not drop them from registered classes during the drop import process. Also on weekly basis drop list is reviewed by various offices.

Risk

• A student registers for a class who has outstanding debt with the college.

Control• All students with

outstanding debts are placed in a Bursar hold which will not allow for any class registration until the hold is removed.

Risk

• Transcripts are provided to an unauthorized individual.

Control• When requesting a

transcript via walk-in, mail-in or fax-in students must sign for the transcript. Additionally student’s who walk-in must provide a photo ID. Transcript request made online require a student account and password for access.

Risk

• Student’s who have not paid for classes, or students who have partially paid for classes, are able to continue and complete classes earning the applicable credits.

Control• Prior to graduation, a final

review of each student’s account is performed by the Registrar’s Office to ensure GPA, credits, all degree requirements are met and has no outstanding account balances.


What did we learn?• Auditors only care about the money!

• All staff understands the importance of checks and balances.

• Must review staff access in SIS system!

• Use the AACRAO guidelines for a self audit

• Microfilm is GONE!!!

• Contingency plans – never mentioned in audit, BUT…


Questions?


Thank You!Carol Harrison

[email protected]

Please complete the session evaluation using the AACRAO mobile app or the paper form provided in

your registration packet.

Session ID 2917

registrar’s office audit oh no!!! presented by: carol harrison, college of southern maryland...

Documents