U N I V E R S I T Y O F

II GEORGIA"Internal Auditing Division

240 S, Hull St. IAthens, GA 30602706.542.1494|audit.uga.edu

Malfeasance ReportC o n fi d e n t i a l

UGA Triage CommitteeT O

Matthew Whitley, Director, Internal Auditing DivisionF R O M

July 29, 2019D A T E

Neglect of Fiduciary Responsibilities by Greek Life Office EmployeesS U B J E C T :

R e l e v a n t B a c k g r o u n d

The Greek Life Office (GLO) oversees the operation of four Greek Councils and provides an advisor to each ofthese councils; Interfi'aternity Council (IFC), Panliellenic Council (PHC), National Pan-Hellenic Council(NPHC)and the Multicultural Greek Council (MGC). GLO also provides agraduate student advisor to UGA Miracle,advises the Order of Omega and the UGA Food Pantiy student clubs. IFC, PHC, UGA Miracle, and Order ofOmega each have abank account at Synovus Bank. Ms. Claudia Shamp has signatory authority over ail four bankaccounts and Ms. Elizabeth Pittard has signatory authority over the PHC and IFC bank accounts. All financialtransactions for these organization are handled by GLO staff members who are UGA employees. Additionally,some student board members of IFC, PHC, and UGA Miracle have access to adebit card linked to these accounts.

Claudia Shamp, Director of Greek Life

Ms. Claudia Shamp has been employed by the UGA Greek Life Office (GLO) since August 1988. As the directorof GLO, Ms. Shamp has afiduciary responsibility to ensure the safeguarding of all funds managed by GLO andto ensure that employees are acting in the best Interests of the Univei-sity, GLO, and the organizations that fallunder its purview. However, based on our review it appears that Ms. Shamp has failed to enact even abasicfulfillment of these responsibilities.

Failure to Provide Financial Oversight

As the unit head of GLO, Ms. Shamp is ultimately responsible for the fiscal integrity of the unit. However, Ms.Shamp informed us that she fully relied on and trusted Ms. Lasma Evans, Administi’ative Associate I, to handleall financial matter's pertaining to GLO and the organizations overseen by GLO. As aresult, she did not monitorMs. Evan’s financial activities, According to University policy, it is the responsibility of each department head toreview the financial activity of adepartment for accuracy. If these responsibilities are delegated to stalf members,the department head should provide appropriate supervision and oversight of such delegated responsibilities byrevlewitrg monthly statements.

Ms, Shamp’s failure to perform any form of monitoring procedures over the financial activity of GLO or theorganizations overseen by GLO, enabled the significant misappropriation of IFC, PHC and UGA Miracle assetswithout detection for over 10 years. Specifically, we noted that the following minimal unit-level requirements offiscal control were not being performed by Ms. Shamp:

No budsetms of anticipated revenues and expendiitires: Ms. Shamp did not set abudget for any of theorganizations managed by GLO. As such, there was no mechanism available to monitor and evaluate theactual financial progress of each organization and to timely identify and investigate any unexpected results.Additionally, we noted that the failure to establish abudget may have contributed to GLO staff being underthe assumption that there were no purchasing restrictions for the funds of the organizations that they managed.For example, our review of IFC and PHC debit card expenditures noted multiple charges to Starbucks orcampus dining outlets that appeared to be for individuals. We were informed by the UGA Police Department,that inteiwiews with GLO staff members also confirmed that staff members believed there had been alack of

restrictions placed on the use of IFC and PHC funds.

No financial review and analysis: Ms. Shamp did not monitor or analyze the financial activity of GLO or theorganizations managed by GLO. Additionally, there were no monthly or periodic financial reports or othermanagement reports being generated by GLO that could have been used to perform this duty. Ms. Shampinformed us that she had a“good perspective” of what flmds were received and what was spent, however, ourreview found no documented evidence to support this claim.

F a i l u r e t o E s t a b l i s h P r o c e d u r e s a n d I n t e r n a l C o n t r o l s o v e r F i n a n c i a l Tr a n s a c t i o n s

As aunit head, Ms. Shamp’s management responsibilities include ensuring that internal controls are establishedand operating in amanner that conti'ibutes to the mission and objectives of the unit. However, we noted that Ms.Shamp failed to establish astrong control environment within GLO that could have reduced the risk that assetscould be misappropriated without thnely detection. Per Ms. Shamp, she had known Ms. Evans for over 20 yearnand completely trusted her. This misplaced trust resulted in Ms. Evans being allowed to have almost completecontrol of all financial activity at GLO, without an independent review of these activities.

The following are some of the control weaknesses noted at GLO that appear to have contiibuted to the substantialmisappropriation of assets belonging to IFC, PHC, and UGA Miracle:

Lack of asegregation of duties over financial transactions.No independent reconciliation of bank statements.No independent reconciliation of agency account transactions.No independent verification of fund deposited to ensure that all funds received were deposited intact.No independent review of expenditures by someone with first-hand knowledge of the transactiorr.Petty cash firnds were not established following University guidelines.No procedures were establisired for the use of agency funds.No guidelines were established over check and debit card purchases.Lack of documentation created (e.g. cash receipt logs) or retained to support revenues and expenditures.Removal of dual sigrrature requirement on UGA Miracle checks in 2012.Unsupervised access to blank check stock and debit cards.No access restrictions were in place for the fivo office safes that held firnds received by GLO,

Evidence of Ms. Shamp’s lack of concern with establishirrg strong iirternal controls over financial activities is alsoexemplified by her past actions. We noted irr June 2016, Ms. Shamp’s UGA procurement car'd (P-Card) wasrevoked by the Unlvei'sity for allowing Ms. Evans to use Ms, Shamp’s P-Card and to use her password to log into

the P-Card Works system to sign-off on P-Card transactions. Ms. Evans was listed as the &st level sign-offapprover in Works at this time.

Failure to Act with Due Care in Financial Matters

Our review noted the following instances which exemplifies Ms. Shamp’s failure to act with due care in financialmatters pertaining to GLO and the organizations overseen by GLO.

Disremrded fiscal responsibilities as an authorized check simer: Ms. Shamp was an autliorized check signeron the PHC, IFC and UGA Miracle bank accounts. As such, she is responsible for verifying that each checkshe sigited was correctly prepared and represents payment for alegitimate business expenditure. However,we noted the following instances where Ms. Shamp failed to fulfill these responsibilities,

oSigi ed blank checks: Abasic control against the fraudulent use of checks is that check signersshould not sign blank checks. However, Ms. Shamp admitted to signing blank checks for Ms.Evans on numerous occasions. Combined with alack of independent oversight over the relatedbank accounts, Ms. Evans was able to write checks signed by Ms, Shamp and payable to hemelf,totaling $29,472 between September 2013 and Febraaiy 2019, from the PHC bank accountwithout detection. We also noted a$5,500 check signed by Ms. Shamp and payable to Ms. Evansfrom the IFC bank account in March 2017 and a$11,500 check payable to Ms. Evans from theUGA Miracle bank account in May 2017. However, we do not currently have information fi omSynovus Bank that would enable us to determine the full extent of the loss that this practicecontributed to from the IFC and UGA Miracle bank accounts.

oFailed to review bank statements: Ms. Shamp did not review any bank statements or seek onlineaccess to review bank transactions for the PHC, IFC, and UGA Miracle bank accounts for whichshe was acheck signer. Given the vast number and frequency of the fi-auduient activity on thesebank accounts that occurred between 2009 and 2019, even acursory glance at abank statementwould have quickly identified the anomalous tr ansactions. As aresult of Ms. Shamp’s failure toreview bank statements, she was;

“Unaware of counter withdrawals: Per Ms. Shamp, there was no business reason forcounter withdrawals of cash to be made fiom the PHC, IFC or UGA Mir acle bankaccoirnts. However, our review noted acounter withdrawal of $12,000 from the PHCbank account and $5,000 from the IFC bank account that was made on July 30,2013, inMs. Shamp’s irame. Additionally, we noted 2counter withdr awals made in Ms. Shamp’sname from the UGA Miracle account in January and April of 2012, totaling $5,000. Wenoted that the total corrnter withdrawals fi'orn the IFC, PHC and UGA Miracle bankaccounts that were payable to various GLO staff members, totaled $188,768 betweenAugust 2009 arrd May 2019.

« Unaware of ATM Transactions: Per Ms. Shamp, there was no business reason for ATMwithdrawals from the PHC, IFC, or UGA Miracle bank accounts. However', we notedt h a t AT M w i t h d r a w a l s b e t w e e n 2 0 0 9 a r r d 2 0 1 9 f o r t h e t l r r e e b a n k a c c o u n t s t o t a l e d

$429,860.

■Unaware of debit cards issued: Ms. Shamp informed trs that she found one IFC debitcard and one PHC debit card in Ms. Evan’s puree that she was not aware had been issuedby Synovus Bank. She also informed us that she was unawar'e that the there was adebitcard associated with the UGA Miracle bank account. Purchases made on the purportedlyunauthorized IFC and PHC debit cards totaled $43,791. While Ms. Shamp was unaware

of who had autliorized the issuance of aUGA Miracle debit card, we noted that the debitcards expenditures for the most part appear to be for valid business purposes.

!Unaware of PayPal accounts: Ms. Shamp stated that the only PayPal account that shewas aware of was aPHC PayPal account that had been set up in 2016 to pay one vendor.However, we noted PayPal transactions dating back to 2010 on the PHC bank account,and that the IFC and UGA Miracle bank statements also showed PayPal charges. TotalPayPal charges between 2010 and 2019 totaled $4,526.

■Unmvare of payments made to unauthorized vendors: We noted alarge number ofpurchases from vendors such as TJ Maxx, Lowes, Home Depot, Big Lots, Target, Kroger,Sam’s Club, Walmart, and various department stores totaling $156,645, that appear tohave been unauthorized purchases on the IFC, PHC and UGA Miracle accounts. The totaldoes not mclude the unauthorized purchases noted on the debit card held in Ms. Evanspossession as noted above.

Smied official documents without review: Ms. Evans w^as added as an authorized signer on the PHC and IFCbank accounts in December 2018. Ms. Shamp claimed that she had no knowledge of this. However, we notedthat the related Sigirature Cards and Authorization forms were signed by Ms. Shamp, Ms. Pittard, and Ms.Evans. Ms. Shamp informed us that it was her signature that was affixed to these forms, however, she has nomemory of signing the documents or noticing Ms. Evans’ name on the documents. It should be noted that newSignature Card and Authorization forms were signed in January 2019 to add the student treasurer of eachorganization to the bank accounts. Ms. Shamp, Ms. Pittard, and Ms. Evans signatures are on these documentsas well. Per Ms. Shamp, she would often sign documents that Ms. Evans asked her to sign without readingthe documents or questioning Ms. Evans.

Elizabeth Pittard, Assistant Director of Greek Life &Advisor to the Panhellenic Council

Ms. Elizabeth Pittard has been employed by the UGA Greek Life Office (GLO) since February 2010. As theadvisor to PHC, an authorized check signer on the PHC and IFC bank accounts, and with access to funds receivedby GLO, Ms. Pittard has the responsibility to protect the financial interests of the University, PHC and IFC, aswell ensure that she carries out her responsibilities with due care and utilize prudent financial practices.

F a i l u r e t o A c t w i t h D u e C a r e

Our review noted the following instances which exemplifies Ms. Pittard’s failure to act with due care in financialmatters pertaining to GLO and the organizations overseen by GLO.

Disregarded fiscal responsibilities as an authorized check sisner: Ms. Pittard was an authorized check signeron the PHC and IFC bank accounts. As such, she is responsible for verifying that each check she signed wascorrectly prepared and represents payment for alegitimate business expenditure. However, we noted thefollowing instances where Ms. Pittard failed to fulfill these responsibilities.

oSigned blank checks: Abasic contio! against the fraudulent use of checks is that check signersshould not sign blank ehecks. However, Ms. Pittard admitted to signing blank checks for Ms.Evans on numerous occasions. Combined with alack of independent oversight over the relatedbank accounts, Ms. Evans was able to write checks signed by Ms. Pittard and payable to hemelf,totaling $154,932 behveen May 2013 and May 2019, fiom the PHC bank account withoutdetection. We do not currently have information from Synovus Bank that would enable us todetermine the full extent of the loss that this practice conftibuted to fi'om the IFC bank account.

Failed to review bank statements: Ms, Pittard did not review any bank statements or seek onlineaccess to review bank transactions for the PHC and IFC bank accounts for wliich she was achecksigner. Given the vast number and frequency of the fraudulent activity on the bank accounts thatoccurred between 2009 and 2019, even acursory glance at abank statement would have quicklyidentified the anomalous transactions. As aresult of Ms. Pittard’s failure to review bankstatements, she was:

■Unaware of counter withdrawals: Per Ms. Pittard, she only remembers one occasion forwhich she made acounter withdrawals of cash for PHC, but was not able to specify whatamount or when this occurred. However, our review noted counter withdrawals totaling$35,800 fi om the PHC bank account and $9,500 from the IFC bank account in her name.We noted that the total counter withdrawals fi-om the IFC and PHC bank accounts thatwere payable to various GLO staff members, totaled $183,768 between August 2009 andMay 2019.

■Unaware of ATM Transactions: Ms. Pittard was not aware of any business reason forATM witlidrawals fi’om the PHC or IFC bank accounts. However, we noted that ATMwithdrawals between 2009 and 2019 for the fivo bank accounts totaled $391,460.

■Unaware of debit cards issued: Ms. Pittard was not aware that Ms. Evans had debit cardsfor IFC and PHC in her possession. She does, however, remember being called by aSynovus Bank representative, who was in the presence of Ms. Evans, to answer one ofher bank account security questions without first being informed of why she was beingasked the question; which Ms. Pittard informed us she answered and did not remember ifshe subsequently received an explanation for the inquiry. Purchases made on thepurpoifedly unauthorized IFC and PHC debit cards totaled $43,791.

■Unaware of PayPal accounts: Ms. Pittard stated that the only PayPal account that shewas aware of was aPHC PayPal account that had been set up in 2016 to pay one vendor.However, we noted PayPal transactions dating back to 2010 on the PHC bank account,and that the IFC bank statement also show PayPal charges. Total PayPal charges between2010 and 2019 for PHC and IFC totaled $3,521.

!Unaware of payments made to unauthorized vendors: We noted alarge number ofpurchases from vendor's such as TJ Maxx, Lowes, Home Depot, Big Lots, Target, Kroger,Sam’s Club, Walmait, and various department stores totaling $152,828, that appear tohave been unauthorized purchases on the EFC and PHC accounts. The total does notinclude the unauthorized purchases noted on debit cards held in Ms. Evans possession,as noted above.

Simed ofTicial documents without review: Ms. Evans was added as an authorized signer on the PHC and IFCbank accounts in December 2018. Ms. Pittard claimed that she had no knowledge of this. However, we notedthat the related Signature Cards and Authorization forms were signed by Ms. Sharnp, Ms. Pittard, and Ms.Evans. Ms. Pittard stated that it was her signature that was affixed to the forms, however, she has no memoiyof signing the documents or noticing Ms. Evans’ name on the documents. It should be noted that newSignature Card and Authorization forms were signed in Januaiy 2019 to add the student treasurer of eachorganization to the bank accounts. Ms. Sharnp, Ms. Pittard, and Ms. Evans signatures are on these documentsas well. Per Ms. Pittard, she would often sign documents that Ms. Evans asked her to sign without reading thedocuments or questioning Ms. Evans.

F a i l u r e t o F o l l o w P r u d e n t F i n a n c i a l P r a c t i c e s

Our review noted tlie following with regard to Ms. Pittard’s failure to follow pnident financial practices as theadvisor to PHC who had access to the receipt and use of PHC funds.

Failure to proverlv secure student checks: We noted that Ms. Pittard would keep checks received from UGAstudents to pay for recruitment fees unsecured on top of her desk prior to deposit.

Failure to follow University volicv on receivtius and depositius funds: PHC did not maintain an audit trail of allfunds received by the GLO office. According to University policy, there should be adated record of the orighialentry for each hidividual payment. Any method is acceptable as long as an audit trail is maintained (ex. prenumbered receipt, cash register, validating machine tape, cash journal, or computer prepared record).

Improper creation and use of apetty cash fund: Ms. Pittard informed us that she would take cash paymentsreceived by the office for PHC, to create apetty cash fiind for PHC. Additionally, she did not document the useof these funds but would instead give receipts related to the petty cash fond to Ms. Evans. University policyrequires that all petty cash funds are established through the University’s Bursar and Treasury Services.Additionally, good internal controls require that all fiinds received are deposited intact and documentation isretained to support the use of petty cash funds.

Failure to prudently use PHC funds'. As previously noted, GLC employees were under the impression that therewere no purchasing restrictions placed on the use of PHC and IFC ftmds. As the advisor to the PHC, Ms. Pittardwas responsible for ensuring that PHC funds, in the custody of GLC, were not spent wastefully. Cur review oftransactions on Ms. Pittard’s PHC debit card noted multiple charges from Starbucks and UGA dining outlets thatappeared to be for individuals. Ms. Pittard and Mr. Black (IFC advisor) had informed the UGA Police Department,that they would let individual student board members who attended meetings at GLC to purchase food everageitems if they so desired dui'ing weekly meetings. As there were no receipts or documented justification retainedto support these purchases, we were unable to determine the validity of these expenditures.

Mason Black. Assistant Director of Greek Life &Advisor to the Interfrafernity Council

Ml'. Mason Black has been employed by GLC since 2012. Mr. Black was not an authorized check signer on anyGLC managed bank accounts during the period of our review. However, he informed us that he shared his IFCbank account debit card with students who wanted to make IFC related purchases and did not review purchasesmade on his assigned card. This practice represents afailure of his fiduciary responsibility to safeguard the use ofstudent funds. Additionally, under university policy procurement card sharing is prohibited.