Business Service Center Audits: Feedback from and Results of the UBSC Audit

1. Business Service Center Audits:Feedback from and Results of the UBSC Audit Presented by: Pamela Doran (Associate Audit Director) Robin Yager (Director, University Business Service Center) Robert Beveridge (Senior Auditor) 1

2. Agenda • Audit Approach Refresher (Pam Doran) • UBSC Audit Scope (Bob Beveridge) • Audit Results & Helpful Hints (Robin Yager) • Overall Audit Conclusion (Bob Beveridge) • What to expect for Future BSC Audits (Pam Doran) • Q&A (All) 2

3. Audit Approach Refresher: 3

4. UBSC Audit Scope • Assessing the overall control environment in the University Business Service Center: • Use a general ICQ to get broad overview of the control environment • Internal Operating Policies and Procedures • Signature Authority • Staff Competency & Training • Customer Service 4

5. UBSC Audit Scope Cont. • Evaluating the documented “Roles and Responsibilities” for completeness, appropriateness, and clearly defined accountability • Ensuring that a signed “Service Package Agreement” has been executed for each customer • Evaluating the effectiveness of the University Business Service Center in meeting defined performance measurement metrics 5

6. UBSC Audit Scope Business Process & Transaction Testing: • Identifying key control activities by analyzing the business process flow charts for each business cycle • Testing the identified key control activities for each business process for adequacy and effectiveness • Reviewing UBSC’s process for handling and following up on policy violations (e.g. Pcard) 6

7. UBSC Audit Scope Cont. • Business Processes Reviewed: • Purchase Orders • Procurement Cards • AP Vouchers/Payment Requests • Travel Reimbursements • Pay Rep Activities • Vacation & Sick Accrual Reporting 7

8. Audit Results & Helpful Hints Robin Yager Director, University Business Service Center 8

9. Overall Audit Conclusion Overall Conclusion – System of Internal Controls is Satisfactory, no major weaknesses were noted. Things UBSC did well: • Comprehensive Operating Policies & Procedures • Ensuring adequate segregation of duties • Due diligence review and documentation of business purpose • Pcard policy violation tracking and subsequent suspension and or revocation of pcard privileges • Well trained staff • Etc. (UBSC did many other things well) 9

10. What to expect for Future BSC Audits • We will be reviewing: • Roles & Responsibilities (make sure they are clearly defined and documented) • If the services provided to your customers are not uniform (e.g. cafeteria plan) we will be looking for Service Agreements or equivalent • Written operating policies and procedures (there should be procedures for each service provided) 10

11. What to expect for Future BSC Audits • We will be reviewing: • Transaction/Signature authority • 1. Does the delegation make sense for both the unit and the service center. • 2. Are transactions approved by an individual with the appropriate signature authority level. • Policy compliance and policy enforcement (effectiveness of BSC to bring about greater policy compliance for the units they serve) • Segregation of duties (separate transaction initiators and approvers) 11

12. What to expect for Future BSC Audits • Scope will depend on what services your BSC provides • Our Audit Approach for Service Centers is evolving and is subject to change 12

13. Questions 13