MEETING OF THE BOARD OF TRUSTEES. Audit, Risk, and Compliance Committee. April 24, 2018

Transcription

1 Audit, Risk, and Compliance Committee April 24, 2018 University of North Carolina School of the Arts Kilpatrick Townsend & Stockton, LLP 1001 West Fourth Street Winston-Salem, NC COMMITTEE MEMBERS: Stephen Berlin, Chair Pete Brunstetter Anna Folwell Rob King Michael Tiemann, ex officio COMMITTEE STAFF: Shannon Henry, Chief Audit, Risk, and Compliance Officer Charles Leffler, Interim Vice Chancellor for Finance and Administration David Harrison, General Counsel Amanda Balwah, Staff Faculty Representative Staff Representative Foundation Liaison AGENDA OPEN SESSION 1. Call to Order and Confirm Quorum.Chairman Berlin 2. Approval of Minutes from the Meeting....Chairman Berlin 3. Enterprise Risk Management: Shannon Henry & Jim DeCristo a. Discussion of Poole College of Management Risk Assessment 4. Matters of Governance and Compliance Claire Machamer, Chief Technology Officer a. Information Governance and Security General Update 5. Discussion of External Audits & Reviews (if any)...s. Henry & UNCSA Management a. None to report at this time. Note: Information related to any external audits or reviews released prior to the meeting will be provided at the meeting.

2 6. Discussion of Internal Audit s Reports, Open Projects, and Plans Internal Audit Staff a. Cash Count & Receipting Follow-up Review* b. CDI Review Internal Controls* c. Special Review Contract Compliance* d. Human Resources Control Environment* *Additional information related to this item or any internal audits or reviews released prior to the meeting will be provided at the meeting. CLOSED SESSION 7. Approval of Minutes from the Meeting..Chairman Berlin 8. Discussion of Special Reviews and Investigations (if any) Internal Audit Staff OPEN SESSION 9. Other Business Committee Members & Staff 10. Adjourn..Chairman Berlin

3 Audit Committee DRAFT OPEN MINUTES University of North Carolina School of the Arts Law Office of Kilpatrick Townsend & Stockton LLP Winston-Salem, North Carolina TRUSTEES PRESENT Steve Berlin (Chair)*, Pete Brunstetter*, Anna Folwell (phone)*, Rob King*, Michael Tiemann (ex officio; phone)* *denotes voting member COMMITTEE STAFF PRESENT Shannon Henry (Chief Audit, Risk, and Compliance Officer), Charlie Leffler (Interim Vice Chancellor for Finance and Administration), David Harrison (General Counsel), Amanda Balwah (Secretary of the University), Martha Golden (Faculty Counsel Representative), Leslie Kamtman (Staff Counsel Representative), Julie Williams (Foundation Liaison) OTHERS PRESENT Rod Isom (Audit Manager), Pilar Horne-Davis (Internal Auditor), Devin Doss (Internal Auditor), Lisa McClinton (Controller), Claire Machamer (Chief Technology Officer), Greg Gleghorn, (Director of Information Security) CONVENE MEETING AND CONFIRM QUORUM Committee Chair Steve Berlin convened the Open Session of the University of North Carolina School of the Arts Audit Committee at 4:02 p.m. A quorum was confirmed. APPROVAL OF MINUTES MOTION: Rob King moved to approve the minutes from the December 5, 2017 meeting. Pete Brunstetter seconded and the minutes were unanimously approved. ENTERPRISE RISK MANAGEMENT (ERM) AND COMPLIANCE Shannon Henry, Chief Audit, Risk, and Compliance Officer, and Charlie Leffler, Interim Vice Chancellor for Finance and Administration, led a discussion about the implementation approach and status of ERM at UNCSA. In March of 2016, the UNC System implemented ERM directives for each of its campuses in an effort to establish a risk intelligent culture. Since the mandate, a taskforce has been established to focus on the creation of ERM programs that look at risks in the context of strategy, highlighting both areas of achievement and improvement. Ms. Henry is one of five people serving on this taskforce. UNCSA has made strides toward the establishment of an ERM program: DRAFT Audit Committee Minutes Open Session

4 o An ERM policy has been drafted o A steering committee has been established Ms. Henry presented proposed revisions to the Audit Committee Charter that expand the purview of that committee in regards to enterprise risk management and compliance. o Further, in response to the UNC System s new Information Security Policy, adopted last month (January of 2018), the Audit Committee now has oversight for information governance and security at UNCSA. Chief Technology Officer, Claire Machamer, and Director of Information Security, Greg Gleghorn, will regularly attend the committee meetings to provide updates. o The committee thoroughly reviewed and vetted the proposed changes. MOTION: Rob King moved to approve the proposed changes to the Audit Committee Charter, which expand the purview of the committee to include enterprise risk management and oversight for information governance and security. Pete Brunstetter seconded and the charter was unanimously approved. By way of the new charter, the committee has been renamed the Audit, Risk, and Compliance Committee. Ms. Henry then reviewed proposed revisions to the Internal Audit Departmental Charter, which expanded the purview of the department to include enterprise risk management. The committee thoroughly reviewed and vetted the proposed changes. MOTION: Pete Brunstetter moved to approve the proposed changes to the Internal Audit Departmental Charter, which expand the purview of the department to include enterprise risk management. Rob King seconded and the charter was unanimously approved. Ms. Henry presented the draft of the Enterprise Risk Management Policy. MOTION: Rob King moved to approve the Enterprise Risk Management Policy as presented. Pete Brunstetter seconded and the policy was unanimously approved. Ms. Henry reviewed a draft of the Enterprise Risk Management Steering Committee Charter. MOTION: Pete Brunstetter moved to approve the proposed Enterprise Risk Management Steering Committee Charter as presented. Michael Tiemann seconded and the charter was unanimously approved. *All four of these documents, approved by the Audit Committee, will need to go to the full Board of Trustees for approval. Ms. Henry and Mr. Leffler reported that UNCSA is collaborating with graduate students attending the Poole College of Management at NC State to conduct the university s first ERM risk assessment. The graduate students are under the supervision of faculty who lead NC State s ERM Initiative. The goal of the project is to help us identify the top risks related to UNCSA s strategic success. The risk assessment is underway and there should be more to report at the next Audit Committee meeting in April. Mr. Brunstetter commented that opportunity often comes with risk, but an effective ERM plan can help UNCSA accept risk, when appropriate and advantageous for the school. DRAFT Audit Committee Minutes Open Session

5 MATTERS OF GOVERNANCE AND COMPLIANCE Ms. Machamer gave an information security update and discussed steps Mr. Gleghorn has taken since the last meeting to establish an information security program for UNCSA. So far, he has: Conducted a security risk assessment of all departments on UNCSA s campus; Evaluated the UNCSA perimeter and provided recommendations along with quotes to upgrade the current firewall; Started a Security Awareness Training initiative; and Begun work toward making UNCSA s policies compliant with information security standards. DISCUSSIONS OF INTERNAL AUDIT S REPORTS, OPEN PROJECTS, AND PLANS 90-Day Follow-up to the Office of State Auditor (OSA) Investigative Report of 10/18/2017 Rod Isom, the Internal Audit Manager, reported that Internal Audit s review revealed that the university made the required satisfactory progress within 90 days of the issuance of the Office of the State Auditor s (OSA) initial report per North Carolina G.S OSA s initial report had one finding and two recommendations. The University of North Carolina System Office sent an official response on behalf of the System and OSA concurring with Internal Audit s assessment, which allows UNCSA to maintain its budget flexibility. Cash Count and Receipting Follow-Up Review Mr. Isom reported that an exit conference with management has taken place. Management has requested additional time to respond to the review. Internal Audit s findings will be released once a response from management is received. Discussion of Next Planned Project Internal Audit will examine Human Resources (HR) control environment. The Audit Committee reviewed the engagement letter, which includes the review s objectives. CLOSED SESSION MOTION: Rob King moved to go into closed session to prevent the disclosure of privileged information under N.C.G.S (a) (1), Internal Auditor s work papers, under Section of the North Carolina General Statutes. Pete Brunstetter seconded and the motion was unanimously approved. ADJOURNMENT After returning to Open Session, there was no further business to discuss. Chairman Berlin adjourned the meeting at 4:48 p.m. Respectfully submitted by: Amanda G. Balwah Assistant Secretary to the Board of Trustees DRAFT Audit Committee Minutes Open Session

6 Audit, Risk, and Compliance Committee Tuesday, April 24, :00 5:00 PM AGENDA ITEM Enterprise Risk Management Risk Assessment presented by Shannon Henry & Jim DeCristo Summary: UNCSA partnered with graduate students from the Poole College of Management at NC State to help us further our ERM process. The students began in January, leading UNCSA leadership through a series of tasks to help pinpoint the top enterprise-level risks for UNCSA. Thus, the views on risks will be management s not the students. They will end their work in late April with a presentation and report that summarizes the top risk themes they are hearing from management and the board. The graduate students are under the supervision of faculty who lead NC State s ERM Initiative. The goal of the project is help us identify the top risks related to our School s strategic success. Action: This agenda item is for informational purposes only.

7 AGENDA ITEM Audit, Risk, and Compliance Committee Tuesday, April 24, :00 5:00 PM Internal Audit Activity Update presented by Shannon Henry & Rod Isom Summary of Internal Audit Reviews: 1. Cash Count & Receipting Follow-up Review Internal Audit completed its cash count and receipting review and followup to evaluate the university s progress toward resolving observations included in prior audit reports released on April 8, 2015 and December 16, There were no new issues. Of the four outstanding issues, management resolved three and accepted the remaining risk with corrective action planned for the future. ** 2. CDI Review Internal Controls Internal Audit released an investigative report related to missing property at the Center for Design Innovation. Subsequent to that review, Internal Audit conducted an evaluation of the internal control environment related to risks identified during the investigation of missing items. Observations related to this review have been provided to management. ** 3. Special Review Contract Compliance Internal Audit determined the University of North Carolina School of the Arts (UNCSA) made satisfactory progress toward resolving a finding reported by the North Carolina Office of State Auditor in accordance with North Carolina G.S The finding was related to a conflict of interest. Subsequent to that review, additional transactions were reviewed to determine compliance with university policy and State laws. Observations related to this review have been provided to management. ** 4. Human Resources Control Environment Internal Audit commenced its review of Human Resources (HR) control environment. Selection of this review is based upon a comprehensive plan to assess the internal control environment across all divisions of the UNCSA. The objective of the review is to determine the effectiveness of the control environment within HR. Surveys will be sent campus-wide to assist with assessment and planning efforts. **Additional information related to this item or any internal audits or reviews released prior to the meeting will be provided at the meeting. Action: These items are for informational purposes only.