Finances in the Clear
Six years out from Sarbanes-Oxley, see how NACUBO member institutions have adapted practices to meet the goals of transparency and accountability.
By Sue Menditto and Teresa Gordon
|About the Survey|
Late in 2007, NACUBO and the Association of College and University Auditors designed "The Sarbanes-Oxley Act of 2002: Recommendations for Higher Education Follow-Up Survey." The effort was meant to build on a similar member survey conducted in 2004. The earlier survey was designed around NACUBO Advisory Report 2003-03, "The Sarbanes-Oxley Act of 2002: Recommendations for Higher Education." The objectives of the second survey were to gauge improvement in practice since 2004 and assess how institutions are responding to recent significant audit, whistleblower, and conflict of interest issues.
To gauge practices currently in place and learn about future plans, a Web-based survey was e-mailed to primary representatives at 2,151 member institutions in December 2007. The survey remained open through late January 2008. Completed surveys were submitted by 398 institutions. The statistically significant number of respondents approximates the demographic characteristics of NACUBO’s membership: independent institutions accounted for 60 percent and public institutions for 40 percent. Institutions with fewer than 1,000 full-time equivalent students made up 13 percent of the total; colleges and universities with 1,000–9,999 FTE comprised 67 percent; and institutions with 10,000 or more FTE represented 20 percent.
Our updated survey shows that progress has been made in these areas (see sidebar, "About the Survey"). For example, the 2007 results showed that 67 percent of respondents had a code of ethics policy for senior management, compared to 47 percent in 2004. Similarly, 46 percent of CEOs certify financial statement results, compared to 28 percent in 2004. This article summarizes SOX-related activities and the results of the NACUBO surveys and offers some advice for the future.
Where We’ve Been, Where We’re Going
While the Sarbanes-Oxley Act (SOX) generally does not apply to higher education institutions or other public or not-for-profit entities, the concerns it covers are near and dear to many higher education stakeholders. Because institution leaders have thought it important to stay out in front of these issues, NACUBO provided advisory guidance in 2003 (see NACUBO Advisory Report 2003-03). Since then, institutions have continued to work on business practices and processes related to governance, external auditor independence, and senior management. This is not an easy task. It requires continually weighing costs and benefits to make sure increased administrative resources do not detract from the academic mission. Balancing the demands of regulatory and standard-setting bodies over the past half decade has posed both challenge and opportunity for the business office.
Since the 2004 NACUBO survey, the American Institute of Certified Public Accountants (AICPA) has issued a dozen new audit standards addressing internal controls and risk. Among other changes, the standards introduce new terminology, which can sound ominous to an uninformed user community; lower thresholds for reporting audit findings; and mandate increased communication with the governing board. Some of these latest standards may have been motivated by a climate of increasing accountability.
But, the effect appears to be closer alignment of the AICPA’s standards—used for auditing nonprofit, governmental, and nonpublic organizations—with the Public Company Accounting Oversight Board (PCAOB) standards used for auditing publicly traded companies. Also, the focus of audits is shifting from transactions to risk, which has the potential to increase the level of attention required of academic and administrative leadership as well as governing boards.
In the years following SOX enactment, several states began pondering SOX-like requirements for public charities and nonprofits and subsequently have enacted related legislation. At the federal level, the Senate Finance Committee and the House Ways and Means Committee held hearings that shined a light on not-for-profit accountability and financial-reporting transparency. Secretary of Education Margaret Spellings’s Commission on the Future of Higher Education stressed enhanced financial transparency, better performance metrics, and improved accountability. In addition, the recently redesigned Internal Revenue Service Form 990 information return will collect more details on governance structure, executive compensation, financial instruments, foreign programs, contributions, and endowment activity.
The accounting standard-setting boards have also been active. The Financial Accounting Standards Board (FASB) and the Governmental Accounting Standards Board (GASB) continue to bring more assets and liabilities onto the balance sheet. For public institutions that follow GASB and independent institutions that follow FASB, much more information is finding its way into the footnotes of financial statements, and projects are in process that consider performance reporting. Although these efforts indicate that transparency is on the rise, more required information necessitates additional or enhanced college and university resources—policies, procedures, systems, accounting and reporting staff, management direction, training, communication, and governing board oversight.
The following publications are available to members on NACUBO’s Web site:
NACUBO learned in the 2004 survey that more than 90 percent of institutions had an audit committee. In fact, higher education has a long history of formal governance structures. Public institutions have smaller state-appointed boards, while independent institutions have much larger boards with strong business and community connections. For these reasons, we believe that widespread strong governance practices predate SOX.
In 2004, the more demanding NACUBO Advisory Report suggestions were related to financial certifications, internal control assessments, and ethical codes of conduct. Far fewer survey respondents had established policies and practices in these areas. At that time, many institutions were considering implementation but quite a few remained undecided. Presumably, implementation complexity and increased costs were at the root of the hesitation.
Three years later, survey participants have responded much differently. The demands placed on colleges and universities over the past few years have led to improvement in these areas. Respondents attributed the move toward SOX-like policies to several influences: senior management (noted by 88 percent of institutions), boards of directors (68 percent), the NACUBO Advisory Report 2003-03 (43 percent), and Statement of Auditing Standards No. 112 (33 percent). A quarter of participating institutions mentioned other factors, including professional development programs addressing the Sarbanes-Oxley Act and, to a lesser degree, state government, technology ventures, the student loan controversy, and the media.
In institutions where increased adoption of SOX practices is occurring, respondents were asked to indicate all institutional areas where implementation of such practices most commonly resides. Overwhelmingly, the office of the CFO (reported by 88 percent of respondents) leads the effort. Other areas of responsibility include the office of the controller (indicated by 40 percent of respondents), internal audit (6 percent), office of the president or chancellor (14 percent), general counsel (11 percent), and system office (10 percent).
As previously mentioned, higher education must balance administrative burden and associated expense with the academic mission. So, although business officers must pay attention to multiple accounting, auditing, and regulatory mandates, survey results suggest that higher education leaders are also working to improve business practices and accountability. The data, along with anecdotal discussions with NACUBO members, indicate that gradual implementation over time may be an appropriate response. That way, institutions can balance complex business changes, resources, academic quality, new initiatives, and stakeholder expectations.
NACUBO’s follow-up member survey was designed to gauge the changes in institutions’ practices since the 2004 survey and to obtain more in-depth information about various governance and management practices. Neither survey was intended to determine when colleges or universities established their policies and practices or whether institutions acted in response to Sarbanes-Oxley or NACUBO’s guidance. Instead, the surveys were intended to capture snapshots of campuses’ governance structures, senior management practices, and control systems.
Here are some highlights of the survey findings related to these three areas:
1. Governance still strong; audit committees abound. The results of the current NACUBO survey show that 91 percent of respondents have an audit committee or its equivalent. These results are higher than the 82 percent reported by not-for-profit organizations participating in the 2007 Grant Thornton National Board Governance Survey for Not-for-Profit Organizations. At the institutions with such a governing body, an impressive 97 percent report that the audit committee is independent of management. In addition, 83 percent indicate that external auditors report directly to the audit committee, and 88 percent say they have at least one financial expert on the committee. Futhermore, 86 percent report audit oversight, 80 percent select the auditors, and 71 percent say their audit committee has a charter.
The audit committee oversees multiple institutions in one half of the public institutions that responded to the survey. In comparing independent and public institutions, no appreciable differences were cited with respect to many audit committee practices (see Table 1). However, 92 percent of independent institutions have at least one financial expert on their boards as compared to 89 percent of public four-year institutions and just 76 percent of community colleges. In addition, 60 percent of independent institutions report that their audit committees evaluate the external auditors’ performance—a practice followed at 55 percent of public institutions. In contrast, the independent institutions were less likely to report having a policy for rotating external audit firms.
2. Other trends in governance and senior management practices. The 2004 and 2007 surveys indicate some interesting trends in governance structures and management accountability practices (see Table 2). In some areas, relatively little change was reported. For example, the number of institutions with an audit committee has remained high (slightly more than 90 percent), and the CFO continues to sign the Form 990 tax returns at 70 percent of the responding institutions.
Surprisingly, institutions do not seem to be adding internal auditing functions. While an average of about 50 percent of respondents reported such functions in both years, internal audit is far more common among public institutions (with 74 percent responding positively, as compared to 30 percent for independents, according to the 2007 survey).
Other areas show considerable progress, including the following:
Whistleblower- or employee-complaint mechanisms. These processes are required for all organizations under the Sarbanes-Oxley Act. While 65 percent of institutions report that they have established such mechanisms, it is still surprising to learn that approximately one third of institutions do not appear to have made the necessary arrangements.
Of the institutions that track complaints, the number of different types of complaint mechanisms used ranges from 1 to 6, with the average being 1.5. The most commonly used are (1) externally administered hotlines (reported by 56 percent),(2) a dedicated e-mail address (25 percent), (3) internally administered hotlines (24 percent), (4) a dedicated phone line, and (5) a dedicated fax number (22 percent). The least common mechanisms were a dedicated mailing address (reported by 13 percent) and a suggestion box (15 percent).
According to respondents, information gathered in these various ways usually was routed to one of the following areas: human resources (by 54 percent of participants), internal audit (49 percent), legal counsel (42 percent), the audit committee (37 percent), and/or the board of directors (16 percent).
With respect to the types of complaints received, here’s how they rank by percentage of participating institutions reporting respective issues:
- Accounting and finance issues (94 percent)
- Human resources complaints (83 percent)
- Regulatory issues (78 percent)
- Environmental health and safety issues (71 percent)
- Information technology issues (63 percent)
- Academic affairs (57 percent)
- Athletics and research (less than 50 percent).
In terms of how this data is used, the most frequent response (77 percent of participants) was "to mitigate future risk." Other reported uses include informing policy (55 percent), reporting to audit committee (52 percent), making management decisions (46 percent), determining training needs (41 percent), and benchmarking complaint activity (24 percent).
Codes of ethics. Two thirds of institutions reported having a code of ethics for senior management, and 60 percent also have a code of ethics for staff below the level of senior management. More than 90 percent of these institutions require training for executive and senior management and more than three fourths of them require deans and staff to attend. The training is less commonly required for department heads (reported by 58 percent of respondents) and faculty (reported by 45 percent). However, only a quarter of institutions reported conducting ethics training for nonmanagement employees.
Conflict of interest policies. Such policies are even more common than codes of ethics. More than 87 percent of institutions reported having a conflict of interest policy for senior management, and 73 percent also have conflict of interest policies for lower-level staff. Training regarding the conflict of interest policy was provided by just 20 percent of institutions. Again, the training is most commonly directed toward executive and senior management (93 and 91 percent, respectively). The other groups that are required to attend are deans, staff, and department heads (73, 71, and 61 percent respectively), followed by faculty at 46 percent.
3. Fiscal certifications and internal audits. As shown in Table 2, reporting to the audit committee about internal controls increased from 43 to 52 percent during the time between the two surveys. According to the 2007 survey, 56 percent of institutions now require senior management to assert the adequacy of internal controls over financial reporting. The assessment of internal controls is most commonly performed by the external auditors (59 percent). Forty-one percent of institutions report using their internal auditors; 45 percent use internal resources other than internal auditors. Just 11 percent are outsourcing to a third party.
Internal audit functions, when they exist, play an important role in helping a college or university maintain good management practices. For 59 percent of institutions, an internal audit function provides support for the external audit and includes the assessment of internal controls over financial reporting. Other internal audit functions reported on the survey include investigations of confidential complaints (noted by 84 percent of respondents), assessment of compliance with code of ethics (46 percent), assessment of organizational governance (28 percent), assurance to support the financial certification process (32 percent), and internal audits of financial statements (39 percent).
With the changes in auditing standards discussed earlier—specifically the Statement on Auditing Standards (SAS) 112—we wondered how the increased emphasis on internal controls is affecting member campuses. A third of 366 responding campuses reported that control deficiencies had been identified in the most recent financial statement audit. For the 123 institutions with deficiencies, slightly more than half of the control deficiencies were classified as "significant." Material weaknesses were reported for 24 percent of institutional audits. For institutions reporting A133 audit results, 90 percent conveyed that the number of control deficiencies did not exceed the typical or average number of reportable conditions in past audits. When asked about the impact of SAS 112 on the time to complete the audit, 38 percent reported that it took more time; 60 percent reported no change.
Although the detailed results of NACUBO’s recent survey indicate improvement by higher education over the past three years, the reasons behind current practice are difficult to assess. Overall, it appears that SOX has served to underscore the importance of the traditional formal governance structures of colleges and universities while adding emphasis on ethical and transparent practices. A large number of institutions are attempting to improve business practices and accountability as they balance the associated expense with academic mission.
A follow-up survey will be conducted in two or three years. Because the many mandates affecting the industry do not seem to be trailing off, we have every reason to believe that higher education will continue to adjust and improve its practices.