On the Transparency Track
With Corporate America facing new, stricter standards for managing and disclosing its finances, how is College America responding? A survey of 353 NACUBO institutions offers reassurance and reveals some differences in how campuses tackle the issues.
By Sue Menditto and Jessica Shedd
|About the Survey|
Late in 2004, NACUBO sought to move from anecdotal to experiential information with a member survey designed around NACUBO Advisory Report 2003-3, The Sarbanes-Oxley Act of 2002: Recommendations for Higher Education. The objectives of the report were to help the business office make sense of the Act; reinforce internal control and governance practices that improve stakeholder confidence; promote managerial behaviors that withstand scrutiny; provide a tool to evaluate current and future organizational direction; and allow room for updated guidance as practice evolves.
To gauge practices currently in place and learn about future plans, a Web-based survey was developed by NACUBO and the Accounting Principles Council and e-mailed to primary representatives at 2,178 member institutions on October 8, 2004. The survey remained open through December 31, 2004. Completed surveys were submitted by 353 institutions. The statistically significant number of respondents approximates the demographic characteristics of NACUBO’s membership: independent institutions accounted for 60 percent and public institutions for 40 percent. Institutions with fewer than 1,000 full time equivalent (FTE) students made up 13.6 percent of the total; 1,000–9,999 FTE comprised 55.2 percent; and 10,000 or more FTE represented 30.3 percent. A large majority, 88 percent, is aware of the Advisory Report, and 73 percent of respondents had read the report. Full descriptive survey results are available at www.nacubo.org/research.
Higher education has long been accountable to its many constituents—legislatures, students, donors, federal research agencies, and the public. But the Sarbanes-Oxley Corporate Reform Act of 2002, enacted in the wake of the Enron, WorldCom, and Wall Street scandals, set new benchmarks for auditors, executives, and directors in America’s publicly held businesses. Generally, the Sarbanes-Oxley Act (the Act) does not legally apply to nonprofit and governmental organizations like colleges and universities. However, NACUBO has been paying close attention to the issues and has offered recommendations and surveyed campuses on their governance, accountability, transparency, and ethics policies and practices.
A recent assessment shows that colleges and universities are on solid ground in most of their audit-related practices: At almost all institutions, boards have audit committees or an equivalent in place equipped with the necessary authority. But in other areas—certification of financial results by top campus leaders, codes of ethics, and the assessment of internal financial controls—there is room for improvement.
NACUBO’s member survey was designed to gauge institutions’ current and planned practices in the context of the guidance provided in NACUBO Advisory Report 2003-3, The Sarbanes-Oxley Act of 2002: Recommendations for Higher Education. The survey was not intended to determine when colleges or universities established their policies and practices or whether they acted in response to Sarbanes-Oxley or NACUBO’s guidance. Instead, the instrument captured campuses’ governance structures, senior management practices, and control systems by asking about existing and future plans and policies (see sidebar, “About the Survey”).
The ABCs of Audit Committees
In studying high-profile cases of poor corporate governance at public companies, regulators and other experts concluded that unusually close business relationships between officers of a company and its outside auditors have the potential to create a conflict of interest. To guard against executive and audit firm impropriety, the Act establishes high standards of governance in general and for the audit committee in particular. NACUBO’s guidance, modeled on the law’s requirements, recommends that institutions establish an audit committee or ensure that an equivalent body—a finance committee, for example, or the full board—fills the audit committee’s role. The Advisory Report recommends that:
- members of an institution’s audit committee be independent directors or trustees,
- management not be voting members of the committee,
- at least one member of the audit committee have financial expertise,
- the audit committee has an explicit charter that specifies the breadth of its authority, and
- the committee exercise direct control over external auditors.
The NACUBO survey results show that 92 percent of respondents have an audit committee or its equivalent. These results are slightly higher than the 84 percent reported by not-for-profit organizations participating in the 2004 Grant Thornton National Board Governance Survey for Not-for-Profit Organizations. In addition, the audit committees at colleges and universities appear to have the expertise and direction they require. At the institutions with such a governing body, 73 percent say their audit committee has a charter, 78 percent report that the charter contains all the necessary authority for the committee, 74 percent have external auditors report directly to the committee, and 81 percent say they have at least one financial expert on the committee.
There were no appreciable differences between independent and public institutions regarding charters, authority, and financial audit governance. However, 95 percent of independent institutions have at least one financial expert on their boards compared with 73 percent of public institutions. Many public institutions have elected or governor-appointed trustees and thus have little say in the membership or qualifications of their boards.
External Auditor Independence
Public accounting firms auditing colleges and universities are not legally bound by sections of the Act that address external auditor independence. Consequently, NACUBO’s Advisory Report predominantly addresses auditor independence from the governance or audit committee perspective. The general rule for auditor independence is that auditors should not perform management functions or be involved in activities they might later be required to audit. The report recommends that:
- the audit committee (or its equivalent) provide oversight to ensure the independence of audit decisions;
- institutions prohibit their auditors from providing the non-audit services restricted by Sarbanes-Oxley;
- the audit committee pre-approve all non-audit services; and
- the accounting firm’s lead audit partner rotate off the institution’s audit after seven years, with a minimum “time-out” of two years.
Almost all of the institutions with an audit committee—90 percent—report that the committee currently has oversight of the annual financial audit. The percentage of institutions with policies on specific elements of oversight is almost as high. For example, 79 percent of committees are involved in selecting the audit firm and 73 percent report that the committee evaluates the auditors’ performance. While only 59 percent have the audit committee receive the engagement letter, an additional 17 percent of respondents will have the audit firm direct its engagement letter to the committee, not management, within the next 12 months.
Despite the fact that audit-committee oversight responses are positive overall, differences between the responses of public and independent colleges and universities are worth noting. For example, 85 percent of independent institutions report that their audit committee evaluates the external auditors’ performance—a practice followed at only 53 percent of public institutions. Many public institutions are audited by state agencies, either executive or legislative, not by independent accounting firms. Those campuses have little or no control over their auditor.
The survey revealed that the most common non-audit work performed by external auditors is tax (39 percent), followed by internal control reviews (36 percent). The assumption is that independent auditors are performing control reviews due to increased awareness resulting from the Act, NACUBO advisory guidance, or trustee concerns. Only 50 percent of institutions currently require preapproval for non-audit services (38 percent public and 56 percent independent) and 17 percent of public institutions indicated they would not implement preapproval. It is likely that the response from public institutions reflects state control over the appointment and use of auditors.
Forty-seven percent of institutions require lead partner rotation. Perhaps many institutions are not yet concerned about a seven-year-long rotation cycle. And as NACUBO’s Advisory Report discussed, the market for higher education audits is small and specialized, leaving institutions with few choices among the limited number of accounting firms and partners with expertise. In a sellers’ market, audit committees may hesitate to demand partner rotation or limits on non-audit services.
A Model for Senior Management
To enhance financial statement reliability, Congress embraced the notion of personal accountability for top corporate managers. Sarbanes-Oxley requires the chief executive and financial officers of public companies to personally certify that their businesses’ annual statements are correct. To back those assertions, Sarbanes-Oxley requires corporations to establish strong internal financial controls.
NACUBO’s Advisory Report acknowledges the sound business practice of identifying, designing, and maintaining controls and recommends steps to document policies and procedures, assess risks, and review controls. Specifically, the report says that:
- Senior financial managers should adopt a code of ethics and methods to ensure compliance.
- Institutions should make a confidential complaint mechanism available to employees.
- Large decentralized institutions should consider requiring certifications by employees with fiscal responsibility at each unit.
- Institutions should begin identifying controls over financial reporting and disclosures and evaluating their adequacy:
- Plan the steps needed to accomplish an internal control assessment.
- Consider a risk assessment that documents key financial processes.
- Begin documenting the financial reporting process.
- Institutions with an internal audit function should consider providing periodic reports on internal controls to the audit committee as well as management. ‰
The survey examined senior management practices in three areas: ethics, controls, and certifications. In all three areas, less than half of institutions have adopted the report’s recommendations, at least one-fifth are planning to do so, and more than one-fifth of respondents are undecided about proceeding with them.
Ethics. According to survey respondents, 47 percent have a code of ethics in place, while 49 percent have confidential complaint mechanisms to protect employee whistleblowers. The remaining institutions are planning to implement, with a slightly smaller percentage undecided. Specifically, by 2006 an additional 28 percent will have a code of ethics and an additional 24 percent will have a confidential compliant mechanism. The number of undecided respondents is high, indicating that at least 20 percent of institutions are considering implementation. When it comes to ethics, there is little to no opposition—institutions are actively planning or thinking about their approach. NACUBO hopes to learn more about plans and process through follow-up interviews with survey participants.
Controls. The survey asked about three practices aimed at assessing and strengthening internal financial controls. Institutions were most likely to have management report periodically to the audit committee on their controls: 43 percent of respondents say they do so, and 19 percent plan to add such reports. Only 38 percent say they have performed risk assessments and documented their key financial processes; 29 percent plan to do so within the next two years. While only one-quarter of respondents have planned an overall assessment of their internal controls, another 25 percent plan to do so within the next two years.
By the end of 2006, half to two-thirds of campuses intend to have adopted these three practices. Because public companies are finding rigorous reviews of internal controls difficult, time-consuming, and expensive, it is not surprising that survey data suggest that institutions are taking measured steps. Higher education may be seeing a cost-effective, incremental approach to such policies. In fact, per the Advisory Report, recommended practices determined to be burdensome or costly should be documented and reviewed by the institution’s board.
|The following publications are available to members on NACUBO’s Web site:
NACUBO Advisory Report 2003-3, The Sarbanes-Oxley Act of 2002: Recommendations for Higher Education: www.nacubo.org/x4384.xml
“The Substance of Transparency: The Sarbanes-Oxley Act” (February 2003 Business Officer article): www.nacubo.org/documents/bom/2003_02_sarbanes_oxley.pdf
Certifications. Fiscal managers and CFOs are more likely to be certifying financial results than campus CEOs. In the survey, 36 percent of respondents require public certification of financial statements by the CFO; 35 percent require certification by managers with fiscal responsibility; but only 28 percent have the CEO publicly sign off on financial statements. Large institutions are more likely to have their CFO publicly certify financial statements and less likely to be undecided than small- or medium-sized campuses. It’s assumed that because larger institutions are more complex, they have more experience responding to public accountability concerns.
In general, relatively few institutions plan to adopt these practices. Even by the end of 2006, certifications will not be the rule at a majority of institutions, according to survey respondents.
The Road Ahead
Is higher education prepared for the post-Enron era? Trustees, donors, legislatures, and stakeholders may look to business practices addressed in the Sarbanes-Oxley Act as models for control, disclosure, and accountability on campus. NACUBO’s survey shows strong compliance with some of the Act’s requirements, as filtered through the recommendations of the NACUBO Advisory Report, and robust plans at many institutions to adopt these practices.
Yet many of the most widely adopted practices—particularly in creating and empowering audit committees—undoubtedly predate Sarbanes-Oxley. Far fewer institutions have adopted demanding accountability suggestions, such as certification of financial statements by top campus leadership and rigorous testing of internal controls. Indecision about those proposals remains high, perhaps reflecting the novelty, cost, or difficulty of implementation. The more challenging or complex the recommendation, the smaller the number of institutions likely to have adopted it.
NACUBO’s survey offers a solid baseline for assessing higher education’s current policies and practices. What’s needed now is further assessment and explanation of the areas where recommendations are not widely followed and deeper understanding of which practices best fit the circumstances of higher education. NACUBO plans to reach out to higher education leaders and follow up with member interviews. As key constituents increasingly apply Sarbanes-Oxley’s requirements—and some state and local governments even consider legislating similar standards themselves—colleges and universities must prepare to explain accountability to stakeholders.
- Federal Court Postpones Effective Date of Overtime Rule
- 1098-T Box 1 Reporting Will Not be Required Until 2018 Tax Year
- EPA Issues Hazardous Waste Generator Improvements Rule
- 2017 Intermediate Accounting and Reporting - Winter
January 23-24, 2017
- 2017 Endowment and Debt Management Forum
February 1-3, 2017
- ON-DEMAND: The CBO's Role in Diversity and Inclusion on Campus
- ON-DEMAND: The Clery Act: Strategic Planning to Mitigate Institutional Risk
- ON-DEMAND: Title IX: Key Issues Surrounding Institutional Compliance
- ON-DEMAND: NACUBO Live! Higher Education Accounting Forum
- ON-DEMAND: Responsibility Center Management: Two Different Perspectives