My NacuboWhy Join: Benefits of Membership

E-mail:   Password:   

 Remember Me? | Forgot password? | Need an online account?

Business Officer Magazine

SOX Assignment

Ohio University students are getting a real-life lesson in internal controls by testing the accounting procedures of the OU Foundation. This unique approach to an institutional checkup is improving efficiency for the foundation and giving students a professional boost.

By Ray Stephens and John Barr

Several years ago, the general sense among foundation audit committee members was that a better understanding of current internal controls and a test of their effectiveness would benefit foundation and university advancement operations. Some members also believed that testing could result in reduced audit costs for the foundation. Michael Fritz, Deloitte & Touche LLP audit partner for the foundation, agreed. In an innovative move, the foundation and the university’s institutional advancement group created an opportunity for a select group of accounting students to gain exposure to internal control review requirements similar to SOX section 404.

Defining Student Involvement

To get started, Fritz committed Deloitte & Touche to provide initial training to help students establish how to perform the internal control assessment. The university’s School of Accountancy agreed to have faculty supervise students and offer ongoing technical expertise and education. A call was sent to all accounting majors for the Foundation SOX 404 Fellows Program, indicating that each selected student would receive a $500 scholarship and one hour of internship credit for participation during the academic year. Students were selected based on their educational accomplishments and involvement in student activities.

At the outset, the goals of the foundation audit committee were to have students: 1) document the internal control structure; 2) determine the sufficiency of the internal controls in place; and 3) assess the effectiveness of internal controls in the foundation and university advancement. The primary difference between the work of the students and a formal SOX 404 audit would be that no management assertion about the quality and sufficiency of the internal controls would result from which to issue a report. Instead, students would communicate testing results to the foundation audit committee.

Year One: Document

For the inaugural 2004-05 academic year, six junior and senior students were named as SOX fellows. The Deloitte & Touche training consisted of a four-hour program on testing internal controls and using spreadsheets to document the design, placement in operation, and effectiveness of internal controls. The spreadsheets could also be used to identify areas where internal controls were desirable but none were found.

Student work during the first several months resulted primarily in documenting the current internal control structure in the foundation and university advancement so that further work could be performed. Most of the learning for these first-year fellows centered on the additional documentation needed about the design and placement in operation of controls.

For instance, some processes such as the internal controls over cash receipts between university advancement and the foundation were documented sufficiently. However, in many cases additional documentation was needed before recommended controls could be implemented. In other cases, controls existed but the processes were not documented. Almost all of these were situations where a reorganization of duties within the foundation and university advancement meant that the documentation indicated an appropriate design but the way the duties were being performed did not reflect the design.

Year Two: Test

In 2005-06, nine students were selected for the program, including three fellows from the previous year. During the second year, students worked in two teams: investments and contributions. Each team spent approximately five hours per week in inquiry, documentation, and meetings during each of the three academic quarters. By first identifying all controls, students gained a better understanding of which controls were “key” and proceeded with testing on that basis.

The investment team identified 32 controls and carried out complete testing on 9 of these. Results indicated that all controls were operating effectively but that minor adjustments were needed in three of the controls. One control indicated the need for an adjustment in the foundation accounting system to allow the control to operate differently, since the university system did not always allow unique identification of the transaction without an additional amount of searching.

The contributions team carried out complete testing on 6 of the 29 controls it identified. While all controls were operating effectively for contributions, the team noted the possibility for a non-contribution to be included in the system as a contribution. University advancement is now aware of the problem and will not allow future amounts to be included unless tied to a foundation account.

Year Three: Keep Up the Good Work

One outcome of the interim report provided by the 2005-06 fellows to the foundation audit committee was approval to continue the program for 2006-07, with one addition. A third team—disbursements—will examine, test, and document processes that follow a donor’s intent when either gifts or endowment earnings are spent. (Donor intent and higher education spending typically receive significant media attention and constitute a high-risk area for many foundations.) The 2006-07 fellows will also continue work on the identified controls that have not yet been tested in investments and contributions.

Why Tapping Students Makes Sense

By Sue Menditto

Many nonprofit and higher education trustees have corporate backgrounds and are familiar with the provisions of the Sarbanes-Oxley Act. And, of course, many trustees inquire about accountability, documentation, controls, and financial assertions. Such issues can be burdensome for even the wealthiest of publicly traded companies, let alone higher education institutions, their foundations, or other nonprofit organizations. However, higher education is in a unique position of having students as resources who are interested in accounting and auditing and who desire a competitive employment edge.

As a higher education and nonprofit practice partner with Deloitte & Touche LLP, Michael Fritz understands the resource-intensive commitment required to establish and document business processes that reinforce solid internal controls, plus the follow-up required to make sure controls are working properly. Similarly, he understands the time it can take to adapt a new graduate to the position of auditor in a public accounting firm. Consequently, the idea to match student needs with the slim resources of a university foundation environment allows an institution to leverage students’ motivation and talents, gain knowledge, and prepare for an audit, says Fritz.

The accounting students selected for internal control work at the Ohio University Foundation were trained using Deloitte & Touche benchmarking, control, and risk-assessment tools and procedures. As engagement partner, Fritz was involved in high-level review of the students’ work. Such involvement by a partner increases the audit firm’s reliance on the work of the students. Although the training and review can come with a cost, in the case of the OU Foundation, the return was well worth the investment.

In general, when a professional training program is used and a well-conceived plan is followed, students’ review, testing, and documentation provide audit-ready work where none previously existed. Even though students are not yet experienced or qualified accounting professionals, their work product helps the organization assess what processes should be continued, reengineered, or begun. In that regard, the students’ work effort can replace what an institution or foundation would otherwise have to hire extra staff to complete.

The deliverable also puts an entity with limited resources ahead when external auditors evaluate risk and scope. Documentation allows the auditors to hone in on the audit areas that will require greatest attention. With trustees asking about Sarbanes-style best practices, and with the clock ticking on potential control-related reportable findings (per AICPA Statement on Auditing Standards (SAS) 112), higher education must begin to honestly, and perhaps creatively, assess and evaluate its current processes and control environment.

SUE MENDITTO is director of accounting policy for NACUBO.


Benefits for Both Sides

One obvious benefit of the program for students has been the practical internship experience in auditing internal controls of an actual entity—without ever leaving campus. Several students who also had internships with “Big 4” accounting firms during their time as SOX fellows agree. Jena Rinker says the experience has given her a professional advantage over peers outside the institution. Kristen Romaker says the program has strengthened her ability to communicate with clients because of the interviewing experience she gained during the fellowship.

The program has provided a learning experience not only for the students but also for the foundation as it becomes more effective and efficient in applying the SOX 404 practice to a not-for-profit organization. Those who work on the books and internal control processes at the foundation benefit from improved documentation and identification of specific issues requiring further study. For instance, in addition to flagging the use of the funds in accordance with donor wishes, students noted the duplication of controls between the foundation and university advancement.

Foundation audit committee chairman Phil Muck names another value of the program: confirmation that the foundation has a solid accounting system in place, despite identified areas for improvement and efficiency. From a financial standpoint, valuable documentation, testing, and assessment are occurring at minimal costs to the foundation and university advancement—with the possibility that other monetary benefits, such as operational efficiencies and a reduction in audit fees, could flow to these groups, says Muck.

Do Try This at Home

The Ohio University Foundation experience may be advantageous to other higher education institutions interested in developing a similar program. Several lessons we learned may help you expedite the process.

Factor in human behavior. During the first year, we did not fully anticipate how interactions between university personnel and students would play out. Understandably, some university personnel reacted in the manner in which they would to any type of auditor. However, SOX fellows often felt they were being reacted to as students and that their work was not being respected. These disparate perceptions revealed a need for both groups to be educated about the importance of the process. For business office staff, that meant making clear that they must take time to interact with students during inquiry and internal control testing. For students, we had to provide ongoing reinforcement about how they should respond during an inquiry process to those from whom they are requesting responses.

Plan for continuity. Obtaining concrete results becomes much easier if you incorporate some overlap with student representation. We allowed three students from the 2004-05 academic year to continue as fellows for 2005-06, and three members from this past year will return for the 2006-07 academic year.

Adjust your time frame. Perhaps the biggest lesson we’ve learned so far is that it takes time to understand and test internal controls and to develop concrete results. As mentioned, our first year was largely one of laying the groundwork by documenting existing internal control structures. By the second year, students were much more productive, especially since each of the two teams had a continuing member. For any student-centered approach, it’s important to understand upfront that certain constraints do exist because of the amount of time students can commit to the process during an academic year. Students not only have classes, assignments, and exams—they also are unavailable during academic breaks. While this process does not always flow smoothly or continuously, it does flow—given that appropriate students are selected and appropriate supervision by faculty occurs.

Ultimately, the benefits of developing such a program far outweigh the academic-year time constraints. Chief in the payback for an institution is ensuring that internal controls are designed to safeguard the assets of the foundation and to carry out the intended uses of donors. The transparency provided through this review process can likewise give needed assurance to an institution’s administration and board of trustees that proper controls are in place.

RAY STEPHENS is James E. Daley Professor and director of the School of Accountancy, and JOHN BARR is director of external relations, at Ohio University, Athens.