Last Tuesday we discussed the financial audit of the University of Louisville’s College of Education and Human Development. That story revealed that UofL had not legally complied with our Open Records Request for a copy of the audit and we were reduced to linking to the audit’s executive summary, which was presented to the University’s Board of Trustees. Once that story went live, UofL’s legal counsel promptly and professionally complied by fulfilling our original request of the audit.

You may read all about that by clicking the link above.

Now to the audit. We’ll scan the entire document later today (Finally! Here it is! CLICK HERE for the audit.) but for the time being let’s expand upon a few areas that the previously mentioned executive summary touched.

Under the section “Comply with University Procurement Card Policies“, there are several noted procurement card control weaknesses which include:

• Failure to reconcile timely
• Lack of separation of duties. The procurement cardholder is frequently the reconciler and authorizer/approver. Many times the card was found to be in the possession of someone other than the official cardholder.
• Acceptance of missing receipt forms. Excessive use of missing receipt forms more than once or twice per year is a red flag that fraudulent activity may be taking place.
• The PeopleSoft system has a process for reallocating procurement card charges to the appropriate program or project before the charges are transferred to the general ledger. Audit Services identified excessive expense transfers moving procurement card charges between programs and projects or between general ledger account codes.

Pertinent excerpts from the audit:

University policy requires procurement cardholders to keep a log of transactions that includes the name and signature of the person who actually made the transaction, if that person is not the official cardholder. CEHD has determined that log is unnecessary and is using QuickBooks. However … QuickBooks entries are not made when the transaction is originated, but are updated from the bank statement. In addition, it cannot record the name and signature of individuals who “borrow” the card from the cardholder. Recent changes by the Procurement Card Department require the cardholder, PeopleSoft reconciler, and PeopleSoft approver to sign the monthly log.

Audit Services found during testing that more than 250 transactions occurring between July 1, 2005 and June 30, 2008 that “most [of these] transactions were compliant with policy; however, policy exceptions were noted as follows:”

• 257 transactions tested, 5% (12) were outside the established limits for the card
• 257 transactions tested, 17% (43) did not have an original receipt on file
• 47 transactions tested, 45% (21) allocated as “Entertainment” did not include a list of attendees and the business purpose for said entertainment
• 247 transactions tested, 85% (211) of transactions were not listed on a transaction log
• 55 research transactions tested, 4% (2) were not allowable, allocable or reasonable
• 202 transactions tested, 9% (19) did not pay Kentucky sales taxes
• 239 transactions tested, 12% (28) were items not allowable for purchase. E.G., personal purchases, alcohol on general funds.

There were 41 questionable items purchased by or on the direction of former and now-indicted Dean Robert Felner totaling $2,793.55. The purchases were for various novels and books on U.S. history, membership in a bookstore’s “preferred buyer’s club” and for moving supplies. More than $17,000 was charged to Felner’s credit cards in 2008 for professional journals and membership in professional organizations.

From section “Strengthen Controls over Cash, Checks, and Credit Card Receipts“, there’s all kinds of unsettling information regarding CEHD about funds not being logged as received, no separation of duties, no assurance that cash and checks are being deposited or used for the benefit of the college.

Not surprising:

At least one department is maintaining a petty cash fund that is not record on the general ledger and has not been approved by the Controller’s Office. This petty cash is used as a change fund and as a convenience fund for employees to use for personal meals or gas. On two days in September, employees “borrowed” from the fund and did not pay the money back. One borrower has left the University’s employment and the other borrower did not leave his or her name. Security over the cash supply was inadequate with at least six different people (entire staff of the department) having access to the cash. In September 2008, over $600 had accumulated.

Also not surprising is that the audit’s action plan for stopping the free flow of cash isn’t targeted for implementation until June 30, 2009. And that’s something that could certainly be implemented immediately.

From section “Monitor Conflicts of Interest and Comply with Current Policy“:

Conflicts of interest unrelated to research are governed by personnel policy PER 1.03, which requires conflicts to be reported to the University as soon as identified. Two potential conflicts of interest were identified in the CEHD. In one situation, a faculty member hired her daughter to work on a research project on which the faculty member was the principal investigator. In addition to being a potential conflict of interest by employing her daughter, this was a probably violation of the University’s nepotism policy, which prohibits employees from being involved with the terms of employment of a family member. In another situation, a researcher hired a close family member as a contractor for computer programming. In addition to being a violation of University policy, this payment was an apparent violation of Kentucky statute (KRS.45A.455). This statute says in part: “(1) It shall be a breach of ethical standards for any employee with procurement authority to participate directly in any proceeding or application; request for ruling or other determination; claim or controversy; or other particular matter pertaining to any contract, or subcontract, and any solicitation or proposal therefore, in which to his knowledge:
(a) He, or any member of his immediate family has a financial interest therein; …”

To the University’s credit, in its “Response to Cotton and Allen Recommendations For Grants Management Process“, there are plans for improving monitoring to ensure that conflicts of interest statements are filed timely, that sanctions are communicated and enforced for non-compliance, that periodic audits of statements are conducted to ensure accuracy, that formal policies are strengthened surrounding the Committee for the Review of Individual Financial Interests in Research to ensure independence is maintained, and UofL is considering requiring conflict of interest statements from all faculty. No word on how or whether any of these have been implemented.

Long story short: This is all troubling and not surprising in the least.

Will have another UofL-related story about internal damage control coming up later in the afternoon. Stay tuned.