I Volume 55 I Number 1 I SPRING 2013 I
ACUA Ambassadors: A Few of Our Favorite ACUA Memories How Much Is Higher Education Like a Business? Part 1: Exploring Internal Auditing Views on Culture and Measuring Achievement Techniques for Auditing Reputation Controls â€“ Part I: Fundamental Sources of Reputation Risk
! r o t i d u A e h t o t Power Fight Fraud and Protect Revenues! Import data faster than a speeding bullet. Analyze thousands of records in a single pass. IDEA® empowers you to conduct more efficient and effective audits ... almost like you’ve acquired superpowers. 2013 Strategic Partners Providing ACUA Members with Exclusive Benefits, Resources and Discounts • Preferred Pricing • Hands-on Training at the Mid Year Conference • Live Online Demonstrations
Contact us to see IDEA in action. 888.641.2800 • email@example.com audimation.com
sprin g 2 0 1 3
ACUA members are invited to submit letters and original articles to the editor. Go to www.acua.org and click on the Resources – College & University Auditor Journal for further guidelines. Please send your copy electronically to the editor or ACUA in Word 95 (or higher) or text file format. The editor reserves the right to reject, abridge or modify any advertising, editorial or other material.
From the Editor
From the President
Doug Hawks, University of Tennessee firstname.lastname@example.org 865-974-4460
ACUA Ambassadors: A Few of Our Favorite ACUA Memories By Toni Stephens
How Much Is Higher Education Like a Business? Part 1: Exploring Internal Auditing Views on Culture and Measuring Achievement By Sterling Roth
Techniques for Auditing Reputation Controls Part I: Fundamental Sources of Reputation Risk By Dr. Bradley W. Brooks, Joe Oringel and Ken Ramaley
Clarice Maseberg, Wichita State University Amy Hughes, Michigan Tech Beverly Hawkins-Llewellyn, University of Montana Claire Sams Milligan, Alabama Department of Postsecondary Education David Dixon, Governors State University Mary Ann Mackenzie, Auburn University Michael Foxman, University System of Georgia Sterling Roth, Georgia State University ACUA Management
Stephanie Newman, Executive Director
College & University Auditor is the official publication of the Association of College & University Auditors. It is published three times a year as a benefit of membership. Articles in College & University Auditor represent the opinions of the authors and do not necessarily represent the opinions of governance, members or the staff of the Association of College & University Auditors. Acceptance of advertising does not imply endorsement by ACUA. ©2013 Association of College & University Auditors. Send address changes to:
ACUA PO Box 14306 Lenexa, KS 66285-4306 ACUAemail@example.com
1 College & University Auditor
Letter From The Editor By Douglas Hawks, Editor
I’ve always gotten a chuckle out of the somewhat professionally self-deprecating joke, “Why did the auditors cross the road?” “Because that’s what they did last year!” Maybe it’s because of the sliver (or trunk) of truth in it, or maybe because it’s a good reminder of how important it is in our profession to learn from the past, not waste time recreating the wheel, but never for a second assume that our environment today is what it was in the past. Not only is that an important professional principle for internal auditors, it is becoming an even more important part of the higher education industry. The articles in this issue provide some important perspectives on how we can analyze and view our industry and our institution’s strategy. Dr. Sterling Roth provides an excellent summary of work he has focused on for the last few years as he has worked toward his Ph.D. His dissertation included work on what higher education can learn from the business world, a question that we will likely hear asked more and more as resources continue to be strained, expectations continue to increase, and innovation turns from being a competitive advantage to a necessity for survival. It’s easy to see from this article that Dr. Roth “gets it,” and this article is a great read to consider and reflect on to see if your institution “gets it” as well. Much of my work over the past few months has related to the idea of reputational risk, a concept I’ve always found rather ominous. It certainly sounds bad. We see recent examples of some pretty significant hits to higher education institutions in the media, but has it really crippled them? Was there anything more than a black eye that quickly healed?
While the methods of our communication may change, the information we share with each other
I’m no higher education historian, but I can’t think of an Enron or Arthur Andersen in our industry. Is that just me taking comfort from my own lack of understanding? The article by Brooks, Oringel and Ramaley gave me plenty to think about, and while I felt like I learned a lot, the one thing I know for sure is that I am anxious for Part II!
remains the core strength of ACUA.
As I hand over the editor reins of the “C&U Journal” to Clarice Maseberg at Wichita State, I do so already excited for the next issue! Part of that may be that I’ve been privy to a sneak peek of what’s to come, but it mostly comes from the anticipation of what Clarice and her team of editors and committee members will be able to do with the journal. New ideas and perspectives are what make ACUA so valuable. While the methods of our communication may change, the information we share with each other remains the core strength of ACUA. I’ve enjoyed the opportunity to be involved, in some small way, in the dissemination of that information. Thank you! n
2 College & University Auditor
Letter From The President By Phillip W. Hurd, CISSP, CISA President
As President, I recently discovered I actually don’t get to see much of the cities where our conferences are held. However, at our midyear in Seattle, I did manage to get out and visit the first Starbucks store. It was a somewhat unimpressive store, no doubt indicative of the humble roots of the corporation, but it is visited by tens of thousands of people annually. I, like most tourists, purchased a coffee and a souvenir mug. It was rather late at night, at least for me, when we were at the store. As I waited to purchase my coffee mug I noticed that it said, “Made in Ohio.” I queried the store clerk as to why it was made in Ohio as opposed to China, as most of the other mugs were. His response reminded me why I love higher education. Apparently, around the town in Ohio where these mugs are made, the economy had been hit particularly hard over the past several years. The owners of Starbucks were in the process of moving their mug-making process and selected that site–even though it was a bit more expensive–to help give the economy of that area a boost because “a friend had asked.” Because of the large volume of mugs made, the economy surrounding that area has picked back up. As the manager of the Starbucks continued to talk to me, he told me how the organization had wanted to be “economy conscious,” as it related to the U.S. economy. Almost as a side note, and with no prompting from me, he also mentioned how some accountants and auditors had cautioned against moving Chinese-based mug operations to the U.S. I said nothing but realized that it illustrated a stark contrast between the types of auditors that I see in higher education and those that I’ve known in the corporate environment where profit is a–or the– primary driver. It also made me glad that the concepts of corporate responsibility and personal relationships were not lost. I couldn’t help but think back on all the times when I’ve cautioned Georgia Tech’s administration about the cost associated with a particular move of resources or people. It also made me glad that the concepts of corporate responsibility and personal relationships were not lost.
My recommendations, while primarily financially driven, are also influenced by ethics, responsibility, support of the State of Georgia and other “corporate responsibilities.” Usually, management is very receptive and often follows the path I’ve suggested, but I’ve found myself wondering if in the “dog eat dog” world of corporate America whether similar recommendations would be as well received.
I will likely never know the answer to that as I am very happy in my job at Georgia Tech, but it also gave me great comfort to know that the folks in ACUA all seem to have an understanding of the tremendous responsibility that goes along with assessing such levels of money, knowledge, resources and people in the framework of more than money. One of the key founding documents of the United States says, “… But when a long train of abuses and usurpations, pursuing invariably the same Object evinces a design to reduce them under absolute Despotism, it is their right, it is their duty, to throw off such Government, and to provide new Guards for their future security…” I’ve always liked that particular line because in modern-day English it roughly translates to, “those people who have the ability to change their world, and see it needs to be changed, also have the responsibility to do it.” In higher education we face the daunting task of assisting in changing the world: assessing the postures, the ethics and the control systems of repositories of knowledge and education that possess more knowledge now than has ever existed in any era of history and doing it in an ever-changing, dynamic complexity that is distributed around the U.S. and, in many cases, the world. Yet we do it, in part, because we know the world can be, and is becoming, a better place. I know that is a lot to ponder so I suggest that you go to the local Starbucks, have a coffee and think about your responsibility and ability and what you’re going to do with them. May the 12 great riches of life be with you. n
3 College & University Auditor
What is the ACUA Risk Dictionary? The ACUA Risk Dictionary is a comprehensive database of risks and their associated controls for areas specific to higher education. Higher education audit departments can use the risk dictionary for identification of an audit universe specific to higher education which can be used for performing their annual risk assessments and preparing their annual audit plan. The ACUA Risk Dictionary can also be used to prepare project level risk assessments for areas such as: ‐ NCAA Compliance ‐ Student Financial Aid ‐ Export Controls ‐ Research Compliance and many more! After having identified the risks for your audit project, the ACUA Risk Dictionary contains the associated controls which can then be used to prepare an audit program to test whether the proper controls exist.
Is the ACUA Risk Dictionary for YOU?
Business officers, risk officers, compliance officers and other higher education leadership can use the ACUA Risk Dictionary to provide a comprehensive list of areas that could likely need their attention. For someone new to their position or new to higher education, the ACUA Risk Dictionary will be especially beneficial in identifying not only broad areas where inherent risks are common, but also specific risks within those areas and their associated controls. In the absence of a formal risk management structure, the ACUA Risk Dictionary provides a concrete and comprehensive starting point for identifying, evaluating, and managing risks across the organization. You now have the ability to submit new risks and controls for the dictionary. The Risk Dictionary is a living document, so check it out with an eye toward what you can contribute. The ACUA Risk Dictionary is available for FREE as a benefit of ACUA membership or by subscription to non‐members.
4 College & University Auditor
ACUA Ambassadors: A Few of Our Favorite ACUA Memories By Toni Stephens, Director of Internal Audits, University of Texas at Dallas
ccording to dictionary.com, an ambassador is “a diplomatic official of the highest rank, sent by one sovereign or state to another as its resident representative.” Did you know that ACUA has such diplomats?
ACUA Ambassadors are members who have served ACUA in a leadership position. Examples include past presidents, vice presidents, secretaries/treasurers, board members and committee chairs who have served at least three years. The ACUA Ambassadors Committee, chaired by the Immediate Past President, is an ad hoc committee established by the Board in 2009, and is an integral part of ACUA’s Strategic Plan. The purpose of the committee is to provide advice and counsel to the Board and to develop and foster mutually beneficial relationships with other professional organizations. They also help enhance relationships with current and potential ACUA members. In fact, this year they have been helping the Membership ACUA Ambassadors Committee with membership renewals! are great resources for ACUA Ambassadors are great resources for members because they have been around a members because they long time. No, they’re not old, they’re just experienced! If you have a question about ACUA, I bet they can answer it for you! Look for them at the next ACUA conference… have been around a long they’ll have a ribbon designating that they are an ambassador. time. Below is a list of your 2012-2013 ACUA Ambassadors and some of their favorite ACUA memories … even some memories I bet many of you didn’t know … like the ACUA PINEAPPLE?! C ACUA Ambassador Favorite ACUA Memories I come home from every ACUA event convinced that it was the best event ever and totally energized to Mary Barnett, Virginia Community take off running on an exciting new auditing adventure. I did a QAR this week and a big part of the report is going to be about improving their QAIP, and I just keep referring back to what I learned in College System Kim and Sandy’s class in Vegas. I always come out of an ACUA event with something I can keep in my back pocket until I need it! Betsy Bowers, My favorite thing about ACUA is its commitment to networking and constant sharing of information. University of West Florida I’ll never forget the San Francisco Annual Conference where for the conference opening Stephanie Siri had a university marching band come through and our souvenirs from ACUA that year were wooden baseball bat-type pens. (I still have mine.) 1986 Boston annual – besides the return ride on double-decker buses from the last minute clam bake/ Mary Lee Brown, lobster feast at the Gloucester House in Gloucester, Mass., I recall the formality of the Wednesday University of dinner dance. All the men were in suits and ties and the ladies were in dresses and heels—no jeans or Pennsylvania polo shirts. The dancing was much the same as today with virtually everyone in attendance getting on the dance floor at some point in the evening and having a great time with people you knew and those you didn’t. 1988 Providence Annual – the birth of the “ACUA Towel” at one of the local bars; “Sh-booms” which became a tradition at the Wednesday dinner dance after 1988. I recall seeing an ACUA towel even as recently as the 2011 annual. (continued on page 6) 5 College & University Auditor
C ACUA Ambassador Mary Lee Brown, University of Pennsylvania, continued
Favorite ACUA Memories 1998 Keystone Annual – instead of staying in a hotel, several ACUA members opted to rent condos, one such group–no names revealed–hosted a “kegger” in their condo. Admission cost $2 and you received an official ACUA plastic cup for unlimited beer … the party lasted until the very wee hours of the morning but everyone made it to the workshop sessions the next day. We play hard and work hard. Of course the best thing about ACUA is the incredible professional and personal relationships that are forged, so many of which last long after members retire or move on in their careers and are no longer in the audit profession. I was the last one to get the cream-pie-in-the-face at the Wednesday night dinner/dance, which was a Fred Chavez, thankfully short tradition. Stephanie Siri, who followed me in “the chairs,” gave a no-joke order as soon University of as she became president to stop that “tradition.” It was a real pie at least; not a shaving cream pie like San Diego rookies get in the major leagues. One of our meetings was in Birmingham in the '80s and a rusty iron rod was added to the pineapple and towel. That got dropped from the lore at some point, hopefully not on anyone’s toes. *Really* old ACUAites might remember the Boston conference when ACUA rented out the Museum of Science in Boston. The museum had a power outage on the day of that event so we had to scramble to find a substitute for it. A director found a lobster and beer place north of Boston. It turned out to be one of the most fun events we’d had up to that point. The fun didn’t stop at the event though. On the way back the party continued on the buses until we got stuck in a horrible traffic jam on the interstate on the way back to the hotel—traffic was at a dead stop for quite a while. This was a long time ago, so my memory of it may be weak, but Chuck Jefferis first ran for the Board Dick Dawson, University of Texas as a “write-in” candidate during one of the general membership meetings at an annual conference. His supporters all showed up at the meeting with signs stating “Up Chuck!” at San Antonio The first day of the Phoenix Conference where I was the incoming President and Kevin was outgoing, Kevin had to keep telling stories and jokes because the Monday morning speaker did not show up. Then, Toni stepped in and got Mark Salamasick to speak at a moment’s notice. This is probably more of a nightmare than a memory. Chuck Jefferis, Just a few memories that immediately come to mind: April 7, 1958, the first meeting held in Chicago; Stanford University ACUA blue bus; pineapples; ACUA towel; ACUA logo competition; double-decker buses in Gloucester fog; Johns Hopkins singers; the almost photo opportunity with Lady Bird Johnson in Austin; pie in the face; Frank Abagngale; Mr. Sock in Keystone; Sloss Furnace in Birmingham; Flamingos in Baltimore; The Fun Nun’s “And You Thought Life Was Not Stressful”; Lois May’s initiation into the “ACUA way” in St. Louis; bus light shows; pep rally at Oakland Annual; paddleboat regatta; sugar packets attached to balloons in San Diego; commandeering a BART in Oakland; Stanford IA winning NACUBO award; disposable cameras; pig pickin’ in Raleigh; Leah shopping everywhere; ACUA Websters intro with Ray Clay, Chicago Bulls announcer; ACUA bus trips; drink tickets – ACUA negotiable instruments; Pat and Eddie show; Dick’s last chance San Antonio; Riders in the Sky in San Antonio; Midnight rodeo San Antonio; heck, everything about San Antonio; Larry Sawyer’s “Auditing Anything Under the Sun”; twist contest winners; C&L’s first and last offer to cover an open bar at Gloucester House; recruiting new ACUA members in Busch Stadium St. Louis; Doe family in Birmingham; starting ACUA-L in 1989 with only nine schools on BITNET “Because It’s There, Because It’s Time Network” (for the youngsters, before the WWW there was only BITNET); 1984 first non-ACUA member speaker at Midyear; Courtanay Thompson’s Fraud Investigation 1984 Las Vegas; UP Chuck; birthday dance at Studebakers Salt Lake City; ACUA theme dances; “I’m an ACUA Dandy”; hairdressers convention St. Louis; Jackson Lake Lodge & Grand Tetons; Germain’s luau Honolulu; Bob Tuffnell, the unofficial “father of ACUA”; Tuffnell’s grass skirt hula at Germain’s; Peabody ducks Orlando; Taking Our Work But Not Ourselves Seriously … most importantly, establishing friendships, some of which become the strongest in your lifetime. Chuck also commented that a speaker told him years ago that anyone can put on a CPE event – you get a speaker, rent a meeting room at a hotel near an airport, fly people in, teach them, send them back to their sleeping rooms in the evening and THAT’S IT! The speaker said what sets ACUA apart from any other organization is that we build family relationships at the same time we are teaching people. Instead of everyone going back to their rooms after the sessions, ACUA gets people together. By doing so, we create lasting relationships with the newer auditors. (continued on page 7) 6 College & University Auditor
ACUA Ambassador Favorite ACUA Memories Seth Kornetsky, My favorite thing about ACUA is having the opportunity to learn something new that is specifically Tufts University applicable to auditing in higher education at every conference I have attended; and that is a lot of conferences over the years! If I have to sum it up, my favorite thing is that ACUA is fun and focused; it’s about higher education Tina Maier, and not broad-sweeping like the IIA. University of Central Florida Ransom McClung, Many of us old-timers and most new members know the ACUA towel, but how many members remember the ACUA pineapple, passed from outgoing president to the new incoming president? Florida State University Remember my first ACUA conference going to breakfast on the first day of the conference where somehow I ended up in the proctor’s buffet breakfast? Attending an annual conference in San Antonio where I again ended up at the wrong breakfast–this time for another organization–then sneaking out before someone did not recognize me. Breakfasts are important to me… Also, when I first joined ACUA many, many years ago, did I look as young as our current first-time attendees? Marsha Murphy, Who could forget the Old Crusty Minstrels? I was a member until it became too much trouble to carry Stanford University a guitar to the conference. One of my favorite conferences was in 2000 where Mary B. and I teamed up to do tattooing at the dance. You could spray paint “ACUA 2000” on your arm, or get a fake tattoo to wear home to a shocked family. And my other favorite conference was Montreal, the conference in a foreign country that the naysayers said nobody would go to, but everyone did. The Jet Boat ride was the most fun event I have ever participated in my entire life. Oh, wait – that was 2000, wasn’t it? Wow, what a great conference. Kevin Robinson, Your challenge: To find Kevin at the next ACUA Conference and ask him! Auburn University My first ACUA Conference was 1992 Orlando Midyear, and since then I continue to believe that ACUA Toni Stephens, is THE best conference for higher education auditors and THE best source of networking and camaraderie University of of any association. Texas at Dallas My personal favorite conference was the 5'1"-short me winning Prom Queen at the 2009 Annual Conference in Minneapolis with the 7'-tall Dick Dawson winning Prom King. We were quite the mismatched pair! Kim Turner, Texas My favorite thing is the camaraderie and friendship ACUA members have. We play as hard as we work when we see each other. Then throughout the year, that camaraderie and friendship translate into support Tech University in many different ways. Whether it’s responding to a request on the L, sharing information at Annual System and MY conferences, giving our time to conduct peer reviews, or serving on ACUA’s board or committees—we support ACUA and each other. My favorite ACUA memories are being crowned “Queen” when I took over as president in 2006 and winning the race (to get one square of toilet paper from the bathroom about half a mile away) against Helen Vanderland in Salt Lake City in 2002. Helen Vanderland, Your challenge: To find Helen at the next ACUA Conference and ask her! Virginia Community College System n
7 College & University Auditor
ACUA Leads! The premier resource for ACUA members for TRAINING training, mentoring, and MENTORING guidance to emerging leaders. GUIDANCE
About ACUA Leads! ACUA Leads! is a year‐long leadership program that provides a framework to develop leadership skills, including communication, strategic planning, performance management, self‐awareness, and innovative problem solving.
ACUA Leads! Benefits
Grow both professionally and personally. Become more aware of your leadership and communication styles. Understand how to build relationships in a collaborative environment. Enhance written and verbal communication skills. Understand the dynamics of change management. Nominations for Cohort III in Discuss emerging issues. 2014 will open September Network with other emerging leaders. 2013! Work one‐on‐one with a mentor. Develop your leadership potential. Interested? Full details are
posted on the ACUA Leads! web page at : http://www.acua.org/CPE_Events/ ACUA_Leads.asp
8 College & University Auditor
How Much Is Higher Education Like a Business?
Part 1: Exploring Internal Auditing Views on Culture and Measuring Achievement By Sterling Roth, CIA, CPA, Chief Audit Officer, Georgia State University
nternal auditing views on culture and measuring achievement differences between higher education and a business could infer how much higher education is like a business. Such views, to my knowledge, have not been previously explored. Of course, innumerable factors, such as types and sizes of institutions and institutional activity, to say nothing of the eyes of the beholders, would be at play. Thus, exploring these views would be challenging as well as new.
About the Author
Sterling Roth, CIA, CPA is the Chief Audit Officer at Georgia State University (GSU). He retired from the U.S. Air Force (AF) as a colonel in 1998, having served as Chief of Pacific Audit Region, Director of AF Financial Management Audits, Director of the Department of Defense Professional Military Comptroller School, and Chief Financial Officer for Air University. He worked for the University of Alabama System at Birmingham and in Huntsville before coming to GSU in 2003. In addition to a Ph.D. in Educational Policy Studies from GSU, he has an MBA from Michigan State University and a BSBA from the University of North Carolina at Chapel Hill, both with an accounting major.
In 2012, I completed a dissertation, “Academic Culture, Business Culture, and Measuring Achievement Differences: Internal Auditing Views,” based on my 2010 survey of 283 doctorate-granting research universities’ internal audit directors. One hundred and forty-four (51%) responded. However, their views on culture and measuring achievement differences are not in this introductory article. They will be addressed in detail in a future article and in my presentation at the ACUA 2013 Annual Conference. For those interested now, my entire dissertation is available at http://digitalarchive.gsu.edu/eps_diss/93/. Because my study addressed only research universities and sought only the views of internal audit directors, extending its inferences to other categories of institutions and respondents would be inappropriate. Furthermore, any inferences must recognize how the terms “culture” and “measuring achievement” were presented and used in my study. Culture: Origins and Definitions Internal auditing has business origins; thus, business may skew internal auditing’s culture. Higher education has business connections, but higher education origins and culture lie in the realm of reason and knowledge. Broadly defined, culture involves cultivation, education, expertise, taste, heritage and convention. More narrowly, organizational culture has been defined as “shared perceptions of organisational work practices within organisational units.”1 Considering the culture of an organization might sharpen internal auditors’ insights, enhancing their ability to add value. Measuring Achievement: Missions and Objectives To address measuring achievement, I used missions on the university side. Research, teaching and public service missions are fundamental to and common among research universities. These missions drive objectives, but the latter likely differ among universities due to their varying initiatives and priorities. I used objectives on the business side. Business missions differ due to the distinctiveness of industries, but foundational objectives, such as making a profit and remaining a going concern, are common to all businesses. Therefore, using missions for a university and objectives for a business focused measuring achievement on what was most essential to and commonly associated with each type of organization. (continued on page 10) 9 College & University Auditor
“The task of a university is the creation of the future, so far as rational thought and civilized modes of appreciation can affect the issue.”
Rationality: Openness and Objective Counsel Mathematician and philosopher Alfred North Whitehead declared, “The task of a university is the creation of the future, so far as rational thought and civilized modes of appreciation can affect the issue.”2 Rationality profits from openness and objective counsel. Counsel from a scholar in another discipline may advance a researcher’s idea, or an administrator’s advice may promote a professor’s academic goal. Likewise, an internal auditor may offer comparable counsel to advance teaching, research and public service missions.
Research Initiatives: The Institute of Internal Auditors and Accounting Academicians The Institute of Internal Auditors (IIA) and accounting academicians addressed internal auditing research early this century. In fact, Whitehead’s above quotation was from the Editorial Preface of The IIA Research Foundation’s monograph, “Research Opportunities in Internal Auditing.” The monograph was intended to inspire accounting academics to do basic and applied research on significant internal auditing topics and to strengthen communication with practicing internal auditors. The preface “acknowledged that the two groups exhibit ‘two distinct cultures’3 and concluded that their contrasting perspectives could produce ‘creative abrasion,’ . . . [from which] the most conceptually sound and robust practical solutions can be developed.”3 Culture differences between higher education and internal auditing could be inferred from the monograph. The accounting academic community, almost always in a business school, would tend to reflect a business culture in its research and in its education of accounting students, the source discipline for most internal auditors. Thus, internal auditors, even in a higher education institution, might tend to reflect a business culture. Outside of the business school, such a culture might sometimes clash with that of the academic community. Of course, academicians and internal auditors have cultural commonalities too, such as valuing and protecting independence and detachment. Accounting professors Dana Hermanson and Larry Rittenberg, moreover, described governance and its effectiveness as culturally dependent and indicated that cultural distinctiveness offered important research opportunities. They emphasized areas where internal auditing could contribute to governance and addressed governance expansively: Governance processes deal with the procedures utilized by the representatives of the organization’s stakeholders to provide oversight of risk and control processes administered by management. The monitoring of organizational risks and the assurance that controls adequately mitigate those risks both contribute directly to the achievement of organizational goals and the preservation of organizational value.4 Management Business schools obviously are about much more than accounting and auditing. Management is a business school fundamental, and management movements and areas of emphasis over the past century and a quarter warrant consideration. Between 1920 and 1940, in keeping with the scientific management and efficiency movements advocated by business, major foundations
Early Management Movements: Scientific Management and Efficiency Called a “mental revolution”5 by its architect, Frederick Winslow Taylor, scientific management was a significant part of educational reform between the 1890s and 1920s. In 1911, Taylor claimed his principles applied “to all social activities: . . . the management of . . . our tradesmen, large and small; . . . our universities, and our governmental departments.”6
sought to increase standard-
Between 1920 and 1940, in keeping with the scientific management and efficiency movements advocated by business, major foundations sought to increase standardization ization in higher education. in higher education. The Rockefeller Foundation and the Carnegie Foundation for the Advancement of Teaching promoted a corporate model for higher education institutions. The Carnegie Foundation would perform a higher education survey of a state and recommend to the legislature and (continued on page 11) 10 College & University Auditor
governor a flagship university and one governing board for all public colleges and universities in that state.7 In 1930, educator Abraham Flexner questioned American universities’ adoption of business methods that ignored “fundamental differences between business and education.”8 He contrasted the former’s focus on profits, charting and tangible resources with the latter’s emphasis on knowledge, understanding and creativity. In some cases, the corporate model promoted practices “antithetical to inspired teaching and original research.”9 Training was often by
Later Management Movement: Managerialism Management professor Robert Locke described managerialism in the U.S. after World War those without a nuanced II as “transcending the needs for the efficient running of commercial and industrial understanding of manage- organizations . . . [with] its influence . . . extending into almost every kind of organization in America, profit and nonprofit, commercial and educational, governmental and military. ment. Managerialism . . . came to exhibit ‘the qualities of caste and cult, authority and belief.’ . . . American management and the mystique it generated . . . denied organizations the means needed to formulate and effectively reach goals.”10 Public Management professor Christopher Pollitt noted that managerialism after the late 1970s led British and U.S. public institutions to embrace “management boards, management training, performance indicators, staff counseling and appraisal schemes.” Training was often by those without a nuanced understanding of management. Principles “pitched at a high level of generality . . . [were] taken for granted as truths.” An abundant literature provided specifics of tasks, techniques and priorities.11 Areas of Emphasis Now: Risk Management, Control and Governance Processes Risk management, control and governance processes have received increasing emphasis over the past decade. Risk, control and governance literature, techniques and tools have filled the marketplace in the wake of the U.S. Sarbanes-Oxley Act of 2002 (SOX), the Public Company Accounting Reform and Investor Protection Act. Although SOX did not apply to government and nonprofit entities, some higher education institutions adopted aspects of it.12 Might internal auditors in those colleges and universities have given inordinate attention to risk management, control, and governance processes at the expense of attention to operational areas essential to institutional success? Perspectives on the Place of Business in Higher Education With higher education missions neither profit-oriented nor easily measured, many scholars and writers have questioned the suitability of business practices for colleges and universities. Historian and educator Jacques Barzun in 1968 asserted that teaching was undeveloped and unappreciated, as academic freedom and tenure were questioned and faith put in research and the practical. He believed Written rules saved time administrators helped professors and others best via controls and communal consent. Written rules saved time and fostered fairness and continuity. Trustees must be skeptical, but not and fostered fairness and enforce business efficiency harmful to a university, whose output was intangible. He continuity. advocated that administration be more centralized, interconnect with every element, possess central funds, inform its provost, free its president to lead, and avoid added complexity. Knowing itself was not enough; the university must help others know it—most simply as an independent institution with dignity and designs on truth, even though the public wanted something more practical and productive.13 Educator and management consultant John Jay Corson in 1975 cited five attributes that led society to turn to universities to meet public service and research needs: capacity and prestige, signal human talent, detachment, rigorous curiosity, and values. Because research and public service have implications, Corson called for these guidelines: protect teaching; avoid sponsor control; and assure quality, significance, openness and consistency with institutional goals.14 Many have also related the value of the university and corporate connection. A 1984 Business-Higher Education Forum report, “Corporate and Campus Cooperation,” asked “the university . . . to direct its energy to corporate ends. . . . In return, universities can expect careers for their graduates . . . and honorary (continued on page 12) 11 College & University Auditor
Therefore, we must always keep in mind that amid differences, there are significant commonalities between a university and a business.
membership in the private sector.”15 More importantly, abundant literature argues persuasively that business principles are vital to higher education’s success. Creativity and innovation, of course, are not confined to the classroom, laboratory or other places in the academy. Business is often the source of both. Creativity and innovation are also part and parcel of entrepreneurialism, which universities teach and advocate. Therefore, we must always keep in mind that amid differences, there are significant commonalities between a university and a business. Internal audit directors’ views of the extent of difference would appear especially useful and credible, given our place at the table in our institutions and our relationship to their boards and audit committees.
Overarching Research Question My overarching research question, which stemmed from this framework for exploring culture and measuring achievement differences, was whether internal audit directors’ views of the extent of difference (a) between their respective institutions’ culture and a business’s culture and (b) between measuring achievement of their respective institutions’ missions and measuring achievement of a business’s objectives were related to how they viewed the priorities and uses of internal auditing at their institutions. Significance of the Study This study was important because of the increasing pressures on universities to be accountable for their performance, financially efficient, technologically advanced, and properly governed.16 These pressures increase the need for independent advice that can add value and improve operations. Internal auditing’s expertise about risk management, control and governance processes along with its systematic, disciplined approach that advances operational and compliance processes can Views of culture and measurhelp respond to these pressures. In the academy, the historical pervasiveness of culture ing achievement differences and the current pervasiveness of measuring achievement make them both opportune for analysis. between universities and businesses might ultimately determine not only how but also whether internal auditing is used in the academy.
University missions, which higher education internal audit directors are professionally and ethically obligated to support, are intertwined with academic culture. Views of culture and measuring achievement differences between universities and businesses might ultimately determine not only how but also whether internal auditing is used in the academy. Exploring these views may be more than new and challenging. It may also be consequential. n
__________________________ 1. P. T. van den Berg and Celeste P. M. Wilderom, “Defining, Measuring, and Comparing Organisational Cultures,” Applied Psychology: An International Review, 53 (October 2004): 570-582. 2. Andrew D. Bailey Jr., Audrey A. Gramling, and Sridhar Ramamoorti, eds., Research Opportunities in Internal Auditing (Altamonte Springs, FL: The Institute of Internal Auditors Research Foundation, 2003), ix. 3. Bailey et al., Research Opportunities in Internal Auditing, xi. 4. Bailey et al., Research Opportunities in Internal Auditing, 27. 5. Claude S. George Jr., The History of Management Thought (Englewood Cliffs, NJ: Prentice-Hall, 1968), 93. 6. Raymond E. Callahan, Education and the Cult of Efficiency: A Study of the Social Forces That Have Shaped the Administration of the Public Schools (Chicago: University of Chicago Press, 1962), 43. 7. John R. Thelin, A History of American Higher Education (Baltimore: The Johns Hopkins University Press, 2004). 8. Abraham Flexner, Universities: American, English, and German (New York: Oxford University Press, 1930), 185. 9. Thelin, A History of American Higher Education, 243. 10. Robert R. Locke, The Collapse of the American Management Mystique (New York: Oxford University Press, 1996), 3. 11. Christopher Pollitt, Managerialism and the Public Services: The Anglo-American Experience (Oxford, UK: Basil Blackwell, 1990), 3-4. 12. Susan Menditto and Jessica Shedd, “On the Transparency Track,” Business Officer, 38 (May 2005): http://www.nacubo.org 13. Jacques Barzun, The American University: How It Runs, Where It Is Going (New York: Harper & Row, 1968). 14. John J. Corson, The Governance of Colleges and Universities: Modernizing Structures and Process (New York: McGraw-Hill, 1975). 15. Sheila Slaughter, The Higher Learning and High Technology: Dynamics of Higher Education Policy Formation (Albany, NY: State University of New York Press, 1990), 186. 16. John L. Lahey and Janice C. Griffith, “Recent Trends in Higher Education: Accountability, Efficiency, Technology, and Governance,” Journal of Legal Education, 52 (May 2002), 528-539.
12 College & University Auditor
Don’t weaken the foundation your campus was built on. Some say students need a new bank account to receive a refund or financial aid disbursement, even though most students already have an account. The Department of Education advises electronic transfers to existing student bank accounts. So do we. If direct deposit to pre-existing bank accounts isn’t the method for the majority of your student refunds, take the time to find out why. The right choice is simple. Learn more about direct deposit refunds at touchnet.com/refunds.
touchnet.com/refunds © 2012 TouchNet Information Systems, Inc. 13 College & University Auditor
Techniques for Auditing Reputation Controls Part I: Fundamental Sources of Reputation Risk By Dr. Bradley W. Brooks, Joe Oringel, CIA, CPA, and Ken Ramaley, CIA
About the AuthorS
Dr. Bradley W. Brooks (left) is tenured Professor of Marketing, McColl Business School, Queens University of Charlotte. He may be contacted at: firstname.lastname@example.org. Joe Oringel, CIA, CPA, (right) is a Managing Director at Visual Risk IQ, an advisory firm specializing in data analytics, visual reporting and continuous auditing. Joe will be presenting at the 2013 ACUA Conference in Norfolk with a session titled “Let’s Get Rolling with Data Analytics and Continuous Auditing.” This session will include a mock audit planning meeting where attendees will jointly plan an audit of one or more business processes specific to Higher Education. He may be contacted at: email@example.com.
Ken Ramaley, CIA, is Managing Director of Ramaley Group, a management consulting firm specializing in reputation risk management. He may be contacted at: firstname.lastname@example.org.
n December 2012, officials from Tulane University’s A.B. Freeman Graduate School of Business reported that they were resubmitting to U.S. News & World Report certain nonfinancial data, including GMAT scores and number of applicants, used to determine the magazine’s graduate school rankings.1 The resubmitted data resulted in Tulane’s removal from the U.S. News & World Report Best Business Schools list and assignment of “unranked school” status through spring of 2014.2 Investigations by Tulane’s outside law firm and auditors indicated the discrepancy was based on systematic over-reporting of these metrics in prior years. Had Tulane recognized this error earlier, it could have avoided the potentially severe damage to its reputation it is now facing. Although such nonfinancial information has typically not attracted the attention of university administrators or auditors, failing to monitor or to proactively manage the reporting of these metrics can significantly damage a school’s reputation. A damaged reputation can have a material effect on a university’s ability to The importance of attract students and to recruit and retain faculty. It could also operational and reputation significantly hinder a university’s fundraising efforts. The importance of operational and reputation risk related to nonfinancial risk related to nonfinancial information warrants increased attention as part of a university’s information warrants risk assessment. increased attention as Forward-looking internal audit departments in many industries are part of a university’s risk now training their auditors to measure reputation and its associated risks. As a special type of organization that relies heavily on assessment. reputation, a college or university could also benefit significantly from such proactive reputation risk management. In this two-part series, the authors will present a rigorous explanation of reputation risk drivers and a practical set of tools for university administrators and auditors to use to incorporate reputation risk into overall planning and execution of their duties. Measuring Reputation Reputation risks have traditionally been relegated to “add-on” status in managing risks. When managers desired an extra reason to emphasize the seriousness of an emerging risk, they could always cite “reputation” without the need for quantifying probability or outcome. In many leadership circles, the proclamation of “reputation risk” would be met with head nodding and grumbles of agreement. But without appropriate measurement techniques, it has been difficult for leaders to make informed decisions to address such risks. Conceptually, reputation seems a straightforward notion. For a university, reputation can generally be defined as “the collective perception of a university’s past actions and results that describe the university’s (perceived) ability to deliver specific outcomes” (Ramaley Group 2012). It is noteworthy that this definition twice incorporates the concept of stakeholder perception. (continued on page 15) 14 College & University Auditor
Examples of stakeholders include – but are not limited to – prospective students, students, student family members, faculty and staff, accreditation bodies, alumni, potential employers, and university donors and boosters. Fundamentally, stakeholder perception, not the university’s reality, will drive reputation. Furthermore, stakeholders utilize their expectations as points of reference in deriving their perceptions. Attempts to operationalize this definition of reputation should be driven by hard data and must incorporate each of these key concepts. Consequently, practical reputation measurement requires understanding a stakeholder group’s expectations for the university as well as that stakeholder group’s perceptions of the university’s reality. The expectations for the university are typically dependent upon the stakeholder group. As the Tulane example demonstrates, prospective students and alumni expect a college or university to exhibit the utmost integrity in reporting data that affect its rankings. An accrediting body might particularly expect a school’s assessments to demonstrate favorable student learning outcomes. Potential employers of the school’s graduates might expect them to be competent in a subject area, effective at communication, etc.
The expectations for the university are typically dependent upon the stakeholder group.
Only by collecting and comparing specific stakeholder expectations and their actual university perceptions can an administrator measure a positive university reputation in which perceived reality (PR) exceeds expectations (E) (PR > E) or a negative reputation in which perceived reality falls short of expectations (PR < E). Understanding a school’s reputation, therefore, requires understanding its specific stakeholder expectations as follows: 1. The importance of particular stakeholder criteria (such as research effectiveness, graduate employment rates, starting salaries, social responsibility, etc.). The key is to consider separately each criterion and its relative importance to the stakeholder group. The importance level serves as a weighting that the stakeholder group assigns to that criterion in evaluating the university. Many academic leaders make the mistake of assuming their school’s reputation is positive based on aggregated measures of reputation (reputation scores). This assumption fails to recognize that various stakeholder groups might differ in how they value specific criteria, yielding inaccuracies when such data are aggregated across groups. Even within a single stakeholder group, if a university were perceived as particularly strong on secondary criteria, but poor on the stakeholder group’s primary criteria, the university might receive a positive aggregated reputation score, despite actually having a relatively negative reputation. 2. Stakeholder expectations on those criteria. Consider what a specific stakeholder group expects to be characteristic of the university on those criteria. Along with understanding these expectations, administrators must gauge whether these expectations are relatively stable or dynamic. If dynamic, then in which direction are the expectations trending? Similarly, the university would also desire to know what the stakeholder group considers desirable and appropriate – which will explain the directional valence of the trends. 3. Stakeholder perceptions of the school’s performance on the specific criteria. Quantifying Reputation Risk After measuring reputation, additional metrics are required to measure reputation risk. Reputation risk can be defined as the risk that reputation (as defined above) could be diminished. Operationally, since reputation is measured as PR-E, reputation will decrease when PR decreases or when E increases. We will first examine the risk of stakeholder expectations (E) increasing, before examining the two most likely ways for perceived reality (PR) to decrease.
Reputation Risk #1: Increasing Expectations (E) Consider, for example, a university whose stakeholders expect it (and others like it) to be environmentally friendly. Such a school could have a positive reputation in the eyes of those stakeholders if it is perceived as meeting or exceeding that “green” expectation (at least [PR-E] = 0, but preferably [PR-E] > 0). The more perceived reality (PR) exceeds expectations (E), the more positive this school’s reputation becomes. This positive reputation will yield benefits; however, it likely will not bestow an enduring advantage to the school. Over the years, American stakeholders have expected increasingly higher standards of environmentally friendly behavior. Should stakeholder expectations of environmental friendliness continue to increase, this university’s positive reputation could be damaged or even eliminated despite no change in stakeholder perception of performance. Such a change in stakeholder expectations almost always derives from external forces, such as competitors, media or changing societal norms. The likelihood of expectations increasing and the potential risk to reputation such increases represent depend on the specific standards on which stakeholders base their expectations. All organizations face this risk to some degree. It is incumbent upon the administrator to assess its significance within a specific university’s context. (continued on page 16) 15 College & University Auditor
Reputation Risk #2: [Perceived Reality = Reality] PR Decreasing When a university has earned a positive reputation through accurate perceptions of its truly exemplary nature, it can become tempted to believe its reputation is secure. The school’s reputation might seem bulletproof since it is grounded in reality. While such a university is in a strong position, its reputation can still be at risk. In addition to the possibility of expectations (E) increasing (as described above), the university also faces the possibility of stakeholders lowering their perceptions of the school (PR). This decline might be deserved when based on actual declines in performance. Such reputation damage can only be remedied through actual performance improvements. (See Reputation Risk #3 below.) Perceptions might also decline even if the school did nothing to warrant such a change. For example, if a university’s environmentally friendly initiatives are not consistently heralded in the media, stakeholders could come to question the school’s green initiatives. Perhaps the school has a rigorous recycling program, but maintains highly publicized relationships with other organizations that do not meet similar standards. Events that publically link the school and these organizations could create an unintended “guilt by association” that leads stakeholders to lower their perceptions of the university’s green efforts. Student protests in particular – whether warranted or unwarranted – often attract media attention that is not easily mitigated. Even without such events, stakeholders might begin to forget about the university’s green efforts if the school does not maintain a deliberate promotional focus. Such a scenario could leave the school vulnerable to stakeholders’ not perceiving it in the same positive light that they once did. Administrators should keep in mind that anytime stakeholders lower perceptions of a university, those perceptions could even drop below the school’s reality – especially when both stakeholder perceptions and reality had been relatively high. To protect against this undeserved reputation damage, a university needs to remind stakeholders of its exemplariness. Every school faces this type of reputation risk, albeit some to a greater degree than others.
Reputation Risk #3: [Perceived Reality > Reality] PR Decreasing Note that reality (R) is not required to match either expectations or perceptions for shaping reputation. Reality only affects reputation to the extent that it affects a stakeholder’s perception of the university. A school can enjoy the benefits of a positive reputation even if it is actually inferior to its perceived reality and to stakeholder expectations (PR > E > R). For example, a university might be perceived as “greener” than what a stakeholder group actually expects, but its reality may be less “green” than those expectations. In such a case, the university would have a positive reputation for being environmentally friendly due to the high perception, but have high reputation risk due to the PR-R gap. By definition, any perceived reality (PR) that is superior to reality (R) implies that stakeholders hold an inaccurate, overvalued perception of a university on some criterion. (Note that reality might be either inferior or superior to expectations in such a case.) Such a school, therefore, would face a special type of reputation risk: the threat of its reputation being damaged because stakeholders discover the university’s true nature. The greater the gap between perceived reality (PR) and reality (R), the greater the risk to university reputation. This type of reputation risk can be more threatening to a school’s reputation than other risks for several reasons: • Reputation damage can happen more quickly and unexpectedly • Stakeholders are more likely to feel they were misled by the university (diminishing trust and making reputation damage more likely to be irreparable) • Reputation damage is more likely to be localized to an individual institution (that is, competitors are less likely to suffer simultaneous reputation damage) The potential damage from such risk is greatest if reality is also inferior to stakeholder expectations (R < E). Stakeholders will likely feel betrayed if an event reveals that the university had been enjoying the perks of a positive reputation (PR > E) when in fact the school had been operating below their expected standards. (continued on page 17) 16 College & University Auditor
Although potentially the most damaging, this type of reputation risk is the most controllable. Accurate measurements of stakeholder perceptions (PR) of the university on key criteria and of the school’s reality (R) on those criteria are critical for managing reputation risk associated with a PR-R gap. Audit Next Steps Understanding these fundamental sources of reputation risk represents a critical first step. The next step is for university administrators and auditors to establish procedures to identify and test controls relative to this type of risk. In Part II of this series, the authors will discuss controls such as scenario planning, tabletop exercises, and even data mining that can be implemented to mitigate these risks, and will demonstrate specific methods that an audit department can employ to provide assurance as to the effective functioning of these controls. n
Understanding these fundamental sources of reputation risk represents a critical first step.
__________________________ 1. http://www.freeman.tulane.edu/statement.php 2. http://www.usnews.com/education/blogs/college-rankings-blog/2013/01/24/update-to-tulane-business-schools-2013-best-graduate-schoolsranking
We speak your language.
“Candor. Insight. Results.” is more than a tagline; it is how we conduct ourselves every day in support of our clients, which include many premier institutions of higher education. Baker Tilly is a full service accounting and advisory firm. We collaborate with internal audit departments to provide surge capacity and address areas of strategic importance, including: > > > > > > >
Risk management Research compliance Construction management Fraud and forensics Sustainable energy Cost reduction Information technology
Our experienced professionals provide practical, proactive, and customized services, and are adept at navigating the complex culture found in universities, research institutions, and teaching hospitals. Connect with us: bakertilly.com/higher-education
Baker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed member of Baker Tilly International. © 2011 Baker Tilly Virchow Krause, LLP
17 College & University Auditor