Having trouble viewing this email? View it in your browser.

Internal Auditing

Case in Point:
Lessons for the pro-active manager

March 2012
Vol. 4 No. 3
“We are too busy mopping the floor to turn off the faucet.”

-- Unknown

Goal (noun) - the result or achievement toward which effort is directed; aim; end.

Objective (noun) - something that one's efforts or actions are intended to attain or accomplish; purpose; goal; target: the objective of a military attack; the objective of a fund-raising drive.

Institutions have multiple goals and objectives. They come in all sizes and various forms from the big picture objectives, usually found in strategic plans, to the more micro-level objectives of processing a transaction accurately. There are many ''things'' that can get in the way of accomplishing goals and objectives. We call these ''things'' risks.

Just look at a quick overview of what has happened in our industry over the past month: laptop thefts, accidental data exposure, rabid bats, viral videos, conflicts of interest, lost equipment, Clery Act questions, gambling, fraud, discrimination, social media rights, hazing, animal deaths, campus violence, and many more. What's worth noting is that most of these items (maybe not rabid bats) are repeated each month in this publication.

Risks that are not managed proactively, at least in many cases, become a crisis an institution has to manage. Our purpose of sharing these events is to encourage you to think about your unit's goals and objectives and what ''things'' can get in the way of you accomplishing them. Crisis management virtually always costs more than proactive prevention. We certainly won't be perfect in preventing every problem from happening, but we believe it is worth your time to consider your most relevant risks and then develop a plan to reduce risk.

M. Kevin Robinson, CIA, CFE, CCEP
Executive Director, Internal Auditing

Information Security & Technology Events

Mar. 28, 2012: Howard University Hospital says a former contractor's personal laptop containing patient information was stolen in January. The hospital sent letters this week to more than 34,000 patients affected by the breach. (link)

Mar. 22, 2012: The personal information of tens of thousands of University of Tampa students, past and present, may have been put at risk. Three data files were accidentally made accessible to the public. Those files included Social Security numbers, and University of Tampa identification numbers. (link)

Mar. 14, 2012: The personal information of hundreds of international students at BYU was inadvertently released by email Monday. The message was sent by a staff member in the University Advisement Center who was sending out a notice of a career workshop, but a complete list of students' names, email addresses, phone numbers and student ID numbers was attached. The message included the personal information of all 1,300 international students and was sent to those 1,300 students. (link)

Mar. 12, 2012: It is no secret that U.S.-based institutions of higher learning have suffered their fair share of data breach ‘madness’. So, last year TeamSHATTER started an annual tradition and takes a fun look at which higher education institutions would make the ''Data Breach Final Four.''(link)

Mar. 12, 2012: A Livingstone College student is charged with taking 20 laptop computers from the school. (link)

Mar. 8, 2012: Central Connecticut State University officials say a computer security breach in November that exposed the Social Security numbers of more than 18,000 past and present students, faculty and staff was worse than they thought. (link)

Mar. 7, 2012: A spreadsheet with names, G.P.A.s and contract information of 184 Lindenwood University students on academic suspension were posted to Twitter by an account called, @LindenLeaks. (link) (link)

Mar. 7, 2012: McGill University has succeeded - for now - in shutting down a website that had exposed confidential and personal information about McGill donors, embarrassing the university and raising questions about the security of private information. (link)

Fraud & Ethics Related Events

Mar. 22, 2012: Chicago State University has been unable to locate $3.8 million worth of equipment, including 950 computers that could contain confidential information, according to a state audit. The audit also found problems with scholarship awards, lax contracting oversight, overspending a federal grant and improper spending on a New Orleans tour. (link)

Mar. 16, 2012: Cal State San Marcos canceled its student government election after police arrested Matt Weaver ---- one of two candidates for president ---- saying he tampered with election files on a university computer. (link)

Mar. 12, 2012: A complaint filed with a Maryland auditor alleges the president of the University of Maryland, University College wasted tax dollars on ''hush money'' payments to administrators and professors so they wouldn’t talk after being forced out of the institution. (link)

Mar. 12, 2012: A longtime UC Berkeley administrator has been demoted and docked in pay for improperly giving several raises to an employee with whom she was having a sexual relationship -- but she will still make $175,000 a year. (link)

Mar. 8, 2012: Before retiring last summer as president of the University of Minnesota, Robert Bruininks repeatedly steered money to a tiny leadership center within the Humphrey School of Public Affairs where he will spend the next phase of his U career. Records show that Bruininks, who will earn a $341,000 salary in his new faculty role there, directed at least an additional $355,000 in university funds to the Center for Integrative Leadership since 2009. (link)

Mar. 7, 2012: A 45-year-old former employee of the online Western Governors University has pleaded guilty to stealing more than $500,000 from the school. (link)

Mar. 7, 2012: A Weber State University employee has been arrested by campus police on suspicion of stealing $600 to $700 from the Shepherd Union. (link)

Mar. 1, 2012: A University of Minnesota police employee is accused of stealing hundreds of library books, and then selling them for thousands of dollars on the internet. Investigators say most of the books that went missing are from the Diehl Hall Biomedical Library. The accused employee worked security there. (link)

Feb. 29, 2012: Madison Area Technical College's former controller was charged Tuesday with stealing more than $34,000 from the school between 2004 and 2007 by writing checks to himself from the college's coffers. (link)

Compliance/Regulatory & Legal Events

Mar. 29, 2012: Two faculty members at Florida A&M University accused of being present during an off-campus hazing in 2010 involving members of the school's famed marching band were placed on administrative leave with pay on Wednesday.Two faculty members at Florida A&M University accused of being present during an off-campus hazing in 2010 involving members of the school's famed marching band were placed on administrative leave with pay on Wednesday. (link)

Mar. 28, 2012: The sponsor of a bill that would bar illegal immigrants from attending Georgia's public colleges said he supports an amendment striking that provision from Senate Bill 458. (link)

Mar. 28, 2012: One of the largest student religious groups at Vanderbilt will be leaving campus at the end of the year in a dispute over the university’s nondiscrimination policy. (link)

Mar. 28, 2012: A Long Island district attorney on Tuesday announced that the College Board and the ACT had agreed to tighter security measures for those taking the SAT and the ACT. Nassau County authorities have charged 20 people with involvement in schemes in which supposed test-takers paid others to take the SAT for them. Among the new rules. (link)

Mar. 24, 2012: More than a decade before former Penn State coach Jerry Sandusky was charged with more than 50 counts of child sex abuse, a psychologist warned university police that his actions fit that of a “likely pedophile’s pattern.” (link)

Mar. 22, 2012: A college student in New Jersey will go to court to fight an allegation that he stole a cup of ice from the school cafeteria.(link)

Mar. 21, 2012: In an unusual move, faculty leaders at the City University of New York filed suit on Wednesday in state court to block CUNY from putting in place its new core curriculum. The plaintiffs, who are the heads of the Professional Staff Congress and the University Faculty Senate, argue that CUNY exceeded its authority in determining curriculum when it failed to follow bylaws and faculty-governance procedures. (link)

Mar. 20, 2012: In response to an appeal by the university, a federal administrative judge has issued an order reducing a proposed Department of Education fine to Washington State University from $82,500 to $15,000.
Originally issued in August 2011, the fine resulted from a U.S. Department of Education review that concluded that WSU in 2007 committed violations of the Clery Act. (link)

Mar. 19, 2012: In just about every way, Kaeden Kass is a typical college guy. But his birth certificate identifies him as a female. The Miami University student is fighting school officials for not allowing him to serve as a resident assistant in an all-male residence hall. Instead, he was offered a position in a suite living with female students. (link)

Mar. 19, 2012: Three people who say they were molested by a former cadet at The Citadel filed six lawsuits on Monday, taking the military school to task for allegedly failing to report complaints against the former student. (link)

Mar. 16, 2012: A jury convicted a former Rutgers University student, Dharun Ravi, of hate crimes for using a webcam to spy on his roommate kissing another man in their dorm room. (link)

Mar. 14, 2012: For the way Virginia Tech handled the mass shootings on its campus five years ago, the university has faced investigations by state and federal agencies and an enduring trial in the court of public opinion. On Wednesday, the first jury to examine the events of April 16, 2007, ruled correspondingly: It found the university negligent for not issuing timelier warnings of an active threat and awarded large sums to two families whose daughters were killed. (link)

Mar. 8, 2012: Two sources told Yahoo! Sports the Auburn basketball coaching staff became aware of possible point-shaving when a player raised concerns with an assistant coach in late February. After the coaching staff was alerted, the school contacted both the FBI and the NCAA. (link)

Mar. 7, 2012: A pending lawsuit against the University of Wisconsin System may determine whether professors must disclose their course syllabi under the state's Open Records Law or whether the material is exempt under copyright law. (link)

Mar. 6, 2012: Florida State University has resolved a lawsuit that was brought by two blind students who accused the university of discrimination due to inaccessible technology. Under the settlement, the university agreed to pay each student $75,000 and ''to continue its efforts to make courses accessible to all students,'' according to a news release issued by the National Federation of the Blind, which helped the students bring their lawsuit last summer. Florida State did not admit liability or wrongdoing. (link)

Mar. 1, 2012: University of North Dakota teams risk forfeiting any post-season games if their athletes, cheerleaders or band wear or display the school’s Fighting Sioux nickname and American Indian head logo, an NCAA official said Wednesday. (link)

Mar. 1, 2012: The interim director of Harvard’s New England Primate Research Center, who was appointed in September after an internal investigation found patterns of problems at the center, announced his resignation in an e-mail sent early this morning. The news comes in the wake of the disclosure Wednesday that a cotton-top tamarin monkey had died, and that its death was likely linked to the absence of a water bottle in its cage. It was the fourth monkey death at the center in less than two years, and the third death during Dr. Fred Wang’s short tenure as interim director. (link)

Feb. 29, 2012: The state auditor's office has found significant problems in how 11 state colleges and universities follow federal rules governing the handling of student aid money. (link)

Feb 27, 2012: A Purdue University professor is welcoming the end of an investigation that could have ended his career. Calumet campus political scientist Maurice Eisenstein faced an investigation into nine complaints of discrimination and harassment mostly over comments he is alleged to have made in the classroom, some stemming from discussions about Islam. (link)

Campus Life & Safety Events

Mar 28, 2012: An Indiana University student bitten by a rabid bat while he slept in his Bloomington dorm room is receiving rabies shots. His roommate and a pest control worker who transported the bat also are receiving the 14-day regimen of shots. (link)

Mar. 22, 2012: A video of a student in a class at Florida Atlantic University in Boca Raton going "ballistic" has gone viral. It happened Tuesday afternoon during a class on evolution. On the video, shot by a fellow student on their cell phone, Jonatha Carr lashes out at her professor and other students. She uses profanity and said things like "white people suck." (link)

Mar. 21, 2012: A Boston College football player was charged Wednesday with illegally audiotaping a consensual sexual encounter between a fellow player and a female graduate student in a campus suite the players shared. (link)

Mar. 19, 2012: Student activity fees have been a point of contention on college campuses for years. Lawsuits proceeding as far as the Supreme Court have challenged whether the fees can fund political or religious groups. (link)

Mar. 14, 2012: Things have only gotten messier at Dartmouth College in the weeks since a former fraternity brother went public with hazing allegations involving swimming in and swallowing vomit. (link)

Mar. 12, 2012: A University of Maryland student was arrested and taken for psychiatric evaluation after posting threats about a shooting rampage that would "make it to the national news," the school said. (link)

Mar. 10, 2012: A Miami college student accused of posting threats against President Barack Obama on Facebook has pleaded not guilty. (link)

Mar. 8, 2012: Two people were killed in a shooting at a psychiatric institute at the University of Pittsburgh Medical Center on Thursday, and one of the dead was believed to be the shooter, the hospital said. (link)

Mar. 3, 2012: As a suspected gunman walked across Towson University, officials sent an emergency notification through text alert, email and Twitter to some 25,000 students and faculty, warning them of the man's whereabouts and advising them to "stay in a safe location." The situation ended peacefully. The "gunman" was a student carrying a theater prop (link)

Mar. 2, 2010: A New York woman has filed a lawsuit against her former Roman Catholic college in Boston, claiming administrators didn't do enough to help her when she complained that her roommate was having too much sex in their dorm room. (link)

Mar. 2, 2012: The University of Montana could have moved more quickly when a student told a dean on Feb. 17 that a fellow student had drugged and raped her a week earlier, UM President Royce Engstrom told the state Board of Regents Thursday. (link)

Mar. 1, 2012: A 24-year-old former UTC student pleaded guilty to charges he burglarized four dorm rooms and planted hidden cameras in clocks inside the rooms. (link)

Other News & Events

Mar. 23, 2012: Has an employer or potential employer ever requested access to your Facebook account? If so, Facebook itself advises you to just say no. Responding to growing complaints from employees over the practice, Facebook made its own position quite clear in a post published today. Noting an increase in the number of such requests from employers, the social network said they undermine both the security and the privacy of the user and the user's friends. (link) Today (Mar. 25, 2012) U.S. Sens. Richard Blumenthal (D-Conn.) and Charles Schumer (D-N.Y.) called on two federal agencies -- the Department of Justice and the Equal Employment Opportunity Commission -- to investigate what they call a "new disturbing trend" of prospective employers demanding job applicants to turn over user names and passwords for their social networks. (link)

Mar. 21, 2012: The Board that oversees Florida’s public universities says the state’s budget for the upcoming year could hurt the school’s bond ratings. (link)

Mar. 15, 2012: Rowan University, whose stature would rise dramatically under Governor Christie’s plan to give it control of Rutgers University’s Camden campus, excluded the scores of disadvantaged students in a public document that made its SAT results appear to be a whopping 100 points higher than scores at Rutgers. (link)

Mar. 13, 2012: To hear some parents, students and faculty members tell it, Stony Brook University’s new academic calendar in September is withdrawing the “welcome” mat to Jewish students. University officials insists, however, that its decision to no longer close school for major Christian and Jewish holidays is simply leveling the playing field. (link)

Mar. 10, 2012: Alabama is losing $2.1 million in federal higher education funding as a penalty for cutting state support for colleges and universities too much. (link)

Mar. 2, 2012: Coach Urban Meyer, head coach of the Ohio State University football team, has issued a letter of apology to Scarlet & Gay, the Gay, Lesbian, Bisexual, and Transgender Alumni Society of Ohio State. Responding to a letter sent Wednesday by the president and vice-president of Scarlet & Gay, Meyer stated that the practice of having under-performing student athletes wear purple-mesh jerseys “was never intended to be used to offend anybody.” He continued to cite that the core values of respect and honor were cornerstones within the program Meyers offered and that he offered the program’s “sincere apologies.” (link)

Feb. 29, 2012: Northeastern University said yesterday that a Chick-fil-A fast-food restaurant will not be coming to campus, after the college’s student government denounced the chain amid reports that it supports groups opposed to gay and lesbian rights. (link)

If you have any suggestions, questions or feedback, please e-mail me at robinmk@auburn.edu. We hope you find this information useful and would appreciate hearing your thoughts. Feel free to forward this email to your direct reports, colleagues, employees or others who might find it of value. Back issues of this newsletter are available on our web site at https://www.auburn.edu/administration/oacp.

If you have any suggestions for items to include in future newsletters, please e-mail Robert Gottesman at gotterw@auburn.edu.

Back to top

Department of Internal Auditing
Auburn University
304 Samford Hall
M. Kevin Robinson, Exec. Director

© Redistribution of this newsletter, with or without modification, is permitted provided Auburn University Internal Auditing is listed as the source.