Having trouble viewing this email? View it in your browser.

Internal Auditing

Case in Point:
Lessons for the pro-active manager

March 2013
Vol. 5 No. 3

The Simpsons
"Logic is the beginning of wisdom, not the end."

-- Leonard Nimoy

Risk Assessment/Mitigation by Homer Simpson

In season seven of the popular show The Simpsons, episode twenty-three had a humorous situation where a bear wondered into the town of Springfield. After the bear was removed Homer Simpson convinced the town's mayor that a ''bear patrol'' was needed to protect the citizens of Springfield. There are a few things we can learn from Homer's thought process and logic.

Homer: Not a bear in sight. The Bear Patrol must be working like a charm.
Lisa: That's specious reasoning, Dad.
Homer: Thank you, dear.
Lisa: By your logic I could claim that this rock keeps tigers away.
Homer: Oh, how does it work?
Lisa: It doesn't work.
Homer: Uh-huh.
Lisa: It's just a stupid rock.
Homer: Uh-huh.
Lisa: But I don't see any tigers around, do you?
[Homer thinks of this, then pulls out some money]
Homer: Lisa, I want to buy your rock.

As we consider managing risk it's important to avoid falling into the trap that Homer did in this episode. Frequently, following some risk management failure or crisis, in a desire to do ''something'' we fall victim to thinking similar to Homer. Often it goes like this: 1. Crisis has occurred so 'we must do something'. 2. This is 'something'. 3. Therefore, we must do 'this'. This logic, especially when wrapped with emotions of a crisis, is easy to fall victim to if we are not careful. Ensuring we look at the root causes of an event and take action to address those root causes is a much better course of action.

Our goal here each month is to stimulate thought and help you be successful in managing risks here at AU. Ultimately, a campus community with a culture of thinking about risks in a proactive manner can be much more important than programs or policies. An educated, proactive risk management culture may well be one of our most important tools in avoiding crisis or scandal. We again invite you to examine the events across higher education and think about ways you can help increase the odd of success.

M. Kevin Robinson, CIA, CFE, CCEP
Executive Director, Internal Auditing

Information Security & Technology Events

Mar. 29, 2013: When a flash drive was left in a computer at Brown Mackie College on Thursday, the contents were viewed to see if the owner could be identified. But what turned up on the flash drive landed one man behind bars. (link)

Mar. 27, 2013: Late last week, Oregon Health & Science University (OHSU) began mailing letters to 4,022 patients informing them that an unencrypted laptop containing their personal data was stolen from an OHSU physician's vacation rental in Hawaii in late February. (link)

Mar. 27, 2013: Companies that use Amazon's popular cloud computing service have accidentally disclosed confidential information including sales records and source code, highlighting the risks of moving sensitive data to the Web, according to new research. Rapid7, a Boston-based security firm, said in a report released today that it found more than 126 billion files posted online belonging to customers of Amazon Simple Storage Service, or Amazon S3, earlier this year. Rapid7 analyzed more than 40,000 of the files, most of which contained sensitive data, the company said. (link)

Mar. 25, 2013: The Miami University police department (MUPD) today charged two former students for breaching university computer systems to electronically change grades for themselves and others. (link)

Mar. 22, 2013: The University of Mississippi Medical Center (UMMC) recently alerted an unknown number of patients that entered the hospital between 2008 and 2013 that password-protected laptop with their data had been lost. The data included names, addresses, dates of birth, Social Security Numbers, diagnoses, medications, treatments and other personal information. (link)

Mar. 22, 2013: Tallahassee Community College, on Friday, announced that an unauthorized acquisition of computerized data that may materially compromise the security, confidentiality, or integrity of personal information occurred in March 2011. (link)

Mar. 21, 2013: A former Cal State San Marcos student accused of stealing the identities and passwords of 745 students to rig campus elections pleaded guilty Thursday to three federal charges. (link)

Mar. 21, 2013: Upperclassmen at Saint Joseph's University's Haub School of Business found out precisely where they stood among their peers when a mass email sent from the dean's office March 6 accidentally included a spreadsheet of their grade-point averages. (link)

Mar. 20, 2013: Many Massachusetts Institute of Technology students received a bogus e-mail early today that referred to the controversy over the late Internet activist Aaron Swartz and said classes had been canceled for the day, the university said. (link)

Mar. 18, 2013: TeamSHATTER reports on data breaches in the higher education vertical throughout the United States. The past year has seen a substantial uptick in the amount of total records breached. In 2012, there was a dramatic increase in the total number of reported records affected (1,977,412), but a relatively low amount of institutions (51) that reported breaches. In fact, the past year has seen the most reported compromised records in the higher education sector since 2006, based on data since tracking began in 2005. (link)

Mar. 15, 2013: Twenty-five thousand current and former staff and student workers at Salem State University may have had their personal information compromised after a virus infiltrated a school database, officials said. (link)

Mar. 11, 2013: A 20-year-old Raymond man is charged with two counts of felony cyberstalking for allegedly threatening Jackson State University President Carolyn Meyers via social media, officials said today. (link)

Mar. 11, 2013: A student who allegedly hacked into the wireless Internet network at Florida State University Panama City and redirected users to a porn site is facing felony charges. (link)

Fraud & Ethics Related Events

Mar. 28, 2013: A longtime Towson University professor has resigned his post as the head of the city school system's ethics panel amid allegations that his published academic articles contain content from dozens of sources without proper attribution. University officials and journal publishers say they are reviewing several articles submitted by Benjamin A. Neil, a legal affairs professor, after a librarian at another university alerted them to the issue. (link)

Mar. 28, 2013: The endless demands on modern academics' time are such that many feel they are doing the work of two people at once. Yet one Canadian academic apparently felt able to perform the roles of two professors 4,000 miles apart. (link)

Mar. 27, 2013: Roxbury Community College released a troubling report today chronicling systemic lapses over the past decade by former and current administrators that caused the school to violate federal campus safety laws and apparently lose track of a significant amount of money. The report, prepared at the college's request by former federal prosecutor Wayne Budd, says senior administrators failed to properly investigate sexual assault allegations against two school employees, apparently paying off one of the accusers, a struggling student, so that she would not pursue the matter further.'' (link)

Mar. 22, 2013: A cheating scandal involving a former member of Harvard University's quiz bowl team has resulted in the revocation of four of its championships. National Academic Quiz Tournaments, LLC (NAQT) announced on Wednesday that it had recently reviewed server logs covering the past several years of tournaments; this review found that four team members from different teams, who were involved in the writing of questions for primarily middle and high school competitions, had improperly accessed information that could have included parts of questions used in the college competitions. (link)

Mar. 21, 2013: A former Northern Illinois University official has pleaded guilty to a misdemeanor for his role in an alleged scheme to sell university scrap materials and deposit the proceeds in a private bank account. (link)

Mar. 17, 2013: In 2009, Union County College President Thomas Brown stood with a group of county officials to cut the ribbon for the opening of school's Elizabeth I. Kellogg building. Inside the gleaming structure was the Thomas H. Brown Center for Business and Educational Advancement, honoring the college's long-time leader. Brown retired Dec. 31, 2010, and now the school is suing him, claiming he was overpaid more than $409,000 over his nearly 20-year career, and knew he was not entitled to the money. (link)

Mar. 13, 2013: Utah State University's former director of enrollment services will spend a year in jail for misusing more than $200,000 of the school's money, much of it earmarked for scholarships. (link)

Mar. 10, 2013: Harvard secretly searched the e-mail accounts of several of its staff members last fall, looking for the source of news media leaks about its recent cheating scandal, but did not tell them about the searches for several months, people briefed on the matter said on Saturday. (link) (link)

Mar. 4, 2013: St. Louis University's interim law school dean is stepping down, saying he made politically incorrect'' statements to faculty and was not a good fit for the position. Tom Keefe, who took over the temporary post in August, said his inappropriate comments -- which included a remark about Indians and another comment perceived as sexual harassment -- were misinterpreted. (link)

Mar. 3, 2013: Chicago State University has been plagued in recent years by scandal, financial mismanagement and poor graduation rates. Its latest public embarrassment came this past week, as President Wayne Watson refused to leave office despite signing a separation agreement that allowed him to exit without any drama. (link)

Feb 28, 2013: "Augusta State" was removed from photos of golfers and other athletes in a marketing publication to promote a new school created when Augusta State and Georgia Health Sciences University merged. Officials at the new school, Georgia Regents University, said Thursday the altered photos were an "error in judgment." (link)

Feb 22, 2013: The idea of yet another administrative process doesn't tend to sit well with college and university officials. Yet, when assessing data that is not included in financial audits--such as admissions criteria, crime reports, retention and graduation rates, and degrees conferred--a thorough review process is integral to the success of an institution and to upholding its reputation. (link)

Compliance/Regulatory & Legal Events

Mar. 28, 2013: The federal government has busted a massive student-loan crime ring, charging 11 people across Metro Detroit with orchestrating a scheme that raided more than $1 million from the government by applying for bogus aid, the U.S. Attorneys office announced today. (link)

Mar. 28, 2013: A contractor for the renovations of a building on the campus of the University of Illinois, was ordered to pay $1.5 million in restitution to the state of Illinois after pleading guilty to two counts of mail fraud. (link)

Mar. 28, 2013: A former Syracuse University athletics department media director admitted today in Onondaga County Court to unlawfully videotaping athletes in sports lockerrooms on several occasions. (link)

Mar. 26, 2013: Guilty: that's how a former Missouri State University employee pleaded on Tuesday to charges of stealing more than a million dollars from the school. The U.S. attorney's office says Mark Brixey, 48, embezzled for more than eight years. The public learned on Tuesday when his scheme started, how it worked, and how much money he took every year. (link)

Mar. 26, 2013: To help tighten security and have personnel at Connecticut state's colleges who can help identify students who may be at risk to themselves or others, lawmakers voted out of committee a bill Tuesday that mandates threat assessment teams on each of the campuses. (link)

Mar. 25, 2013: Do colleges have a right to mandate all students pass drug tests? The American Civil Liberties Union of Eastern Missouri has argued that it's an unconstitutional practice -- and it seems a federal judge agrees in the case of one local college. (link)

Mar. 25, 2013: The Supreme Court announced Monday it would include a Michigan law that would bar public universities from considering race as an admissions factor in its review of affirmative action in higher education. (link)

Mar. 22, 2013: Harvey Updyke has pleaded guilty to poisoning Auburn's famous Toomer's Corner oak trees, reaching a deal with prosecution that will see him spend six months in jail and five years on supervised probation. (link)

Mar. 21, 2013: A former Central Michigan University professor has admitted in open court that he received child pornography, a crime for which he faces at least five years in prison. Prosecutors alleged he had more than 65,000 pornographic images on his computer, some of them showing acts of violence and some with children younger than 12. I never counted them, but I accept that,'' Merrill replied, adding he downloaded at least some of the images in his office at CMU. (link)

Mar. 19, 2013: The Fifth U.S. Circuit Court of Appeals in New Orleans affirmed a decision to deny Cowboy Athletics and Oklahoma State University booster T. Boone Pickens compensation for $33 million spent on a fundraising campaign. (link)

Mar. 19, 2013: A tenured professor at Columbia's Graduate School of Journalism and co-director of that school's business program filed a lawsuit on Tuesday accusing the university of misdirecting $4.5 million in funds over the last decade. (link)

Mar. 16, 2013: Former Texas women's track coach Bev Kearney has filed gender and race discrimination complaints with the Equal Employment Opportunity Commission and the Texas Workforce Commission charging her former employer with using a double standard. (link)

Mar. 15, 2013: An Oakland University student kicked out of school after writing an essay titled Hot for Teacher'' is suing the college for more than $2.2 million, claiming the school violated his rights to free speech and freedom of expression. (link)

Mar. 12, 2013: The investigation that yielded the Freeh report has cost Penn State slightly more than $8.1 million, according to figures the university updated Monday. The total amount Penn State has paid in responding to the Sandusky scandal stands at more than $41 million, when including the first of five $12 million payments toward the NCAA fine and millions in legal bills, public relations firms and other consultants. (link)

Mar. 7, 2013: Grand Valley State University has reached a $40,000 settlement with a student who sued to keep a guinea pig in a campus apartment for emotional support.(link)

Mar. 7, 2013: The U.S. Department of Education will investigate a complaint by several women who say UNC-Chapel Hill improperly handled sexual-assault cases on campus, violating the rights of victims. University spokeswoman Karen Moon said Wednesday that the university would respond appropriately to their requests and cooperate fully.'' (link)

Mar. 6, 2013: A former equipment manager for the University of Texas was found guilty Wednesday of taking inappropriate images of a student-athlete while she dressed in a shower locker room on campus.(link)

Mar. 6, 2013: An Omaha man who was kicked out of the University of Nebraska's law school just months before he was set to graduate is suing the school and others, saying he was discriminated against because of his Arabic heritage and Muslim beliefs. (link)

Mar. 5, 2013: A federal judge has denied Quinnipiac University's request to lift an injunction that had prevented it from eliminating its women's volleyball team, after concluding that changes the Connecticut institution had made in its athletics program in response to a previous order were insufficient to bring it into full compliance with a key federal gender-equity law, Title IX of the Education Amendments of 1972. (link)

Mar. 5, 2013: A man has been arrested after authorities say he was caught stealing copper from a property owned by Clemson University. (link)

Mar. 3, 2013: The University of Louisiana at Lafayette paid a penalty of $38,571 to the U.S. Department of Agriculture after the agency's investigation of the deaths of three primates in 2011 and the injury of a chimpanzee last year at the university's New Iberia Research Center. (link)

Mar. 1, 2013: Thirty-eight former Duke University lacrosse players ended a 2008 lawsuit alleging that the institution lent its credibility to rape allegations against three other team members who were later vindicated. (link)

Feb 28, 2013: University of Utah head swim coach Greg Winslow has been suspended indefinitely following allegations of sexual abuse of a 15-year-old girl while he was a coach of a swimming club in Arizona. (link)

Campus Life & Safety Events

Mar. 28, 2013: Every day, colleges and universities throughout the country, face the challenge of promoting personal responsibility while striving to make their campuses as safe as possible. Efforts to make campuses as safe as possible include adopting and implementing effective steps to address sexual violence, end its reoccurrence and address its effects. Webinar Archive (link)

Mar. 28, 2013: A 20-year-old North Dakota State University student has pleaded guilty to concocting a story about being abducted and raped. (link)

Mar. 27, 2013: A plan to have unarmed students patrolling the campus of Towson University on foot has sparked accusations of racism. The planned patrols are the brainchild of senior Mathew Heimbach, who also happens to head a group called the White Student Union. (link)

Mar. 27, 2013: A student-run New Mexico community college newspaper that was suspended this week after publishing an issue focusing on sex will be allowed to resume publication, school officials announced Wednesday. (link)

Mar. 25, 2013: An alleged sexual assault reported near Auburn University campus last week did not occur, authorities announced Monday. We thoroughly investigated it and it didn't happen,'' said Auburn Police Capt. Tom Stofer, who declined to release the identity of the woman that filed the false report. (link)

Mar. 25, 2013: The tragic situation that unfolded at the University of Central Florida on March 18 – when an ex-student living in the dorms planned a shooting attack on classmates, but ended up taking his own life without killing anyone else – is a little more common than college students and parents realize. (link)

Mar. 26, 2013: Boston College officials are threatening to take disciplinary measures against a group of students who are distributing condoms out of their dorm rooms, calling the act a violation of the university's mission as a Catholic institution. (link)

Mar. 20, 2013: A Salem International University student who terrified classmates by using a fake bomb in a class presentation was free on $5,000 bond Wednesday and will return to court in four to six weeks to answer for the campus scare he says he didn't mean to create. (link)

Mar. 19, 2013: Outraged Oxford university students have called for a librarian to be reinstated after she was fired for letting students make a Harlem Shake video on her watch. (link)

Mar. 18, 2013: Hundreds of students were evacuated from a University of Central Florida dormitory on Monday morning after the police found explosive devices while investigating the apparent suicide of a student, the Orlando Sentinel reported. A campus spokesman told the Associated Press that there was no immediate threat to the campus. (link)

Mar. 17, 2013: Somber athletes, students and school staff hugged and cried in a century-old chapel on the campus of a small Catholic university outside Pittsburgh on Sunday night, mourning the loss of a coach, mother and friend who died a day earlier along with her unborn child when the team's bus crashed on the way to a game. (link)

Mar. 7, 2013: University of Cincinnati student groups are displaying images of female genitalia on the UC main campus today and Friday in protest of previous anti-abortion demonstrations on the campus. The display, titled Re-envisioning the Female Body,'' includes 12 4-by-6-foot images of some female students' genitals. It is being sponsored by the UC Feminist and LGBTQ student groups. (link)

Mar. 7, 2013: Donnie Collins, the 19-year-old transgender student whose fraternity had pledged to help with sex change surgery, will get insurance coverage after all, according to Emerson College. (link)

Mar. 6, 2013: A man who took over a Seattle University law-school classroom Wednesday afternoon and frightened students with his bizarre behavior was later arrested by Seattle police on suspicion of trespassing.Several students said his behavior was so unsettling that they thought he was going to pull a gun or become violent. They also said they were disappointed at the slow response from campus public-safety officers. (link)

Mar. 4, 2013: Prosecutors have upgraded to manslaughter the charges facing former FAMU band members in the hazing death of drum major Robert Champion. They also charged two more ex-band members, Henry Nesbitt, 26, and Darryl Cearnel, 25, in the fatal hazing. (link)

Mar. 4, 2013: Oberlin College is a bastion of liberalism that was one of the first colleges in the country to admit black students and educate men and women together. On Monday, it canceled classes and declared a day of solidarity'' after a person wearing what looked like a Ku Klux Klan outfit was seen near the Afrikan Heritage House on campus. (link)

Other News & Events

Mar. 21, 2013: If colleges and universities were serious about making school more affordable, they could start herding professors back into their classrooms. (link)

Mar. 19, 2013: As states prepare their budgets for the coming year, they face the challenge of reinvesting in public higher education systems after years of damaging cuts -- the product of both the economic downturn and states' reluctance to raise additional revenues. In the past five years, state cuts to higher education funding have been severe and almost universal. (link)

Mar. 16, 2013: The University of Tennessee faced protests here on Friday over its proposal to let a private company drill for natural gas across a forest controlled by the university. (link)

Mar. 15, 2013: A University of Oregon adjunct law professor was arrested Thursday and his teaching duties were reassigned after he aggressively confronted a group of student activists on the Eugene campus Thursday.In a video that has been making the rounds on YouTube and other social media, 58-year-old James Olmsted is seen provoking, shoving and even snatching the cell phone out of the hands of one student. (link)

Mar. 10, 2013: Research fraud, faculty infighting and federal lawsuits have plagued Ohio State University's pharmacy college in recent years. One prominent researcher, who is retiring after disputes with the college's leadership, even called the working environment there dishonorable.'' (link)

Mar. 2, 2013: Washington State, a big public university in farm country that has been raising its own cattle for generations to train veterinarians and farmers, is trying to put a brand name on the college's meat. It shipped the first introductory orders of packed and frozen W.S.U. Premium Beef in January. (link)

If you have any suggestions, questions or feedback, please e-mail me at robinmk@auburn.edu. We hope you find this information useful and would appreciate hearing your thoughts. Feel free to forward this email to your direct reports, colleagues, employees or others who might find it of value. Back issues of this newsletter are available on our web site at https://www.auburn.edu/administration/oacp.

If you have any suggestions for items to include in future newsletters, please e-mail Robert Gottesman at gotterw@auburn.edu.

Back to top

Department of Internal Auditing
Auburn University
304 Samford Hall
M. Kevin Robinson, Exec. Director

© Redistribution of this newsletter, with or without modification, is permitted provided Auburn University Internal Auditing is listed as the source.