Having trouble viewing this email? View it in your browser.

Internal Auditing

Case in Point:
Lessons for the pro-active manager

July 2013
Vol. 5 No. 7

The first issue of Case-in-Point was e-mailed to about 70 employees in various roles at Auburn University on January 15, 2009. Here is what we said in that first issue:

Part of our mission in internal auditing is to promote a control conscious, proactive risk management environment. We believe learning from the control and compliance failures at other institutions can aid this mission and help you better anticipate and proactively manage your risks here at Auburn University.

Each month we will present information from news stories, publications, conferences, personal and organizational networks, etc. to help you stay aware of what is happening at institutions across the country. We will attempt to provide a hypertext link to the source of the information where possible. As you scan these items we suggest that you ask yourself this one question:

"What can I do to prevent this from occurring here?"

The question is still valid and a good one to ask yourself as you scan the events from higher education this month. We hope there is, more often than not, a ''good answer'' to the above question. A ''good answer'' is one that reduces the likelihood that some event or issue will occur; however, sometimes the answer to that question is ''nothing.'' In those cases it is still important to think about ways to reduce impact of the issue and what the response would be if this issue occurs. All of this is part of the proactive risk management culture that can help put the odds of achieving objectives in our favor.

''An ounce of prevention is worth a pound of cure.''

-- Benjamin Franklin

By the way, this issue of Case-in-Point will go to about 700 people involved in higher education throughout North America. We hope you find this monthly communication helpful within your sphere of influence. As always, we welcome your feedback and suggestions.

M. Kevin Robinson, CIA, CFE, CCEP
Executive Director, Internal Auditing

Information Security & Technology Events

July 30, 2013: The University of Delaware (UD) has joined the long line of recent data breach victims, with a compromised university system yielding personal information on 72,000 past and present employees. (link)

July 25, 2013: Stanford University urged network users to change their passwords late Wednesday evening, explaining that it ''is investigating an apparent breach of its information technology infrastructure.'' Randall Livingston, Stanford's chief financial officer, emailed the entire Stanford community, noting that Stanford does ''not yet know the scope of the intrusion.'' (link)

July 24, 2013: Wesley College published more than a dozen records online that revealed the test scores, grades and written critiques of more than 100 students. The Dover-based private college was not the victim of someone hacking into its system. Instead, the records were posted in 2011 by someone at the school in a folder that was not password protected. (link)

July 19, 2013: Cybersecurity firm, HALOCK Security Labs, found that this back-to-school season may be an ideal time for data thieves to steal the personal and financial information of students and parents. HALOCK found that over 50% of the colleges and universities investigated allow for the transmission of sensitive information over unencrypted (and therefore unprotected) email as an option without directly promoting it and 25% of the institutions investigated advised applicants to send personal information, including W2s, via unencrypted email to admissions and financial aid offices. (link)

July 17, 2013: The Social Security numbers of 18,700 University of Virginia students appeared on the address labels of health insurance brochures mailed across the country in the latest in a string of breaches at the state's flagship university. The school provided the numbers along with other information to Aetna Health Care, which sent open-enrollment brochures to students' homes through a third-party mail vendor, officials said. (link)

July 16, 2013: America's research universities, among the most open and robust centers of information exchange in the world, are increasingly coming under cyberattack, most of it thought to be from China, with millions of hacking attempts weekly. Campuses are being forced to tighten security, constrict their culture of openness and try to determine what has been stolen. (link)

July 16, 2013: A former Cal State San Marcos student was sentenced Monday to a year in federal prison for stealing 745 passwords so he could vote for himself for student council president hundreds of times. "I don't know what I was thinking," he told the court. (link)

July 12, 2013: Boston's Suffolk University recently began notifying an undisclosed number of people who used their credit cards to purchase tickets to Suffolk University events that their personal information may have been accessed when ticketing vendor Vendini was hacked in March of 2013. (link)

Fraud & Ethics Related Events

July 24, 2013: Sometime in 2004 Richard C. Vos, the admission dean at Claremont McKenna College, a highly regarded liberal arts school outside Los Angeles, developed a novel way to meet the school president's demands to improve the quality of incoming classes. He would simply lie. (link)

July 23, 2013: A former California community college administrator has pleaded guilty to a fraud charge for stealing more than $45,000 in student-aid money she gave to family members and others. (link)

July 20, 2013: Newly released correspondence shows the faculty leader at UNC-Chapel Hill watered down a report into academic fraud to lessen the chances the NCAA would come back to campus. (link)

July 12, 2013: A San Antonio man, Rodolfo Mata, has pleaded guilty to mail fraud in a case related to the conviction of a former University Medical Center vice president. Mata submitted 15 fraudulent invoices to UMC for ATAM Technology Solutions, causing the hospital to pay nearly $55,000 to the fraudulent company. (link)

June 29, 2013: A 49-year-old journalism student at Pasadena City College is accusing the faculty advisor for the campus newspaper of unwelcome sexual advances that, when turned down, prompted bad grades in retaliation. (link)

Compliance/Regulatory & Legal Events

July 30, 2013: Northwestern University agreed to pay $2.93 million to resolve allegations of grant fraud by a cancer researcher, federal prosecutors in Chicago said. The university allegedly allowed Dr. Charles L. Bennett, then a researcher at its Chicago medical campus, to submit false claims under research grants from the National Institutes of Health, Acting U.S. Attorney Gary S. Shapiro said today in a statement. (link)

July 29, 2013: The University of Cincinnati board of trustees is the latest public body to raise questions by holding private discussions before officially open meetings. (link)

July 22, 2013: The U.S. Department of Education is investigating USC over its handling of alleged sexual assault and rape cases after students filed a complaint with the federal government, officials said Monday. Two current USC students -- both of whom allege being raped -- said at a news conference that their 110-page complaint contains accounts from more than 100 students detailing problems with the university when handling reports of sexual assault. The complaint was filed last spring. (link)

July 23, 2013: The Justice Department announced today that it has reached a settlement with Louisiana Tech University and the Board of Supervisors for the University of Louisiana System to remedy alleged violations of the Americans with Disabilities Act (ADA). The settlement resolves allegations that the University violated the ADA by using a version of an online learning product that was inaccessible to a blind student. (link)

July 22, 2013: In light of the Supreme Court decision in late June to send the affirmative action case brought by the University of Texas back to the lower courts, NYU said that it will continue to take race into consideration when shaping the next student body as the university awaits the effects of the ruling. (link)

July 20, 2013: A panel of the 1st Circuit Court of Appeal in Baton Rouge has upheld a judge's ruling that requires the Louisiana State University System to turn over names of three dozen candidates considered during its presidential search. LSU has refused to release the names while the issue is pending in the courts. (link)

July 18, 2013: Swarthmore College will hire an advocate for victims of sexual violence on its campus as part of a wide-ranging response to a report from an outside consultant evaluating its handling of assaults. The 1,545-student Delaware County campus also will hire a full-time employee to oversee its compliance with federal regulations prohibiting sexual discrimination on campus with that person reporting directly to the president and supported by a team of deputies. (link)

July 18, 2013: Dr. Christian Head, a surgeon at UCLA's medical school, will receive $4.5 million to settle a racial discrimination lawsuit against the UC Board of Regents, the university system announced Thursday. The agreement settles the lawsuit, filed in April, which accused the university of failing to prevent discrimination, harassment and retaliation against Head. The head and neck surgeon alleged that he was retaliated against for filing complaints through normal channels and was denied teaching opportunities. (link)

July 17, 2013: The NCAA announced today it will not renew its contract with the popular Electronic Arts Sports NCAA Football video game, citing litigation costs and the best interests of the NCAA. (link)

July 16, 2013: Dozens of students rallied outside the Department of Education headquarters on Monday morning, many of them wearing their college T-shirts, to deliver a petition with nearly 120,000 signatures demanding that the Department hold colleges accountable in preventing sexual violence on their campuses, as required by federal law. (link)

July 16, 2013: The U.S. Department of Education has opened an investigation into whether Swarthmore College violated federal regulations in its handling of sexual harassment and assault cases on the 1,545-student, Delaware County campus. (link)

July 15, 2013: A University of Connecticut music professor who was placed on paid leave last month is under investigation by police and school officials amid allegations of sexual misconduct with university students and decades-old molestation involving children, including several boys who attended a camp for sick children. Robert Miller worked at UConn for three decades and once led the music department. School employees were notified several times between 2006 and 2011 of allegations that Miller had sexual contact with children, but it wasn't until February of this year that school administrators were told of the claims, according to UConn officials and the state attorney general's office. And it wasn't until last month that Miller was placed on paid administrative leave. (link)

July 15, 2013: Penn State has received the U.S. Department of Education's preliminary report on the university's compliance with the Clery Act that was triggered by the Jerry Sandusky child abuse case, the university said Monday. But the university is bound by law not to discuss the preliminary findings of the review, which began in November 2011, was received Friday and is ongoing, the university said. (link)

July 11, 2013: Attorneys for the families of two UAH professors killed by Amy Bishop in 2010 filed a motion in circuit court Thursday offering evidence they said shows UAH officials knew Bishop was a threat months before the shootings and protected themselves with "concealed police" when they thought she was coming to their offices. But those same officials failed to protect UAH staff as they were required to do, the attorneys claim. (link)

July 9, 2013: Saint Joseph's University, a private Catholic school in Philadelphia, was sued by a student suspended for an alleged rape over claims its sexual-assault policies virtually ensure that accused males will be found guilty. (link)

July 8, 2013: Nineteen former students of a Manhattan high school run by Yeshiva University have filed a $380 million lawsuit against Y.U. accusing administrators and teachers of covering up decades of physical and sexual abuse. (link)

July 5, 2013: UNC-Chapel Hill faces a third federal investigation related to sexual assault complaints. The Office for Civil Rights has said it would open a third probe, focused on Landen Gambill's allegation of retaliation. Gambill, who accused a fellow student of sexual assault, spoke out at rallies about the alleged rape and the university's handling of her case. She was later charged with an honor court offense for intimidating the accused student, whom she did not name but identified as a former boyfriend. (link)

June 29, 2013: A lawsuit that argues Princeton University violates the provisions of its tax-exempt status survived a university-led attempt to throw the case out Thursday. Plaintiffs in the case argue that, because Princeton is earning hundreds of millions of dollars in patent royalty income and is distributing some of that money to faculty, the school is deeply involved in commercial enterprise and isn't entitled to its tax exemptions. (link)

Campus Life & Safety Events

July 30, 2013: The Blue Bike Program, a bicycle rental initiative created to promote sustainable transportation on the University of Michigan's campus, continues to expand. The program, run out of Outdoor Adventures, 336 Hill St., allows university staff, faculty and students to rent bicycles for $5 a day, $10 for a weekend and $75 for the semester. (link)

July 27, 2013: A Willamette University fraternity has lost its on-campus house and recruiting privileges indefinitely over a scandal surrounding the publication of its private Facebook group. The private university's campus erupted in May after students shared a WordPress blog filled with images of Sigma Chi's private Facebook group. The images revealed a series of conversations between members, who used sexually explicit and degrading language about female students and faculty members. The fraternity members also talked about hazing pledges, secret on-campus parties and drinking. (link)

July 26, 2013: University of Louisville staff members are trashing wooden wardrobes believed to be the cause of mold found in three dormitories. No students or visitors are occupying Threlkeld Hall, where mold was found a couple of weeks ago during a routine inspection of its 260 residential rooms, university spokesperson Cindy Hess said. (link)

July 25, 2013: Better snuff that cigarette if you're on Auburn University's campus. University officials announced today they are banning the smoking of all tobacco products campus-wide. The new rule, which takes effect Aug. 21, comes after Auburn officials banned smoking within 25 feet of any university building a year ago. (link)

July 22, 2013: Eight laptops. Five iPhones. Two cameras. Two backpacks. All told, students of the University of Oregon School of Journalism and Communication's Media in Ghana program lost what they estimate adds up to approximately $25,000 in gear and cash last week when an unknown number of burglars broke into their compound in Accra in the middle of the night. (link)

July 22, 2013: It's increasingly common for colleges and universities, like other businesses, to offer the employees they insure incentives for staying healthy. And that makes sense; experts agree it's a lot cheaper to treat illnesses earlier rather than later, or to prevent them altogether. But instead of offering ''carrots'' to its employees for seeking preventive care, Pennsylvania State University starting this fall is opting for the ''stick,'' imposing a $100 monthly surcharge on those who don't meet new health requirements. (link) (link)

July 22, 2013: A student's lawsuit against Pima Community College started going viral last week on conservative blogs and websites, featuring headlines like "War on English Language" and "Student Booted from U.S. College for Favoring English!" The college has denied the charges -- and some observers see the suit as an attack in the education of Latino students, a key constituency for Pima, which is located in Arizona. (link)

July 19, 2013: Police in Waterloo, Ont. arrested a 31-year-old non-student on Thursday and charged him with voyeurism after he was, ''observed using a cell phone to take video of unsuspecting females as they used a staircase on the campus.'' It wasn't an isolated incident at Waterloo, nor are ''peeping toms'' rare on Canadian campuses. During the last school year there were at least half-a-dozen media reports of men filming, photographing or otherwise spying on female students from New Brunswick to British Columbia. (link)

July 16, 2013: So you want to prevent your soon-to-be college freshman from drinking in college. A Penn State study out this year shows that talking about the realities of underage drinking can help - as long as you do it now. Freshmen whose parents initiated at least one conversation about drinking during the summer before college were more likely to have healthy college drinking habits than those whose parents waited until fall to have the talk or didn't do it at all. (link)

July 9, 2013: Duke University administrators are agreeing to stiffen the penalty for students who are found guilty of sexual assault. A board that sets the standards for the Office of Student Conduct has revised the university policy so that expulsion is the ''preferred sanction'' in cases of sexual crimes. (link)

July 9, 2013: A fire that killed a student in a Saddleback College classroom in Orange County was set deliberately, authorities said Tuesday. The fire broke out about 6:30 a.m. Monday in a third-floor auditorium in the college's Business/General Studies building, school officials said. As firefighters battled the flames, which scorched much of the classroom's interior, they found a 21-year-old male student lying unconscious on the floor, said school spokeswoman Jennie McCue. (link)

July 2, 2013: Former University of Utah swim coach Greg Winslow should have been fired as early as July 2011 because of ongoing problems due to alcoholism, and not necessarily because of the alleged physical and psychological abuse suffered by his swimmers, according to a new report. A three-month investigation paid for by the university found that Winslow used "fear and intimidation" that may have amounted to psychological abuse for some of his swimmers. (link)

June 29, 2013: St. Augustine's University said Friday it has reassigned two convicted killers following revelations that they were working with a children's summer camp hosted by the school. (link)

Other News & Events

July 25, 2013: The highest achieving teenagers are more likely to attend college farther away from home, according to a new study by standardized testing giant ACT. The greater a teenager's academic achievements, the likelier he or she is to put more distance between home and college. According to the ACT's research, 2012 high school graduates who took the ACT college readiness exam attended college a median distance of just 51 miles from their home. (link)

July 18, 2013: Colleges and other nonprofit organizations that want to persuade people in their 20s and early 30s to give and volunteer don't have much of a chance if they're not updating their Web sites frequently and including compelling details about their causes and the people they serve, according to a survey released on Thursday. (link)

July 15, 2013: According to Alabama Commission on Higher Education data, nearly a third of first-year college students end up taking remedial reading or math classes. A sizable percentage must take both. (link)

July 15, 2013: The University of Michigan is expected to begin offering in-state tuition to undocumented students who can prove they graduated from a Michigan high school and attended at least some middle and high school in the state. (link)

July 14, 2013: Florida Atlantic University has a plan to avoid repeating the fiasco that's been dubbed "stomp on Jesus." It involves improved faculty training and discussions on civility and academic freedom. But the plan, part of FAU's formal response to a concerned Gov. Rick Scott, stops short of an earlier pledge by former FAU President Mary Jane Saunders to never use the classroom exercise again. (link)

July 10, 2013: It was the biggest, most expensive, most audacious building ever conceived at Amherst College, a terraced glass-and-steel science center nestled into a hill, designed by a celebrated architect. But now, it is a $19 million mistake, never to be built. (link)

July 2, 2013: A majority of the faculty in the English department at Virginia Military Institute has resigned as a result of disagreements that stemmed from a change in curriculum, a VMI spokesman said. The Chronicle of Higher Education reported today that seven faculty members have quit and another will soon after filing a complaint accusing leaders of the department of creating a hostile work environment. (link)

July 1, 2013: Senior academic leaders at Howard University have charged that ''fiscal mismanagement is doing irreparable harm'' to the school in Northwest Washington and urged the dismissal of Howard's chief financial officer, asserting that his actions have put its survival at risk. Howard's Council of Deans alleged that staff cuts at the university have been based on ''inaccurate, misleading'' data, lamented a decline in research expenditures and contended that a ''burdensome'' tuition increase has driven away students. (link)

If you have any suggestions, questions or feedback, please e-mail me at robinmk@auburn.edu. We hope you find this information useful and would appreciate hearing your thoughts. Feel free to forward this email to your direct reports, colleagues, employees or others who might find it of value. Back issues of this newsletter are available on our web site at http://www.auburn.edu/audit.

If you have any suggestions for items to include in future newsletters, please e-mail Robert Gottesman at gotterw@auburn.edu.

Back to top

Department of Internal Auditing
Auburn University
304 Samford Hall
M. Kevin Robinson, Exec. Director

© Redistribution of this newsletter, with or without modification, is permitted provided Auburn University Internal Auditing is listed as the source.