Having trouble viewing this email? View it in your browser.

Office of Audit, Compliance & Privacy

Case in Point:
Lessons for the proactive manager

April 2016
Vol. 8 No. 3
“To sin by silence when they should protest makes cowards of men.”

-- Abraham Lincoln

This month we continue our review of Case in Point stories from 2015 with a focus on what has been the largest category for the past few years: ''Compliance/Regulatory & Legal.'' As we've noted in prior issues, the compliance burden has grown substantially over the past few years in higher education, and it has certainly impacted the way institutions approach ensuring compliance.

There are seven best practices for organizational compliance. Ironically, these items come from the US Federal Sentencing Guidelines, which could come into play if an organization has a substantial compliance failure. Major universities are now evaluating their compliance approach to ensure these best practices are in place within their institutions.

One of the seven best practices is typically titled ''Response & Prevention.'' This is where every employee has a role to play. When any of us become aware of an issue, it is important that we take appropriate action to address the concern. We no longer live in a world where awareness without action is acceptable. Therefore, it is important for you to understand the major compliance issues for higher education and let someone know if you are aware of a potential issue.

As we evaluated the Compliance/Regulatory & Legal stories from 2015, it was striking how diverse the issues were that we are currently facing. It was so diverse, in fact, that we had trouble actually coming up with a simple top 3 or 4, as many stories included multiple compliance risks. Issues ranged from national security regarding technology/research, how donations are used, labor laws, background checks, guns on campus, tax issues, patent litigation, criminal charges with respect to hazing, litigation regarding the handling of mental health issues (i.e. did the institution do enough?), wrongful termination, free speech issues, data breach notifications, False Claims Act, and many more.

We did note one topic that appeared more frequently than others in this category: the overall theme surrounding sexual assault, violence, and campus climate. From a compliance standpoint, many (if not most) of these issues fall under Title IX. Ensuring everyone knows where to direct any concerns of this nature is vitally important. Here at Auburn University these concerns are reported to our Title IX Office.

The key takeaway from this month's topic is to trust your instincts and let someone know if you think there is a compliance problem or risk not being adequately addressed. You are always welcome to discuss those things with us here in OACP.

We again ask you to review the events reported across higher education and consider how you proactively help our institution manage risks. We welcome any feedback regarding this or other topics.

M. Kevin Robinson, CIA, CFE
Associate Vice President
Office of Audit, Compliance & Privacy

Information Security & Technology Events

Apr 25, 2016: A denial of service attack shut down the University of Georgia's web sites Sunday evening, but as far as investigators were able to determine, no university systems or data were compromised by the attack, said UGA Vice President for Information Technology Tim Chester. According to an email distributed to UGA email users, the attack began shortly after 6 p.m. and lasted until about 10 p.m., when UGA and the consortium that provides Internet connectivity were able to begin blocking the attack, which ended soon afterward. As Chester explained in his email, a "distributed" denial of service attack is when traffic from any IP addresses outside a network flood UGA's network with enough digital traffic to use up UGA's entire bandwidth allocation from the Southern Crossroads consortium, run by Georgia Tech. The consortium includes major universities and other institutions in Georgia and five other Southeastern states. While the attack lasted, no one on campus could get on the Internet. (link)

Apr 13, 2016: Rockhurst University on Wednesday notified about 1,300 employees that someone had stole personal information from their IRS W-2 forms through a data breach. The theft, which includes Social Security numbers, occurred April 4 and was discovered April 6. None of the victims has reported any loss from the phishing incident, school officials said Wednesday. Rockhurst says the breach occurred when someone impersonating a university administrator requested W-2 information and provided a bogus email address. (link)

Apr 12, 2016: At least 600 current and former Stanford employees are vulnerable to tax fraud following the illegitimate download of their W-2 forms through a third-party service. The security breach is presumably responsible for a rash of tax scam cases disclosed to Stanford, starting on April 1. As of April 7, 23 Stanford employees had reported phony tax filings to the University for this year. That number is still growing as more employees file their taxes, although it remains under 100, according to Stanford spokesperson Lisa Lapin. Lapin could not give a more specific number. A perpetrator or group of perpetrators had used hundreds of Stanford employees' Social Security numbers and dates of birth to download W-2 forms from the vendor W-2Express, which the University uses to make tax forms accessible online. (link)

Fraud & Ethics Related Events

April 27, 2016: Citing ''serious questions'' about whether UC Davis Chancellor Linda P.B. Katehi violated policies on employment of her family members and the use of contracts to remove negative information from the Internet, UC President Janet Napolitano placed Katehi on leave Wednesday night pending the outcome of ''a rigorous and transparent investigation.'' (link)

Apr 22, 2016: A Pennsylvania man who allegedly schemed with former officials at Caldwell University was charged Thursday with plotting to defraud a program that funded the education of veterans who served in the armed forces following the Sept. 11, 2001 terrorist attacks. According to a criminal complaint, the fraud involved tricking veterans into thinking they had enrolled in accredited university classes when they actually were taking courses developed and taught by an online correspondence school. David Alvey, 49, is charged with one count of conspiracy to commit wire fraud, Fishman's office said. Alvey is the first individual to be charged in the alleged scheme, Fishman's office said, adding that the investigation is ongoing. (link)

Mar 29, 2016: Essex County College's president has been removed from her position amid a mysterious probe into alleged misuse of the school's resources, officials have revealed. Dr. Gale Gibson received a letter from the college's Board of Trustees Friday advising her she had been suspended while the board discussed the unspecified accusations, according to her attorney Alan Zegas. Gibson, who is currently on vacation outside the country, will continue to earn her approximately $295,000 annual salary. Details of the allegations that led to her removal, however, remain shrouded in secrecy. (link)

Compliance/Regulatory & Legal Events

Apr 26, 2016: Ten immigrants who have received a reprieve from deportation filed another suit in Fulton County Superior Court Tuesday, seeking once again to force the Georgia Board of Regents to allow them to pay substantially lower in-state college tuition. (link)

Apr 25, 2016: North Carolina has received a new document from the NCAA outlining violations connected to the school's long-running academic fraud scandal. UNC will release the NOA as soon as possible, but there is no timetable yet, according to media relations director Steve Kirschner. The arrival of the new Notice of Allegations jumpstarts a case that has been stalled in a procedural limbo since August. UNC hasn't made a formal statement about the second notice's arrival. UNC's academic case centers on independent study-style courses that required no class time and one or two research papers in the formerly named African and Afro-American Studies department. Run largely by an office administrator -- not a faculty member -- the courses featured GPA-boosting grades and significant athlete enrollments across numerous sports, while poor oversight throughout the university allowed them to run unchecked for years.. (link)

Apr 22, 2016: The U.S. Department of Justice Friday announced that the University of New Mexico's handling of sexual harassment and assault reports by students does not comply with federal law and said many students are reluctant to report such matters because they lack confidence in the school's response. The Justice Department had investigated the university since December 2014 after a series of on-campus incidents and looked at UNM's policies and practices for preventing sex crimes and for investigating and responding to students' complaints. The report from the DOJ's Civil Rights Division and Educational Opportunities Section, which was delivered to UNM President Robert Frank Friday, says that despite "strengthened" programs and responses to the issues, the university remains out of compliance with Title IX and Title IV. (link)

Apr 19, 2016: A Brigham Young University student has filed a federal complaint against the school for putting her on academic hold and failing to help her withdraw from classes after she reported being raped to police. Madi Barney, an undergraduate at BYU in Provo, Utah, told The Huffington Post she filed her Title IX complaint with the U.S. Department of Education's Office for Civil Rights on Monday. Barney reported to city police in September 2015 that she was sexually assaulted off-campus by Nasiru Seidu, a 39-year-old man who is not a BYU student and who is expected to face trial later this year over the rape charges. Although Barney says she did not report what happened to BYU, the school contacted her in late November after getting a copy of a police report related to her case. In an email obtained by HuffPost, the school told Barney the police report provided "information that you have engaged in behavior that violates the BYU Honor Code." (link)

Apr 14, 2016: The family of Cal football player Ted Agu, who died after a team drill in 2014, and the University of California settled a wrongful-death lawsuit for $4.75 million, bringing months of negotiations and litigation to a close, the two sides said Thursday. Agu, a defensive lineman and premed student, died at age 21 shortly after an off-season conditioning workout outside Cal's Memorial Stadium. His parents sued the university, saying their son should have never been placed in such a strenuous workout because he carried sickle cell trait, a blood abnormality that experts believe can lead to death under extreme exertion. Cal doctors and coaches knew of Agu's condition since he redshirted his freshman year in 2010. The settlement comes nearly three months after the university admitted liability for the death. (link)

Apr 12, 2016: Illinois has reached financial settlements totaling $625,000 with former football coach Tim Beckman and seven former women's basketball players, the university said in separate news releases Tuesday. Beckman was fired a week before last season kicked off after allegations of player mistreatment arose and an investigation by a university-hired law firm confirmed many of the claims. The seven former women's basketball players -- Amarah Coleman, Alexis Smith, Taylor Tuck, Nia Oden, Sarah Livingston, Taylor Gleason and Jacqui Grant -- will receive $375,000 to be distributed among them. They filed a $7 million lawsuit in July alleging the coaching staff had racially discriminated against them and violated their civil rights. (link)

Apr 11, 2016: A judge found the former Xavier University women's basketball coach accused of sexually abusing a player not guilty Monday. Police charged Bryce McKey with one count of third-degree sexual abuse in August after they said he groped a Xavier student on the evening of May 2 in his Covington home. A judge also found McKey not guilty Monday on a charge related to providing alcohol to an underage woman. McKey resigned from his position at Xavier before accusations were made against him in August. (link)

Apr 08, 2016: "Your entire life is just one big lie," Charin Davenport's former supervisor allegedly told her, according to a lawsuit filed today. Davenport is suing Saginaw Valley State University and the supervisor, Ann Coburn-Collins, for illegal sex discrimination. The suit claims Davenport's administrative job at the school was abruptly eliminated after Davenport told her supervisor she planned to transition to life as a woman. Now Davenport is suing SVSU and Coburn-Collins on grounds of sex discrimination, including under Title IX and the Equal Protection Clause of the U.S. Constitution. (link)

Apr 08, 2016: A former head men's basketball coach at The University of Southern Mississippi acted unethically and failed to promote an atmosphere for compliance when he directed his staff to engage in academic misconduct, according to a decision issued by a Division I Committee on Infractions panel. During the investigation, the former head coach fabricated a document to justify payments to student-athletes and took other actions to thwart the investigation. Penalties in the case include three years of probation, a two-year postseason ban for the men's basketball team, reductions in scholarships and recruiting opportunities, as well as show-cause orders for a number of individuals, including the former head coach. During the show-cause period, if any of the individuals are hired by an NCAA school, that school must follow the terms of each of their respective show-cause orders. (link)

Apr 05, 2016: Should a professor who can't be trusted to be alone with students be trusted to teach at all? Students at the University of California at Los Angeles say no, and they're protesting the university's decision to allow a professor accused of serial sexual harassment and assault to return to campus, despite a university agreement that stipulates he must leave his door open when meeting with students, among other requirements. The complaints against Gabriel Piterberg are detailed in a lawsuit filed last year by two graduate students who have been public about their involvement in the case, Nefertiti Takla and Kristen Glasgow. (link)

Apr 05, 2016: An Ohio University psychology professor was arrested Monday morning and charged with aggravated burglary and assault toward an OU student, according to a report from the Lancaster Police Department. Keith Markman, 48, of Bexley was arrested after he allegedly entered a residence with force and assaulted a woman, 33, described as his former girlfriend. The woman listed in the report is a current student at OU, Pittman said. He said FERPA regulations does not permit the university to disclose whether the woman was a student of Markman's. (link)

Mar 31, 2016: Alabama A&M University fired a tenured professor in March after the school discovered videos of him participating in sexual activity with two students on campus, according to court documents. The school severed ties with Edward Jones, who has worked more than 20 years at Alabama A&M. According to court documents filed in federal court by Alabama A&M, videos of Jones were discovered on a school laptop that recorded the professor in three sex acts, including twice having oral sex with two different male students. All three instances occurred on the Alabama A&M campus, the school said. The videos were found on a school laptop recovered at Jones' home after Huntsville police and Alabama A&M police executed a search warrant, according to court documents. (link)

Mar 31, 2016: A Villanova University history professor has been charged with 415 child pornography-related counts after the university contacted police. Radnor police Lt. Andrew Block says hundreds of images were found in the investigation of 60-year-old professor Christopher Haas. He says Haas also is the subject of a similar 2012 federal probe. Villanova spokesman Jonathan Gust says the university was unaware of the federal investigation. He says the university contacted police after security noticed suspicious activity on a computer in a common area. He says Haas is banned from campus. (link)

Campus Life & Safety Events

Apr 25, 2016: A student is charged with recording women showering in dorm bathrooms at Indiana University. Police say Donte Montague admitted he used his cell phone to record women at Wright-Harding in Wright Quad without their knowledge. According to FOX59, he saved the videos on his cellphone and downloaded them on a laptop. Police searched both devices and found videos showing women showering. It does not appear Montague distributed or posted the videos online, according to police. Students told FOX59 that it's easy to go between male and female floors, as well as to access the bathrooms. Montague faces two counts of voyeurism in the case. (link)

Apr 21, 2016: Hundreds of demonstrators were rallying at the University of Wisconsin-Madison to protest the arrest of a black student accused of spraying provocative graffiti messages around campus. The Wisconsin State Journal reports Thursday that students and faculty gathered at the statue of Abraham Lincoln and pasted a list of demands that included community control of campus police. They later marched to occupy a library and shut down nearby intersections. The protests come after police accused a black student of doing $4,000 worth of damage to university buildings and arrested him during class. One note he's accused of spraying reads, "The devil iz a white man, -- God." Protesters say the collection of graffiti represents anti-racist artwork. (link)

Apr 20, 2016: It was a brown bear that mauled a university professor on a mountain near Haines, Alaska, while he was teaching a class, a University of Alaska Southeast spokeswoman said. Forest Wagner, 35, was part of a mountaineering class with 11 students and two teaching assistants on Mount Emmerich when he was attacked by a brown bear sow on Monday, spokeswoman Katie Bausler said. No one else was hurt, but the class was evacuated from the mountain when the bear, which had cubs, was spotted again, according to Alaska State Troopers. (link)

Apr 19, 2016: East Carolina University has fired a campus police officer over his response to the group beating of a black man on campus last month, and the Greenville police have asked the Federal Bureau of Investigation to review the case for possible hate crime charges. University officials said the officer, Ralph Whitehurst, was given notice of his dismissal Tuesday for violating "multiple police policies," according to ECU Police Chief Gerald Lewis. Whitehurst, who is white, was not accused of using force in the March 17 incident, but he handcuffed the victim and did not follow protocols and procedures in investigating the crime, Lewis said. Whitehurst, a sergeant, had been at ECU for 12 years. (link)

Apr 15, 2016: Five Clemson students were arrested after they refused to leave Sikes Hall Thursday evening. Clemson University administrators gave students until 5:30 p.m. to move their protest out of Sikes Hall, but these five students chose to stay inside. Administrators made it clear that students who refused to go outside the building before the doors were locked would face arrest. According to one of the students arrested all of them have been charged with trespassing. The five students have been released on their own recognizance. Protesters held a sit-in overnight Wednesday at the university's administration demanding racial inclusion. They remained in place all day Thursday. (link)

Apr 14, 2016: Federal officials and the local police are investigating burglaries and hate literature that appear to be directed at Muslim students attending Idaho State University in Pocatello, where tensions have recently risen over an influx of students from Saudi Arabia and Kuwait. The Pocatello police chief, Scott Marchand, said that his office was investigating the burglaries but had received reports of about two dozen, not 50. He also said there had been about 70 residential burglaries in town since Jan. 1. (link)

Apr 13, 2016: A University of Illinois student faces murder charges after authorities say she suffocated her newborn baby after giving birth in a residence hall bathroom last month. Police say officers found 20-year-old Lindsay L. Johnson of Monee near the campus Music Building on March 13 wearing a backpack with the deceased newborn inside. Officers went looking for her after responding to a call earlier in the day from another student at the dorm who reported sounds of a baby crying and that Johnson was in the bathroom for a long time. According to the Champaign County circuit court clerk's website, Johnson was charged Monday with murder, causing a child to be endangered/death and concealing a homicide. (link)

Apr 07, 2016: The manhunt for a campus killer at the University of Texas continued Thursday as school officials identified the victim as Haruka Weiser, an 18-year-old freshman. Austin police said they have still not located a suspect in Weiser's slaying, but released surveillance video from Sunday -- when Weiser was last seen alive on the Austin campus -- of a man with a bicycle lurking in the area. Weiser was last seen leaving the drama building some time between 9:30 to 9:45 p.m. Sunday local time, Gay said. Friends reported her missing the next morning. The next day, at about 10:30 a.m. Tuesday, Weiser's body was discovered near Waller Creek, just west of the school's Alumni Center, according to NBC affiliate KXAN. (link)

Mar 31, 2016: A senior at Salem State University accused of stabbing a professor Wednesday night has been charged with attempted murder, according to a school official. Authorities say Stephen Chastain, 24, attacked the professor with a knife late Wednesday afternoon. The professor sustained a superficial wound to his neck and was transported to Beverly Hospital for treatment. The stabbing took place in one of the campus' academic buildings. The assailant was caught about a block away in Salem. "It seemed to be very random," said university spokeswoman Karen Murray Cady. "The professor did not know the student and we don't believe the student knew the professor." (link)

Other News & Events

If you have any suggestions, questions or feedback, please e-mail me at robinmk@auburn.edu. We hope you find this information useful and would appreciate hearing your thoughts. Feel free to forward this email to your direct reports, colleagues, employees or others who might find it of value. Back issues of this newsletter are available on our web site at https://www.auburn.edu/administration/oacp.

If you have any suggestions for items to include in future newsletters, please e-mail Robert Gottesman at gotterw@auburn.edu.

Back to top

Office of Audit, Compliance & Privacy
Auburn University
304 Samford Hall
M. Kevin Robinson, Assoc. VP

© Redistribution of this newsletter, with or without modification, is permitted provided Auburn University Office of Audit, Compliance & Privacy is listed as the source.