Northern Arizona University Report on Internal Control and on Compliance Year Ended June 30, 2019 A Report to the Arizona Legislature Lindsey A. Perry Auditor General The Arizona Office of the Auditor General’s mission is to provide independent and impartial information and specific recommendations to improve the operations of State and local government entities. To this end, the Office provides financial audits and accounting services to the State and political subdivisions, investigates possible misuse of public monies, and conducts performance audits and special reviews of school districts, State agencies, and the programs they administer. The Joint Legislative Audit Committee Senator Rick Gray, Chair Representative Anthony T. Kern, Vice Chair Senator Lupe Contreras Representative John Allen Senator Andrea Dalessandro Representative Timothy M. Dunn Senator David C. Farnsworth Representative Mitzi Epstein Senator David Livingston Representative Jennifer Pawlik Senator Karen Fann (ex officio) Audit Staff Donna Miller, Director Taryn Stangle, Manager Contact Information Arizona Office of the Auditor General 2910 N. 44th St., Ste. 410 Phoenix, AZ 85018-7271 (602) 553-0333 contact@azauditor.gov www.azauditor.gov Representative Rusty Bowers (ex officio) TABLE OF CONTENTS Independent auditors’ report on internal control over financial reporting and on compliance and other matters based on an audit of basic financial statements performed in accordance with Government Auditing Standards 1 Schedule of findings and recommendations 3 Financial statement finding 3 University response Corrective action plan Report issued separately Comprehensive Annual Financial Report Arizona Auditor General Northern Arizona University Year Ended June 30, 2019 PAGE i MELANIE M. CHESNEY ARIZONA AUDITOR GENERAL DEPUTY AUDITOR GENERAL LINDSEY A. PERRY JOSEPH D. MOORE DEPUTY AUDITOR GENERAL Independent auditors’ report on internal control over financial reporting and on compliance and other matters based on an audit of basic financial statements performed in accordance with Government Auditing Standards Members of the Arizona State Legislature The Arizona Board of Regents We have audited the financial statements of the business-type activities and discretely presented component unit of Northern Arizona University as of and for the year ended June 30, 2019, and the related notes to the financial statements, which collectively comprise the University’s basic financial statements, and have issued our report thereon dated October 16, 2019. Our report includes a reference to other auditors who audited the financial statements of the Northern Arizona University Foundation, the discretely presented component unit, as described in our report on the University’s financial statements. We conducted our audit in accordance with U.S. generally accepted auditing standards and the standards applicable to financial audits contained in Government Auditing Standards, issued by the Comptroller General of the United States. However, the Foundation’s financial statements were not audited in accordance with Government Auditing Standards, and accordingly, this report does not include reporting on internal control over financial reporting or instances of reportable noncompliance associated with the Foundation. Internal control over financial reporting In planning and performing our audit of the financial statements, we considered the University’s internal control over financial reporting (internal control) to determine the audit procedures that are appropriate in the circumstances for the purpose of expressing our opinions on the basic financial statements, but not for the purpose of expressing an opinion on the effectiveness of the University’s internal control. Accordingly, we do not express an opinion on the effectiveness of the University’s internal control. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the University’s basic financial statements will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance. 2910 N 44th ST • STE 410 • PHOENIX, AZ 85018 • (602) 553 -0333 • WWW.AZAUDITOR.GOV Our consideration of internal control was for the limited purpose described in the first paragraph of this section and was not designed to identify all deficiencies in internal control that might be material weaknesses or significant deficiencies. Given these limitations, during our audit we did not identify any deficiencies in internal control that we consider to be material weaknesses. However, material weaknesses may exist that have not been identified. Compliance and other matters As part of obtaining reasonable assurance about whether the University’s basic financial statements are free from material misstatement, we performed tests of its compliance with certain provisions of laws, regulations, contracts, and grant agreements, noncompliance with which could have a direct and material effect on the determination of financial statement amounts. However, providing an opinion on compliance with those provisions was not an objective of our audit, and accordingly, we do not express such an opinion. The results of our tests disclosed an instance of noncompliance or other matter that is required to be reported under Government Auditing Standards and that is described in the accompanying schedule of findings and recommendations as item 2019-01. University response to findings The University’s response to the finding identified in our audit is presented in its corrective action plan at the end of this report. The University is responsible for preparing a corrective action plan to address the finding. The University’s response and corrective action plan were not subjected to the auditing procedures applied in the audit of the basic financial statements, and accordingly, we express no opinion on them. Purpose of this report The purpose of this report is solely to describe the scope of our testing of internal control and compliance and the results of that testing, and not to provide an opinion on the effectiveness of the University’s internal control or on compliance. This report is an integral part of an audit performed in accordance with Government Auditing Standards in considering the University’s internal control and compliance. Accordingly, this communication is not suitable for any other purpose. Lindsey Perry, CPA, CFE Auditor General October 16, 2019 PAGE 2 SCHEDULE OF FINDINGS AND RECOMMENDATIONS Financial statement finding 2019-01 The University inappropriately paid for $40,277 of the President’s and her spouse’s travel expenses that conflicted with policies and lacked appropriate documentation, which put public monies at potential risk of misuse Condition and context—The University paid $40,277 of the President’s and her spouse’s fiscal year 2019 travel expenses, which conflicted with University and Arizona Board of Regents (ABOR) policies and lacked proper documentation to justify the deviations from policies. These expenses represented 62 percent of the total $64,969 in travel expenses the University expended on their behalf in that year. In June 2014, the ABOR chair authorized the President’s spouse to travel with her under certain conditions.1 Our review of 17 fiscal year 2019 travel expense summaries and 2 purchasing card payments for the President’s and her spouse’s travel to conferences, athletic events, donor meetings, and other University events found that the President’s travel expense summaries she signed as correct and proper did not include required documentation of the public purpose and benefit or any justification and approval for deviating from University and ABOR policies, such as approval for business- and first-class airfare, lodging that exceeded allowable rates, and unallowed expenses. Specifically: • The University reimbursed the President $30,641 for her and her spouse’s airfare to Russia that included both business- and first-class tickets and 2 additional replacement one-way business-class tickets. • Even though an event sponsor offered to pay for 2 coach airfare tickets for both the President and her spouse to attend an event in Israel or a business-class ticket if only the President attended, the University purchased a $5,862 roundtrip business-class ticket for the President’s spouse to attend with her. The event sponsor paid for a business-class ticket for the President and all of her and her spouse’s lodging and meals. • The University reimbursed the President for 13 separate hotel stays where the hotel’s room rate exceeded the allowable State government rate, which cost the University an additional $1,751. Documentation management later provided to us still did not support the public purpose for these exceptions. • The University reimbursed the President $2,023 of her and her spouse’s expenses specifically not allowed by its policies, including visas to Russia, early flight check-in fees, valet parking, room service that was in addition to her daily meal allowance, and a duplicate hotel reimbursement. In a June 2014 letter, the ABOR Chair authorized the President’s spouse to travel with the President to attend conferences, athletic events, and donor meetings and for other various reasons, as long as the expenses were paid with non-State, unrestricted resources and depending on the travel, treated as taxable income if necessary. The President’s spouse is a University faculty employee who often travels with the President. 1 Arizona Auditor General Northern Arizona University—Schedule of Findings and Recommendations Year Ended June 30, 2019 PAGE 3 After we brought these inappropriately paid travel expenses to management’s attention, in October 2019 the President reimbursed the University $179 for a duplicate hotel reimbursement. Further, in November 2019 the Northern Arizona University Foundation reimbursed the University $37,785 for the airfare to Russia, the President’s spouse’s airfare to Israel, the visas to Russia, and early check-in fees. In addition, the University inappropriately paid travel expenses for 5 of the President’s and her spouse’s trips that included personal travel but lacked documentation of the required cost analyses to demonstrate whether the personal travel increased the trips’ costs. Consequently, the University cannot show whether it paid higher costs to accommodate their personal travel. Paying costs associated with employees’ personal travel may also have income tax consequences, including a requirement to treat the payments as compensation. Criteria—University travel policies and relevant ABOR policies apply to all employees, including the President and her spouse. These policies require adequate supporting documentation for travel expenses, advance approval and/or justification for expenses greater than those allowed by policy, and that travel expenses have a public purpose justification. Adherence to these policies helps ensure compliance with the Arizona Constitution, Art. IX, Sec. 7, which bans gifts or loans of public monies to individuals. Effect—The University’s failure to adequately review and ensure the appropriateness of the President’s and her spouse’s exceptions to policies were documented before approving and paying all travel expenses put public monies at potential risk of misuse. Further, when executive management does not follow established policies, including compliance with documentation requirements, they set an unfavorable tone that policies do not need to be followed. Cause—The University did not follow its travel policies or applicable ABOR policies to ensure and document that the President’s and her spouse’s travel expenses it paid met them. The employees preparing and approving the President’s travel expense summaries indicated that because they were familiar with her travel schedule, arrangements, and purposes, they did not take the time to ensure appropriate documentation was included in compliance with travel policies. In addition, the University did not have procedures for anyone outside of the President’s Office, such as someone in the Comptroller’s Office, to review the President’s travel expense documentation after the President’s Office prepared and approved the summaries. Finally, the President’s travel expense summaries were generally unorganized and unnecessarily complicated, which made them more difficult for University staff to adequately review and ensure compliance with policies. For example, one summary may have included both of her and her spouse’s travel, more than 1 trip, multiple flights and hotel stays, and varying travel schedules for each of them. Recommendations—To help ensure the University appropriately spends public monies for only those travel expenses allowed by University and ABOR policies, the University should: • Strengthen and clarify procedures for reviewing and approving the President’s and her spouse’s travel expenses, ensure staff are trained on University and ABOR policies, and designate an employee to work with the President and her spouse to obtain required information. • Require that the President and her spouse complete separate travel expense summaries that are adequately organized and supported by documentation, such as detailed receipts, conference brochures and meeting agendas, and explanations of the travel’s public purpose if it is not evident. Arizona Auditor General Northern Arizona University—Schedule of Findings and Recommendations Year Ended June 30, 2019 PAGE 4 • Ensure all the President’s and her spouse’s exceptions to University and ABOR travel policies are justified and preapproved in writing and work with ABOR to determine ABOR’s role in approving certain exceptions in writing since there is no one who oversees the President at the University. • Prepare and retain a cost analysis of travel expenses when personal travel is arranged in connection with the President’s and her spouse’s University business travel to determine whether any travel expenses that arise from their personal travel increase the trip’s cost and should be paid personally by them. If the University pays any increased travel expenses due to personal travel, the University should determine whether those payments constitute taxable income under tax laws and treat the payments accordingly. The University’s responsible officials’ views and planned corrective action are in its corrective action plan included at the end of this report. Arizona Auditor General Northern Arizona University—Schedule of Findings and Recommendations Year Ended June 30, 2019 PAGE 5 mmvazmm NI�lu NORTHERN ARIZONA 'It � UNIVERSITY Northern Arizona University Office of the Vice President of Finance, Institutional Planning and Analysis PO Box 4132, Flagstaff, AZ 86011 Tel 928-523-4240 Fax 928-523-0332 www.nau.edu January 2, 2020 Lindsey Perry Auditor General 2910 N. 44th St., Ste. 410 Phoenix, AZ 85018 Dear Ms. Perry: We have prepared the accompanying corrective action plan as required by the standards applicable to financial audits contained in Government Auditing Standards and by the audit requirements of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Specifically, for the finding, we are providing you with our responsible officials' views, the names of the contact people responsible for corrective action, the corrective action planned, and the anticipated completion date. Sincerely, Bjorn Flugstad Vice President for Finance, Institutional Planning & Analysis and CFO Financial statement finding 2019-01 Contact Persons: ● Bjorn Flugstad, Vice President Finance, Institutional Planning and Analysis and CFO ● Wendy Swartz, Associate Vice President and Comptroller Anticipated Completion Date: ● December 31, 2019 Corrective Action Plan: ● Processing and review of travel reimbursement claims has been moved to the university Chief Financial Officer’s (CFO) office, including the requirement that separate travel expense summaries be completed for each individual traveling. ● Additional training will be provided regarding required documentation requirements for all travel, including clear and thorough explanations of travel purposes and required applicable cost analyses. Northern Arizona University respectfully submits this response to the report regarding Internal Controls and Compliance. NAU appreciates that this report does not identify deficiencies in internal controls over financial statement reporting that would be considered as material weaknesses. Internal controls are an important function of NAU’s business practices and require regular evaluation and adjustments for improvements; NAU appreciates the guidance from the Office of the Auditor General regarding recommendations for such improvements. In this instance, NAU has worked to strengthen business processes and practices to ensure that transactions related to travel are properly documented and accounted for, regardless of funding source. The areas identified by the OAG for process improvement, primarily focused on preserving adequate travel documentation, have already been addressed by NAU as set forth below. The Arizona Board of Regents is aware of the items described in this report and have told us that they believe there was not an intentional misuse of funds. The report, however, nonetheless provides an opportunity to improve business processes that further support an effective controls environment. Importantly, as noted in the report, both the expectation of and the approval for spousal travel from the Arizona Board of Regents has been documented since 2014. More specifically, support for attendance at events ranging from conferences to athletic events, in accordance with ABOR and NAU policies, was approved. Further approvals from ABOR for spousal travel were not expected in accordance with ABOR practice and as confirmed by the ABOR General Counsel. The report’s references to possible inappropriately paid travel expenses were based upon the lack of sufficient supporting documentation, and NAU firmly believes no employee deliberately did not comply with applicable policies. Importantly, the President’s staff based on interviews believed they were complying with all travel policies when preparing and approving the travel expense summaries for the President’s signature. Cost analyses were completed by the President's staff in each case of personal travel at the time that travel was scheduled based on interviews with staff, in compliance with policy and in alignment with university travel training, and as part of the overall travel planning process to ensure the most economical approach was used. However, documentation of each analysis was not adequately retained as evidence of that review, and is one focus of NAU’s commitment to making improvements and implementing best practices moving forward. Based on interviews with staff in the Office of the President, staff did carefully review the appropriateness of both the travel and the expenditure levels for each trip noted at multiple steps in the process, which is consistent with the processes and review for all university travel. Unfortunately, documentation of this review should have been more thorough. Additionally, adherence to policy is part of those reviews and is an important component of all university training, since policies are not subjectively applied on a case-by-case basis. As referenced in the Cause section, improved documentation that better sets forth the need for and the factors considered when making travel arrangements and reimbursements, along with additional steps to further review that reasoning, have already been put in place, to establish best practices and ensure significant process improvement. NAU appreciates the opportunity identified in the report to provide better evidence of NAU’s compliance, as will be demonstrated through the creation and retention of adequate travel documentation. NAU has already addressed the items outlined in the report, to ensure alignment with the Recommendations. And as discussed above, since 2014 the need and approval for spousal travel has been documented and thus does not require a separate preauthorization in writing from ABOR. ABOR policy terms also anticipate that in some circumstances airfare at a rate higher than coach/economy and hotel rates that exceed the state rate may be appropriate and approved so long as written justification is documented. Review of justification documentation for adequacy and policy compliance is a function appropriately handled by the university Chief Financial Officer or their designee. ● Reimbursements in the amount of $37,964 have been completed, a portion of this amount was to address identified errors. The university believes that items such as higher hotel rates were appropriate expenditures but lacked the necessary documentation for justification. ● Processing and review of travel reimbursement claims has been moved to the university Chief Financial Officer’s (CFO) office, including the requirement that separate travel expense summaries be completed for each individual traveling. ● Additional training will be provided regarding required documentation requirements for all travel, including clear and thorough explanations of travel purposes and required applicable cost analyses. NAU also wishes to provide context regarding the examples provided in the report of specific travel and reimbursements (in the Condition and Context section), including the assessment and review process that was undertaken for each item. Each example provided had the public purpose of further advancing the institutional mission of the university. Additionally, each example resulted in demonstrable results which benefitted the university, from the enrollment of new students to establishing new visiting scholars exchanges. Business- or first- class airfare was used only in cases of international travel, and was never used for domestic travel. ● The referenced trip to Russia, which included meetings with university and government officials, including the US Ambassador to Russia, did entail the appropriate purchase of airfare (business class and first-class in this single case), given the length of the international flight and the schedule during, prior, and after the trip. However, documentation that provides justification for this purchase was not prepared. Additional/replacement fares were only purchased after carrier-caused delays and were purchased to ensure that this important trip was completed. The cost of the trip was also reimbursed by the NAU Foundation, as noted in the report. The NAU Foundation, as a separate, 501(c)(3) entity, reimburses expenditures with non-public funds. ● The referenced event in Israel reflected participation as part of Project Interchange, a nonprofit, apolitical, educational institute of the American Jewish Committee (AJC). This trip’s delegation included ten university Presidents and Chancellors and their spouses/partners. The cost of the flight was reimbursed by the NAU Foundation, as noted in the report. ● Hotel rates in Phoenix, of which 9 of the 13 stays referenced were located in the Phoenix metropolitan area, are often higher than the state government rate, especially during the spring when there is peak demand. This peak season coincides with the Arizona Legislative session when frequent, and often last-minute, meetings are scheduled. Proactively planning travel arrangements is always a priority, but schedule adjustments frequently occur to meet the availability of elected and appointed officials as well as business CEOs. When those adjustments are needed, proximity to meeting locations is prioritized to ensure that the travel time is efficient and the schedule is effective. ● Reimbursements in the amount of $37,964 have been completed, a portion of this amount was to address identified errors. The university believes that items such as higher hotel rates were appropriate expenditures but lacked the necessary documentation for justification. In conclusion, NAU appreciates the guidance of the OAG and the opportunity this audit provided to examine and improve current documentation practices related to travel and to better position the university for the future. ARIZONA AuditorGeneraI Making a Positive Difference