Addressing the Y2K issues within an organization that is as diverse and large as the University is a challenge. There is no 100% Y2K failure-safe solution. However to reduce risk, each organization has a responsibility to reduce the risk of failure. At the University, several initiatives have been undertaken during 1998/99 to reduce the risks. These include:

a) Technology Risks

• Conversion of major administrative systems to PeopleSoft remains on schedule.
  
• Formation of a group, comprised of members from ITS and Internal Audit to address compliance of ITS systems and provide assistance, if required, to other departments.
  
• Selection of a new telecommunication system, to be implemented by the Fall 1999.
  
• Development of a 'Y2K Readiness Guide' for UWO employees.
  
• Communications that consistently state "all faculty and staff take personal and individual responsibility for helping to ensure that the technology you use is Y2K ready".
  
• Formation of a Research Subcommittee to reach the research community.

In addition, the Assistant Director of ITS and the Chair of the Y2K Contingency Planning Committee will meet with Deans and Budget Unit Heads individually to discuss compliance issues and contingency planning. Units will also be asked to state their degree of compliance by July 30, 1999.

b) Business Interruptions

• Formation of a Y2K Contingency Planning Committee that includes members from across campus, including Internal Audit.
  
• Participation of department Y2K representatives in seminars and workshops held on contingency planning.
  
• Requests for contingency plans from all faculties and departments. Most plans have been received.
  
• Formally recognizing the first priority in contingency planning is safety and security.
  
• During the remainder of 1999, a corporate contingency plan will be developed and tested.

c) Legal Issues

• Pensa & Associates completed a legal assessment of Y2K issues at the University.
• A final report has not been released to the Y2K Contingency Planning Committee.

Through these activities, it appears the University is managing Y2K risks. However, these activities must continue for the remainder of 1999 and need to be monitored. Internal Audit will continue to monitor the progress during this period.

3) Campus Computer Security Subcommittee (CCSS)

Internal Audit is a member of CCSS, which is a subcommittee of the Senate Committee on Information Technology Services (SCITS). The committee was formed to provide advice to SCITS on computer and network security issues, to develop and recommend computer security-related policies, and to educate the campus community on computer security issues and policies.

During 1998/99, CCSS discussed information security issues facing the University. A report outlining specific recommendations to improve the information security infrastructure will be discussed at SCITS in June.

4) Legislation Affecting the University

In 1992, a list of legislation affecting the University=s operations was completed and reviewed to identify areas where Board member/officer liability was high. A project to update this list was initiated in 1997/98. The project should be completed during the summer 1999, as a summer student has been hired to complete the review.

5) Special and Mandatory Audits

Work in this area was limited to two investigations of travel policy compliance. One investigation concluded with an employee returning approximately $1,300 to the University. The other review did not find any compliance issues.

6) External Audit Assistance

Internal Audit provides assistance to Ernst & Young on the audit of enrolment and year-end inventory counts. Work completed by Internal Audit on year-end files prior to 1996, is now done by Ernst & Young at a cost of $15,000. Additional corporate audit fees paid in 1998/99 included $16,000 for the Human Resource system conversion and $1,025 for tax advice.

7) Professional Development

Professional development included training in PeopleSoft Query reporting and PeopleSoft Security.

WORK PLAN for 1999/2000

The 1999/2000 work plan is proposed (an allocation of time is presented in Schedule 1) based on the following assumptions:

a) No change in internal audit resources.

b) PeopleSoft continues to be a high risk project for the University.

c) Audit Committee and Senior Administration interests in risks facing the university.

1) Systems Audits

a) PeopleSoft - As indicated earlier in the report, work on PeopleSoft projects will continue, but not at the same level as in 1998/99. This is because most of the major implementations have been completed.

b) Year 2000 - As indicated, Internal Audit will continue monitoring progress for the remainder of 1999.

c) Campus Community Security Subcommittee - Work will continue.

2) Special and Mandatory Audits

It is anticipated that projects will be taken on if time permits.

3) Audit Committee

Audit Committee members have expressed an interest in identifying risk areas to the University. In 1992, after identifying areas where Board member/officer liability was high, an indemnification clause covering Governors and Officers was enacted. It is proposed to review this clause to determine if the coverage is adequate or if there are any exclusions. This will be done at the completion of the Legislative review.

4) External Audit Assistance

Additional time will be required to assess the audit of enrolment process for 1999/2000.

5) Risk Identification and Management (R.I.M.) Group

The U.W.O. Internal Audit objective is to assist management in the discharge of its responsibilities by providing objective analysis, appraisals, recommendations and comments concerning the activities reviewed. To attain this objective the Internal Audit Department:

• determines whether the overall systems of internal control and the controls in each activity under audit are adequate, effective and functional.
  
• ensures that the institutional policies and procedures, provincial and federal laws and good business practices are being followed.
  
• ascertains the extent to which university assets are accounted for and safeguarded from losses.
  
• determines the reliability and adequacy of the accounting and reporting systems and procedures.

The internal audit function is not responsible for determining and reporting on issues related to the level of efficiency of University operations. If during a review a situation is determined to be resulting in the inefficient expenditure of resources, that situation will be reported.

Audit Strategy

Prior to May 1996, internal audit work consisted of policy compliance reviews, basic control reviews, process reviews, system development reviews and special projects/investigations. The work plan was developed considering the following factors:

• statutory requirements
  
• concerns of management and the Audit Committee
  
• significantly altered or new systems/programs
  
• external audit requirements
  
• issues arising from risk assessment. A risk assessment model ranked faculties and departments as a high, medium or low risk depending on the level of materiality, sensitivity, control concerns and management concerns within the unit.

After May 1996, Internal Audit work focused primarily on the PeopleSoft implementation for two reasons: a) the magnitude of the project combined with the impact on the University made it a high risk project, and b) the department size of one person made it difficult to address other risk areas.

However, the future internal audit strategy requires review due to several factors:

1. Audit Committee discomfort with all resources being used in the PeopleSoft project, meaning no review of the risk assessment model has been done. Therefore Audit Committee members do not know what high risk areas are not being covered.

2. The PeopleSoft project will change during 1999 - 2000. All modules will be implemented by August 1999 and the systems will move to a production status. Likely less Internal Audit resources will be required in the systems area.

3. Changes in the internal audit profession that emphasize a proactive approach.

A vision of the future internal audit function includes the following elements:

• A focus on the future, emphasizing risks rather than compliance testing.
  
• Education and communication of risk and controls.
  
• Co-operative audits that emphasize participation and evaluation rather than inspection.
  
• Use of self-assessment processes wherever possible.
  
• Integration of technology into the audit process.
  
• Periodic evaluations of audit processes to ensure alignment with the organization's direction.

If internal audit focuses on the future and risks, the audit is more likely to address the full range of issues that concern management. Instead of identifying and testing controls, internal audit will identify risks and test the ways management mitigates those risks. Communicating and educating people about risks and controls, creates an awareness of issues that may not have been overtly addressed in the past. The result is stronger systems and controls. In addition, a cooperative approach creates communication channels that result in improvements for both units and audit processes.

The creation of the R.I.M. Group will improve the risk management process at the University. By implementing a framework to assess risk, existing and future risk projects can be identified. Those projects can then be reviewed to determine how risks are mitigated. While internal audit brings knowledge of existing risks and controls to the group, the advantage is that those risks will not be considered in isolation.

What Needs to be Done

Over the next six months, Internal Audit would like to: