Beginning in December 2006, SAS 112/115 established standards and provided guidance on communicating matters related to an entity’s internal control over financial reporting identified in an audit of financial statements. In particular, SAS 112/115:
Defines the terms “significant deficiency” and “material weakness,” incorporating the definitions already in use for public companies;
Provides guidance on evaluating the severity of control deficiencies identified in an audit of financial statements; and
Requires the auditor to communicate in writing, to management and those charged with governance significant deficiencies and material weaknesses identified in an audit.
The Controller’s office at each campus has worked with campus external auditors to identify existing internal controls that support the financial reporting process. In simple terms, requirements for key controls under SAS 112/115 are that:
- A key control must exist;
- A key control must be functioning effectively; and
A key control must be documented.
This process is critical to UC but requires a tremendous amount of documentation and allocation of resources.
The University aims to streamline the process, taking it from manual to automated, but also to build a better process to ensure improved compliance, efficiencies, and transparency. The ultimate goal is to ensure that existing key controls are in place and that each campus can demonstrate through documentation that they are operating as intended.
A workgroup, consisting of UC San Diego representatives and an external software developer worked on a web‐based tool to facilitate the review and documentation of key department controls required by SAS 112/115. The tool can be used by all UC campuses. The first phase of the prototype has been completed and shared with UC Control Directors and the Office of the President Chief Risk Officer.
The ultimate goal of UC Tracker is to provide a tool that allows the University to monitor financial controls and reduce the time required to complete the SAS 112/115 process. UC Tracker reduces current workload by eliminating redundancy in report preparation and by automating the manual documentation of the performance and certification of internal controls critical to the University’s annual financial audit. UC Tracker enables the sharing of analyses and information easily and efficiently across multiple locations.
SAS 112/115 requires a lower threshold for reporting internal control deficiencies to the Chancellors and the Board of Regents. The size and many locations of the university make this a potentially daunting task. Advancements in technology assist greatly in overcoming these challenges.
- Initial investment
Prior to UC Tracker, a Request for Proposal was conducted to identify a commercially‐available tool to meet UC’s needs. None of the resulting tools sufficiently met UC’s needs, and all were cost‐prohibitive. Developing UC Tracker in‐house resulted in a superior tool, saving 70% on development costs and 80% on ongoing maintenance costs as compared to commercially‐available products.
- Fiscal results, current and anticipated
UC Tracker is part of a suite of Enterprise Risk Management solutions, which are all funded by internal premium determined by independent actuaries. By shifting premium dollars to loss‐prevention and loss‐control activities totaling approximately $20 million per year, we have reduced the Cost of Risk3 by over $380 million over the last five years through cost savings and cost avoidance.
- Current action and next steps
The second phase of this project is delivery of a “set up” prototype which will allow each campus unit to identify pertinent information related to their department. Completion of this project is anticipated in late 2010.
- Concluding statement
UC Tracker has the ability to save the University millions of dollars and ensure the existence, functionality, and documentation of key controls in an efficient manner.