The Quaestor - Volume 14, Issue 1

Solutions from multiple vendors were evaluated with university-wide representation. The investigation process spanned approximately one year and included the full evaluation of four vendors. The product suite from Novelution was selected for the following reasons:

• User Experience: user friendly, intuitive, secure cloud-hosted, web and mobile application, including dashboard analytics
• Pre-award: integrated budgeting, proposal development, online routing and approvals
• Post-award non-financial: award acceptance, technical reporting, sub-awards, re-budgeting, and extensions
• Post-award financial: billing and financial reporting, budget monitoring and analysis, and projections
• Principal Investigators and Administrative Staff: real-time financial monitoring, forecasting, project management, monitoring technical deliverables, and personnel management
• Compliance: conflict of interest, IRB, export control, and other compliance activities
• Strategic: best suited to position the RIT community to effectively manage its growing research enterprise and support the university’s strategic plan

The goal for this technology solution is to manage processes (currently de- centralized) within one platform from proposal preparation, through award negotiation and acceptance, project step-up, financial and programmatic administration, and final close-out in an integrated and coordinated manner.

Novelution’s single platform solution will enable the management of pre- and post- award activities for externally sponsored projects (i.e., grants and contracts) in a manner comparable to peer institutions.

The Conflict of Interest module will be implemented first beginning in February 2019, with the Sponsored Research and the Institutional Review Board modules to follow with an expected completion during 2021.

BUSINESS EMAIL COMPROMISE

• BEC scams often start with a phishing email intended to obtain unauthorized access to a targeted employee’s account.
• The attacker may exchange a series of emails with the targeted employee in order to build a trusted relationship. Even though these emails do not normally contain links or attachments, they still pose a risk by connecting the attacker to internal resources.
• If a targeted employee clicks a link in the phishing email that leads to downloading malware, cybercriminals may gain access to employee information such as email addresses, vendor profiles, payment details, and travel schedules.
• Using this information, scammers can pretend to be trusted vendors or employees inquiring about payments or sensitive data.
• The scammers will email employees from embedded contact lists or even call them, earning their trust.
• When the targeted employee is out of reach, such as away on business, the cyber thief could send a fake email from his or her office, demanding that a payment be made to the trusted vendor’s account.
• With no way to verify if the email is authentic, the employee may make a hasty decision to approve the payment. Of course, the payment goes to the scammer and not the trusted vendor.
• Determine whether an email is a BEC scam by looking for suspicious behaviors, including fear tactics or urgent unusual requests.
• You can prevent BEC scams by verifying requests in person or by phone and never relying on email alone.

In addition, the Framework includes points of focus or characteristics that are examples of behaviors or processes that would be expected to be in place to demonstrate that the related principle is in fact present and functioning. This edition of the COSO Corner will summarize the sixteenth COSO principle, which is the first of two principles related to the last component of internal control, Monitoring Activities, as well as the related points of focus.

Principle 16 – The university selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. Important characteristics relating to this principle include:

• Considering Both Ongoing and Separate Evaluations – Monitoring can be performed through ongoing evaluations which are routine operations built into business processes and performed on a real-time basis, or as separate evaluations conducted periodically by objective management personnel, internal audit, and/or external parties. Whether ongoing or separate, these evaluations ascertain the adequacy and effectiveness of existing internal controls to provide reasonable assurance that the organization’s objectives will be achieved.
• Ongoing Evaluations are Performed by Knowledgeable Personnel and are Integrated with Business Processes – Ongoing evaluations are generally performed by the line operating or functional managers, who have sufficient knowledge to understand what is being evaluated. Technology is often used to support ongoing evaluations and allow for the efficient review and analysis of large volumes of data by knowledgeable and responsible personnel who would recognize inconsistencies or other anomalies which may indicate the need for follow up and corrective action.
• Considering Rate of Change – When designing an effective monitoring structure (i.e., ongoing vs. separate evaluations), management should consider the rate of change of key factors which may impact operations (e.g., regulations, technology, industry trends). Areas of operation that have greater rates of change may need to have more frequent separate evaluations (e.g., independent consultant, subject matter expert, internal audit).
• Adjusting the Scope and Frequency of Separate Evaluations–Separate objective evaluations will vary in scope and frequency depending on the significance of the process-related risks, results of ongoing evaluations, and expected impacts on the control components in managing the risks. Higher priority risks should be evaluated more frequently and in greater depth than lower priority risks.
• Evaluating Outsourced Service Provider Operations-Owners of key functions that are performed by third party service providers (vendors) need to understand the activities and controls associated with these services and how the vendor’s internal control system impacts the university’s system of internal control. Common approaches used to monitor the vendor’s system of internal control include: incorporating a right- to-audit clause in the vendor’s contract, reviewing an independent audit or examination report (i.e., Service Organization Control (SOC) report), and implementing complementary user entity controls (e.g., reconciliations, independent verification of vendor data, encryption of data transmitted to vendor).

Reference:
Committee of Sponsoring Organizations of the Treadway Commission (May 2013). “Internal Control – Integrated Framework – Framework and Appendices”