Building the Foundation of Compliance

Building the Foundation of Compliance - PPT

Creating a Financial Aid Risk Assessment and Quality Control Plan. Agenda. COSO model of Internal Controls. Identifying areas . of importance within the financial aid . office. Determining . risk factors . ID: 726465

By min-jolicoeur
Watch All docs

Likes : 4
Views : 8

Download this presentation

Click below link (As may be) to get this presentation.

Building the Foundation of Compliance

Download Note - The PPT/PDF document "Building the Foundation of Compliance" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.

Presentations text content in Building the Foundation of Compliance

Building the Foundation of Compliance
Creating a Financial Aid Risk Assessment and Quality Control Plan
Agenda
COSO model of Internal Controls
Identifying areas
of importance within the financial aid
office
Determining
risk factors
Assessing
the risks of the
areas and documenting in
a risk
assessment.
Different
types of quality control reviews and the time each type takes and information each produces.
How to take the risk assessment and make a quality control review plan
.
COSO Framework
In 1992, the
Committee of Sponsoring Organizations of the
Treadway
Commission (COSO)
developed a model for evaluating internal controls. This model has been adopted as the generally accepted framework for internal control and is widely recognized as the definitive standard against which organizations measure the effectiveness of their systems of internal control.
COSO Framework
The
COSO
model defines internal control as “a process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance of the achievement of objectives in the following categories:
Effectiveness and efficiency of operations
Reliability of financial reporting
Compliance with applicable laws and regulations”
In an “effective” internal control system, the following five components work to support the achievement of an entity’s mission, strategies and related business objectives.
COSO Framework
Control
Environment
Risk
Assessment
Control
Activities
Information
and Communication
Monitoring Activities
Control Environment
Integrity and Ethical Values
Commitment to Competence
Board of Directors and Audit Committee
Management’s Philosophy and Operating Style
Organizational Structure
Assignment of Authority and Responsibility
Human Resource Policies and Procedures
Code of Conduct
Risk Assessment
Company-wide Objectives
Process-level Objectives
Risk Identification and Analysis
Managing Change
Control Activities
Security
(Application and Network)
Application Change
Management
Reconciliation
Verifying Information
Business
Continuity/Backups
Information and Communication
Policies and Procedures
Quality of Information
Effectiveness of Communication
0
Monitoring Activities
Ongoing Monitoring
Separate Evaluations
Reporting Deficiencies
1
What is a Risk Assessment?
A
systematic process of evaluating the potential risks that may be
involved
in a projected activity or undertaking
.
An identified list of programs or processes that have been evaluated to determine where risks exist
2
Financial Aid Risk Assessment
Identify programs
Federal Funds (Pell, Federal Work Study, Sub Loans,
etc..)
State Funds (TEXAS Grant, TEOG, CAL loan,
etc.)
Institutional Funds (Foundation Scholarships, TPEG,
etc.)
Outside Funds (Alternative Loans, Outside Scholarships,
etc.)
Non
funding programs (Financial
Literacy,
Identify processes
Automated Processes (Disbursement, SAP, etc.)
Professional Judgment Processes (SAP appeals, Dependency Overrides, etc.)
User Access
Manual Processes (R2T4, Verification, etc.)
3
Types of Risk
Inherent Risk
If everything happens correctly what are the chances that it is still wrong?
Process Risk
How likely is the process to work correctly?
Change in Process
Was the process recently changed? Was the way you handle a specific program altered recently?
Regulatory Interest
What does the overseeing body (ED, THECB, etc.) view as areas of high concern?
Audit Concern or Prior Year findings
Where are Auditors going to look and how deeply will they look
4
Ranking Methodology
For each program and process determine:
How it ranks for each type of risk
High
, Moderate, Low and then Assign numeric values to the ratings
Any variation of this
works
Place weighted values on the types of risk
Determine the overall risk level for each item
Every
School will have differences in the rankings they come up with
5
Quality Control Review - File
Take between one day and 2 weeks
Limited in scope and outcomes are specific in nature
Correcting a common error, finding notes are not detailed enough
Pull
a sample of students that participate
in
the program or who have the process touch their account/file.
30 is a good starting number for statistical purposes
Look at the specifics for the individual program or process for the students chosen.
Document what you have seen in a testing
sheet
Make recommendations on the results
6
Quality Control Review - Process
Take between 2 weeks and
3
months
Broad in scope and outcomes are both specific and general
Process runs before a piece of information is complete in a students file, providing additional opportunities does not result in student improvement,
Pull data that covers all areas of a process or program
Do data analysis on the whole data pull
Look for unexpected amounts, time delays, surprising student outcomes
Preform File review (see previous slide)
Make recommendations on the results
7
Creating a Quality Control Plan
Determine the number of staff and how much of their time will be used completing the reviews
Take the list of identified risks - determine which risks you want to focus on
Determine if you want to do file reviews or process reviews for those identified risks
Create a calendar/plan that allows you to track completion.
8
Questions
9