Case In Point: Lessons for the proactive manager

Volume 13 Number 09 | September 2021

Quotable .....

“You have to think a little smarter, be proactive, not reactive.”

-- Frank Abagnale

Last month, we offered our suggestions for the best way to use Case in Point when it hits your inbox each month. We believe Case in Point does a good job of helping you become aware of the risks within higher education, but simply having that knowledge is not enough to protect your organization. With that in mind, we turn our attention to the topic of developing a proactive risk management culture within your organization.

At its heart, risk management is a very simple process and one we intuitively use regularly. We can break the risk management process down into five simple steps:

What are we in business to do? (The Mission)
What are the things we do to carry out this business? (The Activities)
What are the bad things that could happen (or not happen) to keep us from being successful? (The Risks)
Which of these bad things do we think are the biggest deal and the most likely to occur? (Risk Assessment)
What can we proactively do to reduce the chances that these bad things will happen and increase the chances of success? (Risk Management)

Next month we will continue this topic with a focus on how you might incorporate this process into your organization's culture. The five steps are fairly easy to walk through—the culture is often the real challenge for most organizations.

As you reflect on this month's stories across higher education, we hope you will look through the lens of the risk management process and consider how you can proactively increase the odds of success. As always, we invite your comments and suggestions.

M. Kevin Robinson, CIA, CFE
Associate Vice President
Office of Audit, Compliance & Privacy
Follow us on Twitter

Information Security & Technology Events

Sep 14: Data Breach: A massive data breach at University of New Mexico Health may have allowed a third party to obtain certain medical records from 600,000-plus patients -- more than a quarter of the state's population. UNM Health has been mailing letters to affected patients who had been treated at either UNM Hospital, UNM Medical Group or the UNM Sandoval Regional Medical Center, hospital officials said in a news release. The breach happened May 2 and UNM learned of it June 4, according to the release. Dr. Michael Richards, senior vice chancellor for clinical affairs for the UNM Health System, said in a video posted to the health system's website that patient names, medical record numbers and Social Security numbers were among the information obtained during the data breach. He said patient electronic medical records were not involved in the hack. (link)

Sep 07: Ransomware: Howard University announced Monday that they are investigating a ransomware attack and canceled classes through Wednesday. According to school officials, their information technology team detected unusual activity on the school's network last Friday. Due to the unusual activity, the school's Enterprise Technology Services (ETS) intentionally shut down the university's network to investigate. An alternative Wi-Fi system will be deployed on campus, but won't be available until Wednesday. (link)

Sep 02: Data Breach Lawsuit: A Syracuse University student affected by a data breach that exposed the names and Social Security numbers of nearly 10,000 students, alumni, and applicants is suing the university for negligence. The class action lawsuit, which was filed in Onondaga County Supreme Court on Thursday, alleges that inadequate cybersecurity protocols and poor staff training at SU left thousands of people's personally identifiable information vulnerable. The plaintiff filed the case after an unauthorized charge was made to his checking account following the breach. He is requesting a trial by jury. (link)

Fraud & Ethics Related Events

Sep 21: Misuse of Grant Funds: Acting United States Attorney G. Norman Acker, III, and AmeriCorps OIG today announced settlements with the University of North Carolina at Chapel Hill, East Carolina University, and the North Carolina Commission on Volunteerism and Community Service requiring the total payment of $842,500 to the United States for alleged false claims for AmeriCorps grant funds. Based on its investigation, the United States contends that UNC-CH, ECU, and NCCV caused false certifications for service hours worked and related violations of grant requirements in connection with grant funds paid from 2014 through 2019. The United States contends that these actions constituted a misuse of grant funds and harmed AmeriCorps programs. (link)

Sep 20: Phone/Email Scams: Four scams in the last 10 days--one involving elaborate videoconferencing and caller ID spoofing--have defrauded BU students of thousands of dollars, in one case $150,000. The Boston University Police Department (BUPD) is strongly suggesting protective precautions by students. "Some schemes are designed to capitalize on a fear of not cooperating with government authorities and many seem to target the Asian community," the BUPD says in an email sent to the University community Thursday. Two of the incidents involved phone scammers claiming to be Chinese government officials. (link)

Sep 19: Theft: Toronto police are searching for a woman who allegedly stole a truck from the University of Toronto early Saturday morning. Police said officers responded to a call for a stolen truck in the area of St. George Street and Sussex Avenue at around 4 a.m. Investigators said a woman rode her bike into an underground parking lot before allegedly breaking into an office and stealing keys to the truck. She then fled the area in the white 2014 Nissan Frontier extended cab pick up truck. Police said the truck is also adorned with the University of Toronto emblem bearing Ontario marker #AH 72949. (link)

Sep 15: Admissions Scandal/Bribery: The former head coach of men and women's tennis at Georgetown University has agreed to plead guilty in connection with soliciting and accepting bribes to facilitate the admission of prospective Georgetown applicants and failing to report a significant portion of those bribe payments on his federal income taxes. As set forth in the charging document, the coach solicited and received bribe payments from William "Rick" Singer and prospective Georgetown applicants to facilitate their admission to Georgetown as student athletes. The coach then failed to report a significant portion of those bribe payments on his federal income tax returns. (link)

Sep 15: Conspiracy & Money Laundering: A former University of Miami professor, his wife and his sister are facing federal charges related to purchasing genetic sequencing equipment from U.S. manufacturers and illegally shipping it to Iran, prosecutors said. The professor, his wife, and his sister made their initial appearances Tuesday in Miami federal court, according to court records. All three are charged with conspiring to commit an offense against the United States and conspiring to commit money laundering, as well as several other charges. (link)

Sep 08: Unethical Financial Decisions: Fayetteville State University administrators violated policy and acted unethically in landscaping contracts worth nearly $2 million, a state audit investigation shows. The North Carolina Office of the State Auditor investigated the "fraud, waste, and abuse allegations" and presented the findings in a report released Wednesday. The report concluded that the contracts did not get required approvals per university policy and that one administrator circumvented the rules to move them forward. The report revealed incomplete policies, administrators' lack of knowledge and a failure to "demonstrate a commitment to integrity and ethical values" at FSU. (link)

Sep 07: Money Laundering: A former administrator at the Yale School of Medicine was charged with fraud and money laundering after stealing up to $30 million from the school in an elaborate scheme of purchasing and reselling computer hardware. The administrator, who most recently served as the director of finance and administration for Yale's Department of Emergency Medicine, orchestrated an eight-year money laundering scheme to steal computer hardware from the School of Medicine. She started working for Yale in 2008 and, at most, five years later began to illegally purchase and resell the hardware using funds from the School of Medicine. (link)

Sep 02: Billing Fraud: The federal government has accused the University of Pittsburgh Medical Center and the head of its cardiothoracic surgery department of fraudulently billing Medicare and Medicaid for complex surgeries. The complaint, filed Thursday in federal court in Pittsburgh, Pennsylvania, claims that UPMC has regularly allowed James Luketich to book as many as three complex surgeries at the same time, going back and forth between patients and not participating in key parts of the surgeries, while keeping patients under unnecessary anesthesia. (link)

Sep 01: Financial Aid Scam: California student aid official Patrick Perry was beginning a routine check of federal financial aid records a few weeks ago when he came across a mystifying number: 60,000 more aid applications from a particular group of students this year than last. They were first-time applicants to California community colleges who were older than 30, earned less than $40,000 annually and were seeking a two-year degree rather than a vocational certificate. They were spread out across the state, applying to 105 of the 116 campuses in the California Community Colleges system -- with the top number at Cerritos, Pasadena, Chaffey, Merced and Antelope Valley. And their applications began surging in May through mid-August. (link)

Sep 01: Identity Theft: A woman's been sentenced to four years in prison, in a money laundering case involving dozens of University of Iowa employees. Investigators say Florence Rosale Julio of Brunswick, Georgia used University of Iowa employee information to get nearly a half million dollars in tax refunds. The overall scheme involved more than $1,400,000 in fraudulently obtained funds passed through the accounts in 2015. The Internal Revenue Service says she laundered money in bank accounts, which were opened under a fictitious name. Investigators say she also bought a new Mercedes Benz. (link)

Compliance/Regulatory & Legal Events

Sep 24: Retaliation Lawsuit: A Collin College professor who alleges she was pushed out of her job for challenging the school's COVID-19 response is now suing the school. Suzanne Jones was told in January that her contract with the school would not be renewed at the end of the semester. She and fellow professor Audra Heaslip both had previously questioned publicly how school officials were handling the coronavirus pandemic. Now, Jones has filed a federal lawsuit against Collin College, President Neil Matkin and Toni Jenkins, the former senior vice president of campus operations, claiming she was retaliated against for speaking out on pandemic concerns. (link)

Sep 22: Sex Abuse Lawsuits Dismissed: A federal judge dismissed some of the biggest remaining lawsuits over Ohio State's failure to stop decades-old sexual abuse by now-deceased team doctor Richard Strauss, saying Wednesday it's indisputable Strauss abused hundreds of young men but agreeing with OSU's argument that the legal window for such claims had passed. Roughly 400 men and one woman had sued the university since 2018 over its failure to stop Strauss despite concerns they say were raised with school officials during his two-decade tenure, as far back as the late 1970s. Many of the accusers say they were fondled in medical exams at campus athletic facilities, a student health center, his home and or an off-campus clinic. (link)

Sep 21: Title IX Settlement: In an explosive report, the U.S. Department of Justice on Tuesday castigated San Jose State University over its handling of female athletes' sexual abuse allegations against a longtime sports trainer -- and its retaliation against employees who tried to protect them. The university agreed to pay $1.6 million to the victims -- $125,000 apiece -- and overhaul its Title IX office and its process for responding to sexual harassment complaints in a settlement agreement with the Justice Department's Civil Rights Division and the U.S. Attorney's Office. (link)

Sep 21: NCAA Violations: The NCAA has found that a former Georgia Tech women's basketball coach committed Level II violations for requiring team members to exceed daily and weekly time limitations for countable athletics activities. The NCAA also placed Tech on three years of probation. The penalty will be added to the probation that the school already is serving for recruiting violations committed within the men's basketball team and be completed in September 2026. (link)

Sep 20: Contract Lawsuit: Was UCLA being vindictive while advocating for equality, justice and respect? That's the contention of Under Armour, which has countersued the school in their ongoing dispute by alleging that UCLA covered its former apparel company's logo as part of a retaliatory move. In a lawsuit filed this month in Los Angeles Superior Court, Under Armour contended that it did not receive the expected marketing return on the millions of dollars' worth of products it provided to UCLA prior to the 2020-21 school year because the school unnecessarily obscured its logo on football, baseball and men's and women's basketball jerseys. (link)

Sep 20: Title IX Lawsuit: A Rowan University student has filed a federal lawsuit accusing school officials of failing to take her complaints seriously about being sexually assaulted on campus and blaming her for the assaults. The woman, who NJ Advance Media is not identifying as she is an alleged sexual assault victim, alleges that in January 2019 she reported to a disability coordinator advisor at the university that she had been raped by another student in a campus dormitory on two separate occasions the year prior. The lawsuit accuses the university of violating Title IX, a federal civil rights law that prohibits discrimination on the basis of sex in education programs and activities, including sexual violence. (link)

Sep 17: Prostitution-Payor Charge: A Trinity University Assistant Police Chief is on administrative leave after he was arrested by San Antonio police Thursday evening in an alleged prostitution sting. He was charged with felony prostitution-payor, a state felony, after SAPD's vice unit conducted surveillance on the West Side. Trinity University Public Relations Manager Carla Sierra confirmed the Assistant Police Chief's employment with the school. (link)

Sep 15: Hostile Environment/Harassment Lawsuit: In a lawsuit filed Wednesday, rape survivor Ava Stokes accused Georgetown College, her volleyball coach, and multiple college administrators of attempting to silence her after the attack, and failure to provide security that would've prevented the attack. Cody Arnett, 36, was convicted in July of the 2018 rape and the jury recommended he serve life in prison. After Stokes' assault, representatives of the college created a hostile environment, harassed Stokes, and "attempted to silence her in order to cover up her story," the lawsuit alleges. (link)

Sep 14: Discrimination Court Ruling: A transgender professor who was denied a promotion more than a decade ago must be reinstated with tenure at Southeastern Oklahoma State University because the school discriminated against her, a federal court ruled this week. Rachel Tudor, who was fired from the university in 2011, won a landmark civil rights discrimination case in 2017 in which a jury awarded her more than $1 million in damages. (link)

Sep 10: As part of his "Path out of the Pandemic Plan", President Joe Biden said on Thursday that large private companies must require employees to get vaccinated against COVID-19 or provide proof of negative tests weekly. That general directive may also apply to thousands of institutions of higher education that do not yet have those requirements in place for faculty, staff and administrators. According to the new rule, any business with 100 or more employees must comply under a rule being implemented and overseen by the Occupational Safety and Health Administration (OSHA). Though the Administration's guidance is focused heavily on businesses and K-12 schools, colleges likely will need to follow suit, even in states where bans on vaccine passports exist and where there has been a reluctance to implement them. (link)

Sep 08: Title IX Lawsuit: Four more women and a man have now joined those suing Eastern Michigan University connected to numerous sexual assaults reported at the school. The five individuals filed a new Title IX lawsuit Wednesday evening in U.S. District Court for the Eastern District of Michigan and brought the total to 24 people alleging cover-ups, mishandlings, and deliberate indifference that left them to vulnerable to assaults they endured. (link)

Sep 03: Abuse Lawsuit: A federal lawsuit filed this week claims the former head women's volleyball coach at the University of South Alabama sexually harassed and physically and emotionally abused her players for several years. The plaintiffs in the suit are former South Alabama volleyball players. The complaint also alleges that the coach physically and sexually abused her players, pinching each players buttocks as they exited the team bus, and forcing them to engage in "floor hugs" in which team members laid on the ground while the coach laid on top of them. (link)

Sep 01: Title IX/Negligence Lawsuit: A former Syracuse University student is suing the university and two of its officials, claiming they were "deliberately indifferent" and negligent to her complaints of assault and sexual harassment by a former lacrosse player. The lawsuit, which was filed Monday in the U.S. District Court for the Northern District of New York, names Director of Athletics John Wildhack and former men's lacrosse coach John Desko, as well as SU, as defendants. SU officials violated federal Title IX policies and failed to appropriately address reports that the player had assaulted multiple students, the civil rights action alleges. (link)

Sep 01: Breach of Contract Lawsuit: Former Washington State football receiver Kassidy Woods has filed a federal lawsuit against WSU and its head coach, Nick Rolovich, accusing them of breach of contract, violating his civil rights and covering up COVID-19 cases in athletics. Woods, who recently transferred from WSU to Northern Colorado, left the team last year after a public spat with Rolovich stemming from his decision to opt out of the 2020 season because of health concerns related to the pandemic, according to the lawsuit. (link)

Campus Life & Safety Events

Sep 27: Abuse Allegations: Tears swelled in Dana Joubert's eyes when she saw her daughter, Mikayla Hayes, at a 2017 basketball invitational during Thanksgiving. It was the first time Joubert had seen her daughter since she started playing basketball at UF. She anticipated minor changes typical in many college freshmen: a little weight gain, a new hairstyle and an updated fashion sense. Instead, Hayes' face was dotted with acne. She had put on an amount of weight that looked unusual on her skinnier frame. She was almost unrecognizable. Every time Hayes returned to their Minnesota home, Joubert noticed she appeared less and less like herself. Around Christmas, she told her mother that her head coach hated her and the other freshmen players. (link)

Sep 27: Drugging: Two thousand students surrounded the Alpha Epsilon Pi fraternity house, spilling into Lincoln Street. The crowd stood still, holding a moment of silence in solidarity with the individuals drugged at the house Thursday. The protest, held outside the on-campus houses of Sigma Alpha Epsilon and AEPi Sunday night, followed two University Police crime notices. The first reported multiple druggings at the AEPi house, and the second, sent just a day later, reported a drugging at the SAE house. The Saturday notice identified both addresses as on-campus fraternity houses, though the Friday notice did not. Neither notice identified the fraternities by name. (link)

Sep 25: Hazing Death: Eight people were arrested and three others indicted on Friday after an investigation into the death of Adam Oakes, a student at Virginia Commonwealth University who died in February from alcohol poisoning at a fraternity party, the authorities said. All eight who were arrested face charges of unlawful hazing of a student, the Richmond, Va., police said in a statement. Three of them face an additional charge of buying and giving alcohol to a minor. All eight are V.C.U. students, and seven of them were enrolled in the fall 2021 semester, according to a statement from the university. (link)

Sep 24: Harassment: The USC Title IX office found "sufficient evidence" a longtime Song Girls coach body shamed, harassed and retaliated against several former spirit squad members from 2016 until her resignation in 2020, creating an environment within the program investigators deemed "hostile and unhealthy." In a letter from USC's Office of Equity, Equal Opportunity and Title IX dated Wednesday and obtained by The Times, USC vice president and Title IX coordinator Catherine Spear concluded the coach was responsible for violating university policies regarding harassment and retaliation in her capacity as coach of the Song Girls. (link)

Sep 19: Shooting: A shooting on the campus of North Carolina Central University in Durham killed two people Saturday night, and locked down a stadium full of fans. The Durham Police Department said two men were shot in the surface parking lot next to the Latham Parking Deck on East Lawson Street. The men were taken to the hospital, where they died. In a statement Sunday afternoon, NCCU officials said the incident "involved individuals who are not part of the university's community." (link)

Sep 14: Masks & Health Accommodations: Edgewood College denied an online teaching request from a professor on the autism spectrum who struggles with wearing a mask, saying that granting such an accommodation would be an "undue burden" on the school. The small Catholic college offered tenured English professor Susan Rustick, 68, an alternative -- teach without a mask behind a plexiglass barrier -- but Rustick's doctor disapproved of the idea, citing safety concerns. And so, on the day before classes began last month, emails show the college relieved Rustick of her teaching assignments and halted her pay the next day. (link)

Sep 13: Assault: The University of Western Ontario is reeling after a first-year student died of his injuries following an early-morning assault and police opened a separate investigation into social-media reports of young women being drugged and subject to sexual violence at a university residence. Gabriel Neil, 18, died in hospital on Sunday after an assault early Saturday near campus in London, Ont. A 21-year-old male has been charged with manslaughter. In an e-mail Monday, a London Police spokesperson said that assault was not believed to be connected to the allegations of sexual violence at a campus residence this weekend. (link)

Sep 13: Threats: A student at the Massachusetts College of Liberal Arts has been arrested and banned from campus after police say he made threats on social media targeting residence halls. The student is facing a felony charge of threats of a deadly weapon and disruption of school or public building and a misdemeanor charge of disorderly conduct. (link)

Sep 10: Assault: A Penn State professor is facing misdemeanor charges -- and has been put on administrative leave pending an investigation -- after allegedly assaulting a counterprotesting student during an Aug. 27 pro-vaccine rally. According to the criminal complaint, a 36-year-old assistant professor of English and African American studies is accused of trying to take the counterprotester's sign, pulling him to the ground and then injuring him during the ensuing scuffle in front of Old Main. (link)

Sep 08: Masking on Campus: The American College Health Association recommends vaccination requirements for all on-campus higher education students for the fall semester. The Centers for Disease Control and Prevention recommends face coverings, regardless of vaccine status, for indoor public spaces in areas where the rate of infection is high. But this is not how it has worked out on more than a few campuses. More than 1,000 colleges and universities have adopted vaccination requirements for at least some students and staff, according to The Chronicle of Higher Education. In an indication of how political vaccination has become, the schools tend to be clustered in states that voted for President Biden in the last election. (link)

Sep 07: Penalizing Unvaccinated: After months of coaxing students with thousands of dollars in prizes -- everything from gift cards to sports tickets to free parking -- colleges are starting to punish the unvaccinated. The institutions started the summer by waving the prospect of scholarships, laptops, game consoles and more in front to students who got a Covid-19 shot. Now, as millions move back to campus, hundreds of schools are mandating vaccines and penalizing students who resist without a medical or religious reason. (link)

Sep 01: Racial Issues/Threats: Stanford is prohibiting a student from "entering Stanford's campus or facilities," Stanford president Marc Tessier-Lavigne announced in a Monday email. The announcement comes a day after the University denounced the student for his racist and violent social media posts and said it is working to take action to ensure the safety of the community. Monday's email cited Vinci's racist posts from the weekend -- including ones containing violent imagery directed toward a Black student and faculty member -- and subsequent misogynistic and otherwise offensive posts as reason for the ban. (link)

If you have any suggestions, questions or feedback, please e-mail Kevin Robinson at robinmk@auburn.edu or Robert Gottesman at gotterw@auburn.edu. We hope you find this information useful and would appreciate hearing your thoughts. Feel free to forward this email to your direct reports, colleagues, employees or others who might find it of value. Back issues of this newsletter are available on our web site.