Case In Point: Lessons for the proactive manager

Volume 14 Number 09 | September 2022

Quotable .....

“A wise man learns from his mistakes, a wiser man learns from others' mistakes, the wisest man learns from others' successes.”

-- Anonymous

Last month I referenced a recent fraud trend and noted that circumstances seem such that fraud will increase in the coming months in virtually all industries. The best way to prevent fraud is through strong internal controls, however, this is a term that is either misunderstood or not understood by many people. Therefore, this month we will try to begin demystifying this concept.

Controls are really at the heart of what we call risk management. Risk management is a very simple process and one we intuitively use regularly. We can break the risk management process down into five simple steps:

What are we in business to do? (The Mission)
What are the things we do to carry out this business? (The Activities)
What are the bad things that could happen (or not happen) to keep us from being successful? (The Risks)
Which of these bad things do we think are the biggest deal and the most likely to occur? (Risk Assessment)
What can we proactively do to reduce the chances that these bad things will happen and increase the chances of success? (Risk Management)

Most textbooks will note that there are 4 ways we can approach risk:

Ignore it – the least wise approach.
Live with it – sometimes this is the best response.
Transfer it – with insurance.
Manage it proactively – through internal controls.

When you look at the articles we link in Case in Point each month, the vast majority of them could be categorized as risk management failures. Since our focus with Case in Point is to promote proactive risk management, we will delve deeper into the concepts surrounding internal control next month. Until then, we encourage you to review the stories across our industry over the prior month with a view toward proactively managing risk. As always, we welcome your comments and suggestions.

Kevin

P.S. If you have a chance, take a look at our new OACP website and follow us on LinkedIn and Twitter

M. Kevin Robinson, CIA, CFE
Associate Vice President
Office of Audit, Compliance & Privacy
Follow us on Twitter

Information Security & Technology Events

Sep 20: AI: The pitch was attractive and simple. For a few thousand dollars a year, Social Sentinel offered schools across the country sophisticated technology to scan social media posts from students at risk of harming themselves or others. Used correctly, the tool could help save lives, the company said. For some colleges that bought the service, it also served a different purpose — allowing campus police to surveil student protests. (link)

Sep 13: Electronic Sign Breach: A University of Utah employee reported Tuesday afternoon that an electronic sign outside of the University of Utah Student Life Center was displaying images from a pornographic website. According to a statement from a university spokesperson, university staff members shut down the touch-screen kiosk and checked the browser history. Crews found that the breach first occurred early Sunday morning, and it appears that multiple users logged into multiple porn websites on the kiosk and displayed them on the electric sign over the next two days. (link)

Sep 12: Ransomware: About 8,000 people with some association to Napa Valley College recently received letters informing them of a possible data breach of personal information that occurred during the ransomware attack that struck NVC in June. The community college, once aware of the cyberattack that shut down the NVC website and network systems, worked with a third-party forensic firm to investigate, the letter says. On Aug. 18, the college subsequently discovered “a limited amount of personal information may have been accessed by an unauthorized third party in connection with this incident.” (link)

Sep 08: Cyberattack: People involved with Franklin College may have had personal data revealed to hackers that breached the school's network with a malicious code attack. The attack occurred on Jan. 21, and college officials held back information to determine through an investigation what data might have been taken. After an investigation was completed in June, college officials sent out a letter to individuals who could have been impacted on Aug. 29. The letter says information taken may have included the names and driver's license or state identification numbers of people involved with Franklin College. Information taken in the breach may also include social security numbers, according to Turke and Strauss LLP, a Madison, Wisconsin-based data breach law firm investigating the breach. (link)

Sep 06: Ransomware: Savannah College of Art and Design (SCAD) — an acclaimed art school in the U.S. serving more than 15,000 students — suffered a ransomware attack that leaked the sensitive information of hundreds of people. A spokesperson for the school told The Record that it recently discovered a hacker had gained access to SCAD's information network systems. They did not say what information was accessed. (link)

Sep 01: Data Breach: Tulsa Tech says someone stole data belonging to students who were enrolled in its classes between 1986 and 1999. According to the school, someone accessed the district's systems in June and took files from the network, including the names and Social Security numbers of students. Tulsa Tech sent out letters on August 18th to students who may have been impacted by the breach. (link)

Fraud & Ethics Related Events

Sep 29: Occupational Fraud: A decade after stealing about $80,000 from Northern New Mexico College, the school's former financial services director has pleaded guilty to one count of felony embezzlement as part of a plea deal which has been about five years in the making. The woman, who pleaded guilty and was sentenced at a hearing in Tierra Amarilla on Thursday, took about $200,000 worth of cash and checks meant to be deposited in the college’s bank accounts over two and a half years between 2012 and 2014, according to previous reports and court records. (link)

Sep 27: Occupational Fraud: U.S. District Judge William F. Jung has sentenced a former USF employee to 10 years in federal prison for mail fraud. According to court documents, the man was employed as an accounting manager for the University of South Florida’s University Medical Services Association (UMSA). In this position, he was involved in overseeing the administration of UMSA’s credit cards. Beginning in or around June 2014, and continuing through November 2019, he defrauded UMSA by using several of that entity’s credit cards to make $12,860,744.07 in unauthorized charges for his own benefit, including rent payments, extensive home renovations, travel, chartered yachts, and contributions to women affiliated with an interactive adult website. (link)

Sep 22: Foreign Ties: A Former Texas A&M University, College Station, material scientist pleaded guilty today to two federal charges of making false statements to NASA that hid his ties to two Chinese universities. He also agreed to repay NASA $86,876, funds awarded for a microgravity experiment to be conducted on the International Space Station. At issue was a 2010 clause attached to NASA's annual spending bill that banned the agency from funding any research involving Chinese entities. (link)

Sep 20: Bribery: A former dean at the University of Southern California pleaded guilty Monday in a bribery case involving a powerful Los Angeles politician who promised to help steer a multi-million contract to the school if his son got a scholarship and a teaching job. (link)

Compliance/Regulatory & Legal Events

Sep 28: Equal Pay Lawsuit: The University of Texas at Permian Basin violated the Equal Pay Act by paying lesser wages to a female assistant/associate professor of accounting than it paid to two males hired to perform the same job, the U.S. Equal Employment Opportunity Commission (EEOC) charged in a lawsuit filed today. The female professor began her employment on the UTPB Midland campus during the 2015-16 academic year. According to the EEOC’s lawsuit, during her employment with UTPB, two other male professors in the same department performing the same duties were paid higher wages. (link)

Sep 26: Retaliation Judgment: A jury found Friday that Purdue University violated due process and treated a student differently because she was a woman after she came forward with assault allegations against a fraternity member. Nancy Roe (not her real name) was one of two students who filed suit against the school in 2018, alleging they were expelled after making complaints to Purdue about their respective assaults. Both expulsions were turned into suspensions after Nancy Roe and the second student, Mary Doe, appealed. (link)

Sep 22: Sexual Harassment Lawsuit: A line of residents, students and former staff held up signs this week on a north-central college campus to protest the school's president, who is accused of sexual harassment and discrimination in a lawsuit. The incident came weeks after a former WC employee filed a lawsuit against the college. Shelley Gipson claims she was the victim of sexual harassment and discrimination by Farmer. Shantee Siebuhr, a former instructor at Weatherford College, said she left in August 2021 after being transferred from one position to another because of her appearance, specifically her weight and tattoos. (link)

Sep 22: NCAA Compliance: The LSU football program violated recruiting rules when a former assistant coach and former assistant director of recruiting met separately with a prospect during the COVID-19 recruiting dead period and provided the prospect with impermissible recruiting inducements, according to a decision released by a Division I Committee on Infractions panel. (link)

Sep 22: Child pornography: A researcher in UC Santa Barbara's psychological & brain sciences department was arrested in June and charged in July with possession or control of child pornography, demarcated as a serious, violent and registerable sex offense felony. Three months after his arrest, the man is still employed by UCSB as a researcher, UCSB Public Relations Manager Kiki Reyes told the Nexus in an email, saying that the university was aware of the allegations made against him. (link)

Sep 21: Discrimination Lawsuit: A former University of Wyoming employee is suing the school and several top employees for allegedly discriminating against him based on his identity as a white, heterosexual, Christian man and for his opposition to critical race theory. Plaintiff Jeffrey Lynn Wilkins, who worked for the school as an intern and part-time employee from 2015 to 2021, filed the lawsuit Monday in U.S. District Court. He's asking for more than $874,000 in compensation. (link)

Sep 21: Title IX: The Federal Department of Education's Office for Civil Rights has received multiple complaints concerning potential Title IX violations by the University of Toledo, according to a person familiar with the case. The complaints followed a Guardian investigation involving allegations of sexual assault, sexual harassment and emotional abuse by a past coach of the university's soccer program. The Toledo case has exposed a complex sports system in the United States riddled with loopholes that fails to protect athletes and young coaches from sexual harassment or abuse by those in authority. (link)

Sep 19: State Laws: A Gallatin County District Court Judge last week ruled that the state cannot enforce three laws on college campuses passed during the 2021 legislative session. The laws ban transgender athletes from participating in women's sports; prohibit groups from registering voters in dorms or dining halls; and craft new guidelines for harassment and free speech policies on college campuses. Judge Rienne McElyea ruled that all three bills infringe upon the Board of Regents' constitutional authority to govern the state's university system. The ruling invalidates the voter registration legislation and prevents the other two bills from impacting the university system. (link)

Sep 19: Indecent Exposure: On Sept. 7, an Eastern Michigan University administrator was arrested at his home by Dearborn police after a video was given to the department five days prior. On Sept. 2, Dearborn Police department received cell phone video of a male driver in a black Jeep Wrangler heading westbound on Michigan Avenue near Miller street without any clothing on, touching himself. The Wayne County prosecutor's office charged the man with one misdemeanor count of aggravated indecent exposure and one felony count of indecent exposure with sexually delinquent person notice. (link)

Sep 15: Firing Lawsuit Settlement: The University of Connecticut and former men's basketball coach Kevin Ollie have reached a settlement of $3.9 million for claimed reputational damages and attorney's fees to conclude the lengthy legal battle that has ensued between them since his firing for allegedly violating NCAA rules in 2018. The settlement effectively ends a potential federal race discrimination suit Ollie had considered against the university. (link)

Sep 14: Sex Abuse Lawsuits: A federal appeals court ruling Wednesday revives unsettled lawsuits against Ohio State University over decades-old sexual abuse by the late team doctor Richard Strauss. A district judge in Columbus had dismissed most of the unsettled cases, acknowledging that hundreds of young men were abused but agreeing with the university's argument that the legal time limit for the claims had long passed. The plaintiffs argued that the clock didn't start until the allegations came to light in 2018, and that their cases should be allowed to continue. (link)

Sep 13: Title IV Investigation: The US Department of Education's Office for Civil Rights (OCR) has opened a formal civil rights investigation into allegations of antisemitism at the University of Vermont (UVM). According to a complaint filed by the Brandeis Center in October 2021, UVM's Hillel Center was vandalized and Jewish students who embrace Zionism were harassed by a teaching assistant and expelled from student clubs, including UVM Empowering Survivors, a sexual assault awareness group. Hostility toward Jews, the Brandeis Center said, was so severe that Jewish students concealed their identities and weighed leaving the university altogether. (link)

Sep 13: Hiring Lawsuit: Students and staff at Seattle Pacific University are taking members of school's board of trustees to court for refusing to hire individuals in same-sex relationships. The lawsuit alleges that the six defendants, members of the university's board of trustees, use their position of power to "advance the interests of a religious denomination at the expense of the students, alumni, staff, and faculty of the university." The lawsuit argues that though the university may be faith-based, its primary function is education. Additionally, the lawsuit says that SPU is incorporated under the Washington Nonprofit Corporation Act and doesn't meet the definition of a religious corporation. (link)

Sep 12: Public Records Lawsuit: The City of Palm Springs is suing College of the Desert for what it alleges to be a lack of compliance with the California Public Records Act. The law requires public agencies to make public documents available upon request in a timely manner. The city says COD has not done that. The lawsuit is an escalation of tension brewing between the city and the college on this topic. (link)

Sep 12: Discrimination Lawsuit: A University of Texas at Austin professor has sued Texas A&M University claiming a new faculty fellowship program designed to increase diversity at the flagship university in College Station discriminates against white and Asian male candidates. Richard Lowery, a finance professor at UT-Austin who is white, filed the federal class-action lawsuit on Saturday against the Texas A&M University System and its board of regents; Annie McGowan, Texas A&M's vice president and associate provost for diversity; and N.K. Anand, Texas A&M's vice president for faculty affairs. (link)

Sep 11: Sexual Abuse: A professor at the University of Kentucky is behind bars on several charges, including sexual abuse. According to court records, the university's Department of Communications chair was arrested and charged with sexually abusing a child under the age of 12, sodomy and incest. A school spokesperson said the issue is being taken seriously and that the man is on administrative leave. (link)

Sep 02: Lewd Proposals: An OU faculty member is on administrative leave after being charged with making lewd proposals and sending obscene material to a minor. An assistant professor for the OU Gaylord College of Journalism and Mass Communication was arrested Aug. 23 after meeting with a Cleveland County deputy who posed online as a 14-year-old female, according to a district court affidavit. The contact stemmed from an investigation into “sexual predators using telecommunication devices to solicit sexual conduct with minors.” (link)

Sep 02: Open Records Laws: Attorney General Eric Schmitt's office is seeking emails from the Columbia Missourian and two MU journalism school professors in an apparently unprecedented attempt to access journalists' communications. Schmitt — the Republican nominee for Missouri's open U.S. Senate seat — used the state's open records law in June to request three years of some emails sent and received by the professors. The request appears to center around the Missourian's collaboration with PolitiFact, a nonpartisan newsroom that fact-checks statements by public officials. (link)

Sep 01: Lawsuit Settlement: Texas Tech paid former women's basketball coach Marlene Stollings approximately $740,000 in settling a lawsuit she filed after being fired by the school in 2020, according to a USA Today report. The newspaper obtained the settlement information through a public records request. The lawsuit was settled earlier this month, as Stollings alleged discrimination and retaliation against the school and athletic director Kirby Hocutt. On Aug. 6, 2020, Hocutt fired Stollings, a day after a USA Today report alleged that Stollings had created a toxic and abusive culture within the Texas Tech program. (link)

Sep 01: Title IX Policies: The House chairman of the Legislature's Joint Government Operations Committee is unilaterally ordering state universities to suspend any policies making LGBTQ students a protected class amid federal litigation. In a letter to East Tennessee State University President Brian Noland, state Rep. John Ragan notified the university that because a federal court enjoined the U.S. Department of Education from putting the guidance by the Biden Administration in place, colleges and universities in Tennessee could be violating state law if they follow the guidelines. (link)

Campus Life & Safety Events

Sep 27: Free Speech: The University of Idaho is prohibiting staff from promoting or providing abortion services while performing their jobs, warning they could be fired or face misdemeanor or felony convictions if they do, according to an email reportedly sent to staff on Sept. 23. The university claimed the new guidance aims to make sure it operates within the confines of state laws, according to the memo obtained by the Idaho Press. (link)

Sep 24: Religious Issues: University of North Carolina Charlotte Chancellor Sharon Gaber apologized Friday after a video showed a campus police officer handcuffing a follower of the Sikh faith for having a knife in the university's student union. "Further investigation showed the item was a kirpan, an article of faith in Sikhism," Gaber said in a message to the campus community posted on the university's website, UNCC.edu. Initiated Sikhs must have such articles of faith with them at all times, according to the Sikh Coalition, an organization that defends the civil rights of members of the religion. (link)

Sep 22: Free Speech Settlement: The Alliance Defending Freedom is calling it a victory for free speech on public university campuses. The University of North Texas will pay out $165,000 to math professor Nathaniel Hiers after it fired him for writing a joke about ‘microaggressions' on a chalkboard. ADF attorney's filed a lawsuit after they say the university admitted to firing Hiers after he wrote, "Please don't leave garbage lying around," with an arrow pointing to the flyers warning about microaggressions. Lawyers say the head of the math department fired Hiers a week after he wrote the note, in part, because he did not express "honest regret" about his actions. (link)

Sep 22: Stalking: A Penn State professor is facing charges for allegedly stalking another faculty member in a University Park building throughout the summer. An assistant research professor in the College of Earth and Mineral Sciences was accused on Thursday of following the woman in the Willard Building on multiple occasions and using a cell phone to attempt to take photos up her skirt. The woman told a Penn State police investigator that the alleged stalking had caused her fear and anxiety for which she planned to seek treatment. (link)

Sep 22: Threat: A student at the University of Utah was arrested Wednesday after she allegedly threatened to detonate a nuclear reactor on campus if the football team lost to San Diego State last weekend. The 21-year-old woman posted the threats on an anonymous social media app called Yik Yak before Saturday's game, Salt Lake City radio station KSL reported. (link)

Sep 20: Hazing Settlement: Virginia Commonwealth University has agreed to pay $995,000 to the family of Adam Oakes, a student who died last year from alcohol poisoning at a fraternity party and whose death drew renewed scrutiny of hazing in Greek organizations across the country. The university said in a statement on Friday that, in addition to the payment, it had agreed to make changes to its fraternities and sororities, including requiring that the alcohol served at their events be provided by a licensed third-party vendor; offering more hazing prevention training; and dedicating Feb. 27 — the day Mr. Oakes, a 19-year-old freshman, was found dead in 2021 — as a day of remembrance for Mr. Oakes, and for hazing prevention. (link)

Sep 16: Religious Freedom: Yeshiva University abruptly announced on Friday that it had placed all undergraduate club activities on hold, the latest maneuver in the legal battle by the Modern Orthodox Jewish institution to keep from recognizing an L.G.B.T.Q. student group. The move came two days after the U.S. Supreme Court had ordered the university to recognize the student group. In a 5 to 4 vote, the justices said the university would first have to make its arguments in New York State courts before returning to the Supreme Court. (link)

Sep 14: Campus Safety: A Northeastern University staff member was injured Tuesday when a package he was opening detonated on the Boston campus, officials said. “The staff member sustained minor injuries and is being treated,” Shannon Nargi, a spokesperson for Northeastern University, told CNN in an email. The package was delivered to Holmes Hall, Nargi said. The staffer, a 45-year-old man, suffered hand injuries, Boston Police Superintendent Felipe Colon said during a news conference Tuesday night. Investigators haven't said how the package arrived at the campus and stressed the investigation is ongoing. (link)

Sep 12: Racial Issues: Around 11 p.m. on September 7 someone placed a noose on the head of the Homer statue on the grounds of the University of Virginia. A UVA Grounds Security Officer discovered the noose the next morning around 4 a.m. Officials say security footage shows a person "climbing up the statue, placing a noose around the neck, and leaving the area on foot." The incident is being investigated as a hate crime. (link)

Sep 02: Campus Alert System: A false active shooter warning sent out to the entire Amherst College campus last Friday, startling students and staff alike on the day new students moved in, was the result of a mistake by the software company behind the school's alert system, the college announced Thursday. The reports of a gunman on campus arrived around midday. Just before noon, Amherst College President Michael Elliott said school administrators realized some students had received notifications over the school's threat warning system, which can alert the campus to a dangerous situation by text, email and other methods. (link)

Sep 01: Campus Threat: A former Lehigh University student has threatened current students, leading to charges and increased security on the Bethlehem campus, authorities say. The threat was reported about 7:30 p.m. Sunday to university police, a warning posted on university media says. Bethlehem police have charged the student with terroristic threats and harassment — both misdemeanors -- records show. (link)

Sep 01: Indecent Exposure: A man is facing charges after being accused of exposing himself to a Florida International University student and preventing her from leaving a classroom. "It makes me feel like women here are unsafe," says FIU student Leslie Lopez. "There needs to be more security here." The man, who is listed by police as being homeless, then fled in an unknown direction. (link)

If you have any suggestions, questions or feedback, please e-mail Kevin Robinson at robinmk@auburn.edu or Robert Gottesman at gotterw@auburn.edu. We hope you find this information useful and would appreciate hearing your thoughts. Feel free to forward this email to your direct reports, colleagues, employees or others who might find it of value. Back issues of this newsletter are available on our web site.