Case In Point: Lessons for the proactive manager

Volume 14 Number 10 | October 2022

Quotable .....

“Only those with the patience to do simple things perfectly ever acquire the skill to do difficult things easily.”

-- James J. Corbett

Last month we began a discussion about managing risk and how most stories we link each month can be described as risk management failures in some way. One of the most important tools in proactively managing risk is internal control. Internal controls are widely misunderstood yet are actually very simple when you think about it.

Risks are the things that can prevent us from achieving our objectives. Controls are the things we do to increase the odds of success in achieving our objectives and avoid harm that could be caused by the risk. For example, we have an objective to prevent fraud in our organization (though it may not be written down). The actions we take to achieve that objective are internal controls.

You implement controls in your personal life every day. For example, most people lock their doors when they leave their house. This is a control activity used to achieve your objective of preventing your property from being stolen.

Here are 5 very simple things you can do that will increase internal controls in your area of responsibility:

Never let one person have complete control of a process. You effectively have no control if you do.
Follow your intuition. Ask a question if something seems ''off.''
Don't sign something you don't understand. Proper management oversight means asking questions.
Make sure reconciliations are being done and reviewed by someone other than the reconciler.
Consider the example you are sending to other people. ''Social proof'' impacts internal controls in a powerful way – people follow your example for good or ill.

Controls can be used to manage almost all the risks we see each month in our linked articles. We invite you to review the events happening throughout higher education with a view toward strong controls, oversight, and proactive risk management. As always, we welcome your comments and suggestions.

M. Kevin Robinson, CIA, CFE
Associate Vice President
Office of Audit, Compliance & Privacy
Follow us on Twitter

Information Security & Technology Events

Oct 27: Data Breach: Michigan Medicine has announced that a recent breach could have exposed private health information. The health system is working to notify approximately 33,850 patients whose information may have been compromised as the result of a cyber attack between Aug. 15-22 directed at employee emails. According to Michigan Medicine, employees were targeted by cyber attacker with a "phishing" scam. They were sent a link that prompted employees to enter their Michigan Medicine login information. (link)

Oct 19: Ransomware: Whitworth University has informed the state attorney general's office that a data breach this summer was a ransomware attack that may have affected thousands of former and current students and staff. The notification was made in a letter dated Oct. 4 from the law firm Wilson Elser based in New York City. In the letter, the private university acknowledges for the first time publicly the data breach that occurred July 29 was a ransomware attack, a growing field of cyber crime in which hackers seize control of data and demand payment for its release. (link)

Oct 05: Mistaken Admission Message: A Massachusetts law school says it’s guilty of accidentally sending acceptance emails to thousands of former and current applicants. The Northeastern University School of Law in a statement Wednesday blamed a "technical error" for the glitch, saying the erroneous emails went to more than 200 people who applied for admission starting next fall, as well as to nearly 4,000 former applicants, some of whom are already enrolled. "The School of Law quickly sent a clarifying email explaining the error. Individual outreach is also taking place to applicants with concerns," the Boston school said. (link)

Oct 04: Cyberattack: In early September, the University of Guelph told students about what they are calling a disruption to the IT system. The Office of the Information and Privacy Commissioner of Ontario confirmed to CTV News that they are investigating. "The University of Guelph notified our office of a breach related to a cyberattack on September 19, 2022," the Commissioner of Ontario said. The school itself has declined any comment since the incident happened and has not confirmed if any data has been stolen. (link)

Fraud & Ethics Related Events

Oct 18: Extortion: A man was arraigned before Magistrate Judge Regina Cannon on charges arising from a conspiracy to extort the Georgia Institute of Technology by falsely claiming an individual associated with its basketball program committed sexual assault. The man and a female co-defendant were indicted on these charges by a federal grand jury on August 24, 2022. According to U.S. Attorney Buchanan, the indictment, and other information presented in court: the man and his girlfriend allegedly conspired with each other, and a Georgia Tech security guard, to falsely accuse an individual associated with Georgia Tech’s men’s basketball team of sexual assault. (link)

Oct 16: Academic Fraud: Cheating in college is a big problem. Surveys show that more than half of all college students admit to cheating at least once and some surveys show that figure in the 70, even 80 percent range. With no government or accrediting oversight or even awareness of academic misconduct, schools have been left on their own to try to deter it, detect it and deal with it when it happens – which is pretty nearly always. Some do it well. Others don’t do it at all. But if two Texas universities win their case in the Texas Supreme Court, the schools that actually care about cheating and academic integrity could get a new weapon in their fights. (link)

Oct 13: Occupational Fraud: A former Naugatuck resident and employee at Yale University School of Medicine was sentenced to nine years in prison for stealing $40 million in electronics. According to court documents and statements in court, beginning in 2008, the woman worked at Yale University School of Medicine in the Department of Emergency Medicine, eventually serving as the Director of Finance and Administration for the Department of Emergency Medicine. Starting as early as 2013, she began a scheme where she'd order or have others working for her to order millions of dollars of electronic hardware from Yale using Yale University School of Medicine funds and arranged to ship the stolen hardware to an out-of-state business for money in return. (link)

Compliance/Regulatory & Legal Events

Oct 27: Affirmative Action: What role should race play when you or a loved one applies to college? In the 1960s, colleges began asking about an applicant's race so that diversity would improve on their campuses. However, in recent years, it has become controversial -- with some arguing the question unfairly impacts students who aren't as diverse. On Monday, the debate over the practice, which is known as affirmative action, will be front and center at the Supreme Court. By taking up the case, it's possible justices could outlaw the practice. (link)

Oct 25: An employee working with Stanly Community College has been arrested and faces charges referring to crimes against children. According to a release from the Stanly County Sheriff’s Office, on Oct. 14 detectives arrested a success coach employed by SCC to work with college-level students. The allegations stem from a report received by the Criminal Investigations Division of juveniles enrolled at Stanly Early College, located on the SCC campus, being provided alcohol and vaping devices from an SCC employee. (link)

Oct 25: Unpaid Labor Lawsuit: Seven part-time community college professors across California have sued eight local districts where they teach and the state, claiming their job requires that they work unpaid hours preparing lessons, grading and meeting with students, court records show. They are demanding back pay, changes that will ensure they are paid for the work in the future, and for a judge to declare the suit a class action that could sweep in other part-time academics, commonly called adjuncts. As many as 37,000 adjuncts teach in the 115 colleges. (link)

Oct 25: Sex Crimes: A former campus physician at Antioch College in southwest Ohio has been charged with multiple counts of rape and other sex crimes involving 15 women between 2017 and last year. The doctor, 42, was indicted Thursday in Greene County on 50 felony and misdemeanor charges that include nine counts of rape. He served as the campus physician at Antioch from 2015 through 2019 and maintained a medical practice in Yellow Springs where the small liberal arts school is located. (link)

Oct 21: Sexual Abuse: A former obstetrician-gynecologist who spent more than three decades working for the University of California, Los Angeles, has been convicted of sexually abusing his patients. jury on Thursday found the doctor guilty of five felony counts, including three counts of sexual battery by fraud and two counts of sexual penetration of an unconscious person, according to the LA County District Attorney's office. His arrest in 2019 led thousands of women to claim sexual abuse by the doctor, and, to date, UCLA has spent about $700 million in lawsuit settlements for its alleged role in concealing the abuse. (link)

Oct 20: Faculty Contract Lawsuit: In a sharp reversal of a judge's lower court ruling in Albany, the state’s second-highest court on Thursday unanimously ruled in favor of the College of Saint Rose and reinstated its dismissal of four tenured music teachers last year. The 5-0 ruling by the Appellate Division of state Supreme Court's Third Department will also prevent the teachers from suing the college on the secondary grounds of an alleged breach of contract. (link)

Oct 20: Breach of Contract Lawsuit: ruling that would allow students from UNC-Chapel Hill and N.C. State to pursue a breach-of-contract lawsuit against their schools. The suit is related to student fees paid during the COVID-19 pandemic. A unanimous N.C. Court of Appeals panel ruled on Oct. 4 that students Joseph Lannan and Landry Kuehn could proceed with their suit. Paperwork filed Wednesday asks the state’s highest court to grant a temporary stay against the Appeals Court order. (link)

Oct 18: Foreign Influence Law: On June 18, Louisiana Governor John Bel Edwards signed into law the Higher Education Foreign Security Act of 2022 (the "Act"), imposing new policy requirements on Louisiana postsecondary education institutions. The Act takes effect July 1, 2023, and requires covered institutions to establish policies governing foreign gift reporting, screening of foreign researchers, and international travel approval and monitoring. (link)

Oct 15: Employee Settlement: The Board of Regents has agreed to pay $15 million to settle a class-action lawsuit with current and former University of Iowa Hospitals & Clinics employees. The healthcare system and about 11,000 workers have been engaged in a legal fight since 2019, when employees alleged that managers didn't pay overtime, bonuses or accrued leave as quickly as state and federal laws require. U.S. District Court Judge Stephanie Rose granted part of the workers' motion for summary judgment in March, but attorneys for the Board of Regents raised the specter of appealing that ruling. (link)

Oct 13: Title IX Lawsuit: An athlete suspended in fall 2022 for an alleged sexual assault that took place in October 2021 has sued the University, claiming that it unfairly suspended him after conducting a biased Title IX investigation, according to court documents. Smith v. Brown University was filed in Rhode Island District Court Sept. 9. A previous lawsuit dealing with the same incident, also called Smith v. Brown University, was filed in Rhode Island District Court Jan. 14, The Herald previously reported. The two parties agreed to dismiss the suit Jan. 24. (link)

Oct 08: Title IX Settlement: A Utah State student -- whose lawsuit brought to light damning footage of the university police chief’s comments about sexual assault -- will get $500,0000 from the school in a settlement, ending her high-profile case. Kaytriauna Flint’s suit was originally filed against the university nearly a year ago. It reignited allegations that USU was protecting its football players and deliberately brushing aside women when they reported being sexually assaulted by a member of the team, which Flint said happened to her. (link)

Oct 07: Sexual Abuse Settlement: Columbia University and its affiliated hospitals on Friday announced a $165 million settlement with 147 patients of a former gynecologist accused of sexual abuse by dozens of women. Among the people who have accused him of abuse was Evelyn Yang, the wife of the former presidential candidate Andrew Yang. The hospitals will establish a compensation fund to distribute the money, according to a news release from the university. The settlement follows a $71.5 million deal reached last year between the hospitals and 79 of his former patients who had been represented by a different lawyer. (link)

Oct 06: Controlled Substances Act: Yale University, on behalf of Yale Medicine and the Yale Fertility Center, has entered into a civil settlement agreement with the federal government in which it will pay a total of $308,250 to resolve allegations that it violated civil provisions of the Controlled Substances Act. In November 2020 a nurse responsible for ordering and inventorying controlled substances at the Yale Fertility Center, was discovered to have tampered with vials of fentanyl. A criminal investigation revealed that the nurse stole the fentanyl for her own use. She withdrew the fentanyl from the vials, reinjected saline into the vials and reintroduced the vials into the stock of the Yale Fertility Center to be used during surgical procedures. (link)

Oct 05: Building Name Lawsuit: Descendants of UC Hastings College of the Law’s founder sued California on Tuesday to block a scheduled name change that was signed into law by Gov. Gavin Newsom last month. The state’s first law school was founded by Serranus Clinton Hastings in 1878 after he served as the first chief justice on the California Supreme Court. But in 2020, a commission report explained how after Hastings arrived in California during the Gold Rush, he paid for and promoted expeditions in the Eden and Round Valleys of Northern California that resulted in the deaths and displacement of hundreds of Yuki Indians, whose land he later took for himself. (link)

Oct 05: Title IX Lawsuit: Two former student-athletes at Huntington University have filed suit against the school and its former track coach, claiming the university violated the athletes’ Title IX rights and failed to protect them from their predatory coach. According to the suit, the now-former Huntington University cross-country and track coach inappropriately touched female athletes, manipulated them, sexually assaulted them and injected them with substances. (link)

Oct 04: Breach of Contract: A unanimous three-judge panel of the N.C. Court of Appeals has ruled that students at UNC-Chapel Hill and N.C. State University can move forward with breach-of-contract lawsuits against their schools. The students say the schools should have refunded fees paid for services that were unavailable during COVID-related shutdowns. The university system had claimed that sovereign immunity blocked the students’ legal action. (link)

Oct 01: Defamation Lawsuit: According to his attorney, former Georgetown College President William A. Jones has filed a lawsuit against Georgetown College, its administration executives, and the Board of Trustees. The attorney says the lawsuit claims defamation, false light, and violation of Title IX rights. This stems from Jones's firing on November 1, 2021. The college fired Jones after they were informed of allegations of a sexual assault of a female employee, inappropriate behavior with another female employee, and other conduct in violation of Jones's employment agreement with the college. (link)

Campus Life & Safety Events

Oct 31: Campus Threat: A former student at Clarke University in Dubuque pleaded guilty to a terrorism charge for violent threats he made against the school. Police first arrested the man in Illinois in August. Court documents show he made a threat on social media to shoot Clarke’s president and other buildings on campus. This forced the school to go on lockdown for several hours. (link)

Oct 26: Athletic Environment: Former Iowa State University women's soccer players have accused the head coach of running a program that one parent described as a "toxic environment." As first reported by the Des Moines Register, the former players have accused the coach of verbal abuse, controlling behavior and body shaming. A former athlete at Bowling Green State University, where the man previously coached, also accused him of controlling behavior and body shaming. That player filed a Title IX complaint accusing him of sexual harassment, but the school deemed the complaint unfounded. (link)

Oct 25: Threats: A Miami University student has been taken into custody and charged with making terroristic threats after allegedly posting to social media that he would shoot parents who were in town for Family Weekend. According to police reports, a 20-year-old posted to social media this past Saturday that "I will go on a parent shooting spree tomorrow." Police records say he admitted to "knowing and being frustrated" that parents were on campus, "causing congestion." (link)

Oct 19: Threats: A former University of Hawaii employee has been federally charged for allegedly posting videos on Instagram, threatening to kill two university employees. The employee made her initial appearance at Honolulu federal court Monday after she allegedly "knowingly and willingly transmitted in interstate commerce a communication " via Instagram posts threatening to kill an employee and another employee and her family. The employee worked at the University of Hawaii at Manoa's Information Technology Services Department since 2011 and resigned Sept. 19, according to the university. (link)

Oct 18: Free Speech: A federal judge in Fresno sided with a group of politically conservative students at Clovis Community College, issuing a preliminary injunction that bars the college and its leaders from enforcing some provisions of a policy regulating posters and flyers on the campus. The students and their organization, Young Americans for Freedom, filed a lawsuit against the college’s president, Lori Bennett, and other campus officials, alleging the college leaders violated their First Amendment rights to freedom of expression when they banned their flyers from college bulletin boards in late 2021. (link)

Oct 17: Racial Issues: UC San Diego administrators have publicly apologized to students for the "disrespectful and racist remarks" that a lecturer recently made during an undergraduate class in chemistry. The incident occurred last week and involved a veteran lecturer who was bothered by noise that appeared to come from a hallway outside his classroom. The video clip was posted on Instagram, where it generated lots of angry comments. (link)

Oct 17: Shooting: At least four people were hurt early Sunday morning after a shooting on the Atlanta University Center campus, police said. Around 12:30 a.m., officers in the area responded to a Clark Atlanta University homecoming gathering where they believe two people opened fire. Police said people were listening to music played by a DJ near the Robert W. Woodruff Library. The school said two of the victims were Clark Atlanta students, the third was an AUC student and the fourth was not a student. (link)

Oct 14: Sexual Assault: Following two highly publicized reports of sexual assault on campus in recent months, hundreds of Stanford students on Friday marched to the main quad to protest what they say is the university’s lackluster efforts to prevent future rapes. Last Friday a woman was raped after a man grabbed her from her Stanford University office and dragged her into a basement. The brazen attack came just two months to the day after another woman was abducted in broad daylight from a parking lot near a Stanford dorm and forced into a bathroom, where she was raped. The widespread fear and anger among women on campus was palpable Friday as students articulated their demands to the administration, urging them to take action and demonstrate its --honest commitment to fundamental change of rape culture” at the university. (link)

Oct 13: Walk Out: More than 50 librarians at the University of Washington didn’t show up for work Thursday, taking a stand against what say are low wages and tactics by the university to stall contract negotiations. Librarians, professional staff and press workers from all three UW campuses picketed outside the main campus in Seattle on Thursday, holding signs that said "Top 10 in research bottom 10 in pay" and "We deserve a contract." (link)

Oct 10: Greek Life: The Sigma Phi Epsilon fraternity has been permanently removed from the University of Miami after allegations of misogyny and spiking drinks. A leaked video of an off-campus party on Oct.1st shows male students chanting about raping women, and what they'd do to their corpses. "It's sick and it's crazy that they are chanting it together," says UM student Patrick McCaslin. McCaslin is the student editor at the school newspaper, the Miami Hurricane, who first reported the story. (link)

Oct 06: Homicide: A man is in custody after he allegedly shot and killed a University of Arizona professor at the main Tucson campus Wednesday afternoon. In a news conference, University of Arizona Police Chief Paula Balafas said the suspect, 46-year-old man, was arrested by Arizona Department of Public Safety officers at 5:10 p.m. after a traffic stop near Gila Bend. Limited details are available about the shooting, but police said it happened in an office. The relationship, if any, between the professor and the shooter was not disclosed. (link)

Oct 05: Athletics: The head coach of the University of Texas Permian Basin women's soccer team has been put on paid administrative leave pending an ongoing investigation, according to UTPB Director of Athletics Todd Dooley. This comes after a group of players sent an email to a number of university, Lonestar Conference and NCAA members with concerns about the coach's behavior on and off the field. Last month, the coach was arrested for driving while intoxicated with an alcohol concentration of 0.15 or more, according to an arrest affidavit. At that time, the school was aware of the incident, but the coach remained at the helm of the program. (link)

Oct 05: Homicide: A Purdue University student will be charged with murder after he allegedly killed his roommate in a residence hall on the Indiana campus, according to the school's police chief. The chief and the Tippecanoe County Coroner Office identified the slain student as Varun Manish Chheda, a 20-year-old senior from Indianapolis who was studying data science. Chheda died of "multiple sharp force traumatic injuries" and the manner of death was a homicide, according to preliminary autopsy results. (link)

Oct 04: Vandalism: The Dean of Students office at Illinois State University and the campus Pride organization are condemning bigoted vandalism of Greek houses by members of a campus fraternity. Members of the fraternity Kappa Sigma vandalized three other houses over the weekend (Tri Sigma, Alpha Sigma, and Acacia House), according to the dean's office. Fraternity members spray painted derogatory slurs directed at LGBTQ+ people on the buildings. (link)

Oct 04: Campus Bomb Hoax: A Texas man has been arrested and charged with allegedly staging a hoax explosion at Northeastern University in Boston in September 2022 and providing law enforcement with materially false and misleading information about the incident. According to the charging documents, the man, who was at the time employed as the New Technology Manager and Director of the Immersive Media Lab (Lab) at Northeastern University, placed a 911 call at approximately 7 p.m. on Sept. 13, 2022, to report that he was injured by “sharp” objects expelled from a plastic case he opened inside the Lab that evening. (link)

Oct 03: Stadium Security: An Austin man was arrested over the weekend after he allegedly used false press credentials to access the Texas Longhorns game and then reportedly assaulted two University of Texas band members. On Sept. 17, police reported that a man, 55, bypassed event staff by presenting two expired press box credentials. After he entered the stadium, police said the suspect then assaulted two band members by grabbing or touching their buttocks. At the time, police reported that Torres was wearing a UT Housing and Dining shirt, and he was later identified as an employee there. (link)

Other

Oct 31: Public Records Request Fees: The University of Massachusetts Dartmouth (UMass Dartmouth) recently requested $357,400 to fulfill a public records request submitted by Campus Reform in late September. The request sought communication records between just two individuals over the course of 7 months. Ryan Merrill, Director of Strategic Communications and Media Relations at UMass Dartmouth, wrote that the search would take "14,300 hours," totaling $357,400. Ken Tashjy, a Campus Reform Higher Education Fellow and lawyer familiar with Massachusetts public record law, calculated that if "UMASS searched and compiled records for 8 hours a day, it would take 1,787.50 days to reach 14,300 hours, or 4.89 years." (link)

If you have any suggestions, questions or feedback, please e-mail Kevin Robinson at robinmk@auburn.edu or Robert Gottesman at gotterw@auburn.edu. We hope you find this information useful and would appreciate hearing your thoughts. Feel free to forward this email to your direct reports, colleagues, employees or others who might find it of value. Back issues of this newsletter are available on our web site.