Case in Point
Case in Point: Lessons for the Proactive Manager
“Risk comes from not knowing what you’re doing.” – Warren Buffett
This week, I’m attending ACUA’s annual AuditCon in New Orleans with members of our Internal Audit department. I’ll share insights from this conference in coming months, but for this issue of Case in Point, I asked Kristin Roberts, Assistant Vice President for Institutional Compliance & Privacy, to give us some insight into the implications of the U.S. Department of Treasury’s Office of Foreign Assets Control (OFAC)’s recent enforcement action.
Typically, in higher education we think of OFAC (Office of Foreign Assets Control) as an export control requirement limited to the research enterprise. Contracts, grants, and collaborations with foreign institutions and individuals are likely screened by your research security offices and tightly controlled. However, OFAC is much broader and can present additional compliance requirements and risks for your institution.
This spring, IMG Academy was fined $1.72 million for accepting tuition payments from two people on the Sanctioned Entity List. U.S. persons are prohibited from transacting with Specially Designated Nationals (SDNs) under the U.S. Department of the Treasury’s sanctions. The rule applies to individuals and organizations on a strict liability basis, meaning that if a transaction occurs, it is a violation.
To prevent an incident, we must conduct proper due diligence. First, conduct a risk assessment to identify where international transactions are occurring. You likely already track these transactions to comply with the Higher Education Act Section 117 reporting requirements. Next, develop a policy or guidelines and procedures to put employees on notice of legal requirements and document your controls and screening activities. Lastly, conduct training with targeted employees to socialize the policy, reinforce procedures, and require voluntary self-disclosure if a violation is detected.
Additionally, on August 24, 2026, OFAC launched "Operation Economic Outcast," a major campaign to expand sanctions, suspend general licenses, and designate nearly 60 new Iran-related individuals and entities. OFAC suspended several general licenses that previously authorized certain payments to Iran and Iranian access to the U.S. academic system. This included suspending Iran’s General License G thereby prohibiting providing educational services (online classes, admissions, and standardized testing) to students physically located in Iran or located in another country outside the U.S. but ordinarily resident in Iran.
Institutions should evaluate whether any of its programs and services are impacted by this updated OFAC restriction and take any necessary action to avoid a violation.
Establishing a sanctions compliance program can significantly reduce your potential exposure and mitigate any resulting civil monetary penalties. For additional guidance, review the DOT’s A Framework for OFAC Compliance Commitments.
Thank you for that explanation and your suggestions, Kristin. Higher education risk professionals certainly need OFAC policies on their radar, but it is just one of many risks we assess and mitigate each day. We invite you to review the news stories from this month with an eye toward proactively managing risk at your institution.
M. Kevin Robinson, CIA, CFE
Vice President
Institutional Compliance & Security
Office of Audit, Compliance & Privacy
Follow us on LinkedIn
Information Security & Technology Events
Sep 23: OpenAI agent hacking attempt targets University of New Mexico digital library - AI: A research lab says an OpenAI agent targeted the University of New Mexico's digital library in multiple hacking attempts but did not successfully breach the system. Transluce reported the attempts and said agents targeted UNM's digital library in May 2026. They reported the activity included a direct attack and attempts through third-party relay services.
Sep 23: Stanford faces backlash after AI turns Latino student into Black woman in promotional image - AI: Stanford University is facing criticism after its Residential & Dining Enterprises department used artificial intelligence to replace a Latino male student with a Black woman in a promotional image, a move the university says violated its own policy.
Sep 21: Dartmouth to Pay $750,000 to Settle Suit Over Oracle Data Breach - Data Breach Settlement: Dartmouth College agreed to pay $750,000 to settle a proposed class action alleging the Ivy League school failed to protect the personal information of more than 96,000 people exposed in a data breach affecting its vendor Oracle Corp.
Sep 21: $3.5M University of Hawaii data breach class action settlement - Data Breach Settlement: The University of Hawaii agreed to a $3.5 million class action settlement to resolve claims it failed to prevent a 2025 data breach that compromised sensitive research participant information stored at the University of Hawaii Cancer Center.
Sep 20: Columbia to settle June 2025 data breach lawsuit for $16.1 million - Data Breach Settlement: Columbia agreed Monday to pay $16.1 million to settle a class action lawsuit over a June 2025 data breach which exposed the personal information of nearly 870,000 applicants and University affiliates.
Sep 13: UGA police IT worker demoted for misusing Flock cameras, school says - Privacy: A civilian employee with the University of Georgia Police Department (UGAPD) has been disciplined for allegedly misusing the office's Flock camera system. The employee, who has not been identified, works in the IT department. His use was discovered during an audit, and he was suspended for 20 business days without pay and demoted.
Fraud & Ethics Related Events
Sep 28: Auburn University employee accused of leaking athletics trade secrets to rivals - Occupational Fraud: An Auburn University employee has been arrested and charged with theft of trade secrets and computer tampering, according to police and court records.
Sep 28: Man Arrested for Allegedly Stealing Nebraska Football Helmets from Locker Room - Occupational Fraud/Access Control: A 22-year-old man has been arrested for allegedly stealing helmets and clothing from the University of Nebraska-Lincoln's football team. A former Cornhuskers employee who quit in March was allegedly seen on closed-circuit television footage recorded on Aug. 21, according to the outlets. The video allegedly showed [him] using a card reader to unlock the door at the Osborne Legacy Complex and emerging with two white Husker football helmets and four black helmets.
Sep 20: Former TCAT Elizabethton Employees Misappropriated More Than $1 Million - Occupational Fraud: An investigation by the Tennessee Comptroller's Office, working in conjunction with the Tennessee Board of Regents, has found that former Tennessee College of Applied Technology (TCAT) Elizabethton employees misappropriated at least $1,058,494 through several schemes involving their outside business and employment.
Sep 16: Fraudsters hit Missoula College in national financial aid 'ghost student' scheme - Financial Aid Fraud: A fraudulent enrollment scheme drained $673,745 in federal money from the University of Montana's Missoula College in 2025, according to a new report from the Legislative Audit Division. The report says UM returned all the money to the federal government in the 2026 fiscal year, and the university's net cash loss was $377,937.
Sep 14: Man indicted, accused of defrauding Allen University out of millions meant for football stadium - Fraud: A man is now facing federal charges after allegedly defrauding Columbia's Allen University out of millions that were meant for the construction of a new football stadium.
Sep 13: Former UAH employee accused of stealing over $600K through University Foundation - Occupational Fraud: Newly obtained court records reveal that a former University of Alabama in Huntsville employee is accused of siphoning more than $600,000 from the school's foundation using counterfeit invoices.
Sep 10: Temple University terminates record $55 million gift from alumnus amid federal investigation - Ethics: Temple University has terminated a $55 million philanthropic commitment from [an] alumnus and former trustee ending what had been the largest gift in the university's history after federal allegations emerged against [the alumnus] and his company.
Sep 07: Duke professor Dan Ariely's research article retracted after fraud allegations - Research Fraud: Psychological Science retracted a 2002 research paper on procrastination co-authored by a professor of business administration at the [Duke University] Fuqua School of Business. Evidence of fraud in the article was publicized earlier this week and the retraction came Wednesday.
Sep 01: SIUE lecturer charged $100K in personal items to university credit card, feds say - Occupational Fraud: A former adjunct instructor at Southern Illinois University Edwardsville is facing federal charges for allegedly using his university-issued credit card to pay for tens of thousands of dollars in personal expenses, including rent, athletic fees, marijuana and high-end kitchen knives.
Compliance/Regulatory & Legal Events
Sep 27: NCTC drama professor arrested on a charge of solicitation of a minor - Personnel: North Central Texas College officials say that a drama professor who was arrested Friday is no longer employed.
Sep 27: Education Department formally rescinds Title IX protections for LGBTQ students - Title IX: The Education Department announced Monday it has formally rescinded the Biden-era Title IX interpretation that gave sex-based discrimination protections to students on the basis of sexual orientation and gender identity. Schools now must go back to the Title IX code as held under the previous Trump administration in 2020, which the department says will protect women's sports.
Sep 23: Ex-NC State sports medicine director arrested after accusations of sexual abuse - Personnel: [A] former NC State sports medicine director was arrested Wednesday in Florida on out-of-state fugitive warrants from North Carolina, after more than 30 former NC State athletes accused him of sexual abuse.
Sep 23: LSU found a football player raped a student in Title IX hearing, then reduced his punishment - Title IX: An LSU administrative process found a football player responsible for the rape of a student but reduced his punishment on appeal, determining in part that no "force" or "malice" was involved and the athlete showed "an error in judgment," documents show.
Sep 16: Review finds 'overall failure' in CSCU response to sexual harassment allegations involving now-former interim chancellor - Personnel: An independent review said there was an "overall failure" in how the Connecticut State Colleges and Universities system handled sexual harassment allegations involving [the] former interim chancellor.
Sep 15: Family of Charlie Kirk plans suit against Utah university over alleged security lapses - Lawsuit: The family of conservative U.S. political activist Charlie Kirk plans to sue a Utah university over his fatal shooting there, alleging inadequate security contributed to his death, according to a notice of claim sent by the family's lawyers.
Sep 14: Lincoln Memorial University reaches federal settlement to end discrimination against Jewish students - Title VI: Lincoln Memorial University reached a settlement with the U.S. Department of Justice and HHS to resolve allegations of religious discrimination against Jewish medical students.
Sep 13: West Virginia University assistant football coach Noel Devine arrested on strangulation charge, records show - Personnel: [A] West Virginia assistant football coach was booked into jail on a felony strangulation charge Sunday, records show.
Sep 10: Former resident physician at MSU arrested on charges of sexually assaulting patients - Personnel: A former resident physician at Michigan State University has been arrested on charges of criminal sexual conduct.
Sep 10: University of Houston investigating 'concerning' video with faculty member, talk of child sexual exploitation - Personnel: The University of Houston said it is investigating after an adjunct faculty member appeared in an apparent To Catch a Predator-style social media video Thursday, the university confirmed in a statement to Houston Public Media.
Sep 09: Federal lawsuit claims over a decade of hazing abuse in the University of Michigan hockey program - Title IX: Sixteen former University of Michigan hockey players have filed a lawsuit against the university claiming the Ann Arbor school's hockey program adopted sexualized abuse as part of its standard hazing traditions. The lawsuit covers the years 1984 to 2001.
Sep 08: CCSU president under investigation for culture of fear, intimidation and bullying - Personnel: The president of Central Connecticut State University is under investigation after a complaint alleges a workplace culture characterized by "fear, oppressive control, intimidation, humiliation, and bullying."
Sep 07: St. Thomas University president resigns amid investigation into policy violation - Personnel: More than a month after an investigation into his conduct was launched, St. Thomas University President David Armstrong has resigned from his position.
Sep 06: UCA settles with U.S. Dept. of Education over race, sex-based scholarship concerns - Title VI: The University of Central Arkansas has entered into a two-year monitoring agreement with the U.S. Department of Education after an investigation by the department's Office of Civil Rights launched in response to concerns about the university's race and sex-based scholarships.
Sep 03: University pays professor $600K after being punished for parodying land acknowledgments - Settlement: The University of Washington has paid a professor $600,000 after punishing him for parodying a land acknowledgment in his syllabus.
Sep 02: Former Univ. of Dubuque professor charged with sex crimes against minor - Personnel: A former University of Dubuque professor has been charged with sex crimes against a minor.
Sep 01: Independent report finds credible sexual misconduct allegations against social work professor, adult clergy sexual abuse researcher - Personnel: An independent investigation found credible allegations that a professor in Baylor's Diana R. Garland School of Social Work engaged in sexual misconduct and violated professional boundaries. The allegations involved survivors of adult clergy sexual abuse, the same population at the center of [the professor's] research and clinical work.
Campus Life & Safety Events
Sep 29: Former TSU student charged after alleged phone, online threats to kill people, bomb campus - Threat: A man was arrested this week for making serious threats against his former school earlier this month, according to police records.
Sep 29: Parents, teammates of hospitalized ASU hockey player call for coaches to be placed on leave - Athletics Safety: An Arizona State University hockey player remains in the hospital and is "unlikely to recover" after collapsing during an outdoor workout in August. Now, the player's parents and teammates are calling for the university's coaches involved to be placed on leave.
Sep 28: Man accused of waving toy rifle used for video games on UMD's campus - Threat: A man was taken was arrested after police said he drove around the University of Maryland (UMD) waving a weapon that appeared to be a rifle, but was actually a toy used for video games.
Sep 27: Investigation underway after man found dead near Alma Mater Statue on U of I campus - Death on Campus: An investigation is underway after a man was found dead Monday morning near a central landmark on the University of Illinois Urbana-Champaign campus.
Sep 24: Wisconsin frat leaders arrested after 30 pledges found in filthy basement, injured and covered in condiments - Hazing: Two leaders of an underground University of Wisconsin-Madison fraternity were arrested and charged with hazing after dozens of pledges were found injured, shirtless and covered in condiments in a sweltering basement.
Sep 23: Former Cornell University student sues school, 7 fraternity members over rape allegations - SA: Cornell University and seven Chi Pi fraternity members are facing a lawsuit over rape allegations. A former student alleges that in October of 2024, she was drugged and raped at a frat house. Her attorney claims that after an investigation, only two of the accused were expelled and no one was arrested.
Sep 23: Janitor accused of hiding in ceiling to spy on Wilmington College women's soccer team - Voyeurism: A man has been charged with nearly a dozen counts of voyeurism after being found in the ceiling of a women's locker room at Wilmington College, according to police.
Sep 23: Police investigating 2 Ole Miss students' deaths after kratom found - Death on Campus: Local officials are looking for answers after two Ole Miss students were found dead in separate incidents in Oxford, Mississippi, this week, police said. Despite "packaged Kratom" being found during both investigations into the students' deaths, officials asked students not to speculate as the police conduct their probe.
Sep 22: 18-year-old student charged with making online threats targeting ECU dorm - Threat: A student is facing charges after police say she posted a threat on social media targeting an on-campus East Carolina University dorm.
Sep 20: Four rapes, 1 sexual assault reported at CSU San Marcos within a month - SA: Cal State San Marcos is increasing patrols on campus after four rapes and a sexual assault incident were reported at residence halls within three weeks of each other, an official with the university confirmed to NBC 7 on Monday.
Sep 18: MSU students left without power amid campuswide outage - Infrastructure: A widespread power outage is affecting students in residence and dining halls across Michigan State University's campus.The power outage began at around 4:15 p.m. The MSU Department of Police and Public Safety said they have identified the cause of the power outage and are actively working to restore power.
Sep 17: U of U reports multiple threatening emails impacting offices in 'swatting' incident - Swatting: Multiple threatening emails were sent to the University of Utah in what institution's Department of Public Safety called a "swatting" incident.
Sep 16: Louisville man charged after allegedly threatening to 'slaughter' UofL students - Threat: A Louisville man was arrested after allegedly threatening to "slaughter" University of Louisville students and faculty, according to records filed in the Jefferson District Court.
Sep 16: Teen girl, 18-year-old charged after stabbing at SUNY Westchester Community College leaves 2 injured - Stabbing: Two people have been charged after a stabbing at SUNY Westchester Community College in Valhalla left two students injured.
Sep 16: Lehigh Valley man charged with rape of freshman in East Stroudsburg campus dorm - SA: A 20-year-old Allentown man is accused of raping and sexually assaulting an 18-year-old woman at an East Stroudsburg University dorm room.
Sep 15: New data reveals at least 556 campus hazing incidents in past year - Hazing: HazingInfo's review of 1,441 US colleges and universities finds widespread hazing as new federal law reveals transparency gaps. About 1 in 6 US colleges and universities reported at least one hazing incident in the past year, a new analysis by HazingInfo finds.
Sep 14: University police investigating student's death in campus residence hall - Death on Campus: Police at an Ohio college are investigating a student's death in a residence hall at the university's campus.
Sep 14: UW-Platteville suspends men's cross-country season amid hazing investigation - Hazing: The University of Wisconsin-Platteville has temporarily suspended its 2026 men's cross-country season pending an investigation into allegations of hazing and student-athlete conduct violations.
Sep 07: Man arrested at Texas A&M football game after police catch him secretly recording woman - Security: A man was arrested Saturday during the Texas A&M football game after he was caught allegedly taking nonconsensual videos underneath a female fan's clothing, police said. [The man] was working at Kyle Field Saturday night, but officials clarified he is not an employee of Texas A&M University. Instead, [he] was employed by SSC Services for Education, a third-party custodial services provider.
Sep 06: Sac State says no suspect detained after shots fired on campus, but 'no ongoing threat' - Shots Fired: Sacramento State University said on Monday that university police are continuing to investigate reports of shots being fired at a parking garage during the first home football game of the season on Saturday.
Sep 05: Southern University cancels Tuesday classes as BR campus experiences outage - Infrastructure: Southern University announced that Tuesday, Sept. 8, classes at its Baton Rouge campus are canceled as the campus experiences intermittent power outages following a transformer outage.
Sep 02: CCU student accused of making bomb threat that evacuated dorm - Threat: Officers rushed Coastal Carolina students out of a dorm last month after one student allegedly threatened to bomb the building. Officers responded on Aug. 18 to DeCenzo Hall on Elvington Loop after receiving a silent witness submission.
Sep 02: Shooting threat at Utah Valley University rattles campus ahead of anniversary of Charlie Kirk's assassination - Threat: A shooting threat Wednesday near the university where Charlie Kirk was shot and killed rattled the campus community ahead of the anniversary of the conservative icon's death next week.
Sep 02: Some UNC students have safety concerns after being harassed by man at campus watch party - Security: Students at the University of North Carolina at Chapel Hill are questioning campus safety and the university's response after a man entered a classroom during a student gathering Monday night, allegedly harassing attendees and damaging property.
Sep 01: University of Tennessee issues safety notice after multiple sexual assault, drugging incidents at fraternities - SA: The University of Tennessee issued a campus safety warning on Monday following multiple reports of sexual assaults and drugging incidents at on-campus fraternity houses over the weekend.
If you have any suggestions, questions or feedback, please e-mail Kevin Robinson at robinmk@auburn.edu or Kristin Roberts at kar0032@auburn.edu. We hope you find this information useful and would appreciate hearing your thoughts. Feel free to forward this email to your direct reports, colleagues, employees or others who might find it of value. Back issues of this newsletter and subscription information are available on our website.
