Proper Use and Review of WPIC Funds

1. Proper Use and Review of WPIC Funds March 2012

2. Fraud Triangle - NCURA • NCURA1959's Channel – YouTube • Fraud Triangle • Pressure • Rationalization • Opportunity

3. Agenda • Financial roles • Fraud indicators • Investigations • Controls • Retaliation prohibited • Red flags • Contacts • WPIC P-Card Procedures

4. Types of Funds • Grant Funds (05-90555) • UPMC – 5 digit Department number (0xxxx) • Pitt – 6 digit Project number • 1xxxxx (Federal) • 4xxxxx (Other Federal Accounts Sub-Contracts) • 6xxxxx (State & Other Government) • 7xxxxx (Other Private – Foundations) • 9xxxxx (Pharmaceuticals) • Hard Funds & Department Funds • UPMC – Department 97xxx • Pitt - Area/dept (02-90xxx)

5. Importance of Your Role • Staff, Cardholders, Initiator of Transactions • Ensure valid business expense • Document appropriately to patient/consumer and original receipts • Reconcile and monitor against statements, targets, budgets, available funds • Supervisors, Managers, Program Administrators • Understand and review all spending on your accounts & P-Cards • Validate expenses to documentation or receipts • Monitor for reconciliation process • Manage spend against funds

6. Managing Your Funds • Actual to Budget Analysis • Department Manager Reports from the OGC • UPMC Quest Vista reports access for Supervisors • Authorization for Use • Appropriate personnel • Workflow approval in software • Original signature on documents • Ask Questions • Grants Office • Finance Departments • Peers • Staff (even when you know the answer)

7. Spending WPIC Funds • eProcurement / eMarketplace • eVoucher Disbursement Requests • Travel and Business Expense • Purchasing Cards • Petty Cash • We Pay Participant Payments

8. Buying Channels • Supply Chain Management • Buying Matrix • Panther Buy - Pitt http://infonet2.upmc.com/OurOrganization/Enterprise/Finance/Purchasing/Pages/Ordering-Goods-and-Services.aspx

9. Trust • Honest employees can become dishonest • Don’t tempt employees by creating the wrong environment • Don’t put employees at risk (separate accountability) • Dishonest employees • Will do whatever it takes • Don’t follow or respect rules • Blind trust is not prudent • Trust but verify

10. Executive Assistant Case Study • Scenario – repetitive losses occurring from executives purse • Result – executive’s trusted assistant stealing • Red Flags – ignored person in position to perpetrate due to trust • Controls – physical security of personal items absent Nobody wins, loss of job, feeling violated, pending or possible prosecution, lack of future trust, etc.

11. Purchasing Card Fraud Case Study • Scenario – letter sent to legal regarding employee personally gaining from business transactions • Result – high level employee purchasing personal items on pcard and utilizing employees to work outside the company • Red Flags – employee closed door to meet with vendors, employee lived beyond their means, employee was never in the office or accounted for on work assignments, spend for department was higher than other facilities, work was not documented in software used by other facilities • Controls – budget analysis missing, approval of transactions for business purpose missing, receipt verification missing, central bidding and work order software not used.

12. Investigation Assistance • Enlist help for proper Investigation • Minimize losses • Ensure investigation is not hampered • Improper settlements are not made • Correct personnel actions are taken • Employees are protected from false accusations

13. Innocence Proven Case Study • Scenario – employee suspected of private business with company assets • Result – employee name cleared and business reported • Red Flags – employee working in off hours, physical access to inventory of supplies, employee running parallel business • Controls – reporting through conflict of interest process lacking, management oversight of inventory items Employee shared detailed records and cooperated through interview process to clear his name and reputation saving his job and career.

14. Interview Skills • Good intentions gone bad • Witness not used • Inappropriate questions or requests • Employee access to exit not properly established • Evidence not protected • Physical danger not considered

15. UPMC Pcard Reconciliations Procurement Cards • Matching monthly statement against receipts • Question receipts for business purpose • Ensure proper buying channel is P-card • Supervisors reconcile receipts to monthly credit card statements Protect yourself and your team by having good business practices surrounding the use of credit cards.

16. Proper Pcard Accounting • Default to Hard Department account number • Spend allocated based on purpose • Charge the purchase directly to the correct department number within the P-card system • Move grant purchases to correct department number (0xxxx) within the billing cycle • Department, Grant Fund should be monitored closely.

17. Appropriate / Inappropriate Spend • Prohibited items • Alcohol • Capital Equipment • Cellular Phone Charges • Computers • Copy/Printing Services • Office Supplies • Personal Expenses • http://infonet2.upmc.com/OurOrganization/Enterprise/Finance/Purchasing/Documents/TravelandExpenseCardProgramGuide.pdf

18. Who is Responsible for Internal Control? • The organization’s leadership is responsible for establishing the control environment. • Everyone in an organization plays some role in effecting control. All personnel are responsible for communicating problems in operations, deviations from established standards, and violations of policy or law.

19. Controls • Physical controls -restrict access to cards, conduct inventories, secure/count cash, etc. • Segregation of Duties-different people should ideally be responsible for: • Authorizing transactions • Recording transactions (accounting) • Handling the related assets (custody) • Monitoring transactions (reconciling / verifying)

20. Examples of UPMC Controls • Policies, Department Procedures, Code of Conduct • Required use of computer passwords, anti-virus software • Locking offices, restricted building access • Securing laptops, procurement cards and petty cash funds • Reconciling T&B and P-card reports against receipts • Requiring authorization (signing authority) for large purchases • Requiring management approvals on timekeeping • Running background checks, credit checks • I.D. badges • Credentialing

21. Retaliation Prohibited • Trust your gut – question what doesn’t appear right. • You have a responsibility to report, in good faith, instances of wrongdoing. • The recipients of these reports shall subsequently investigate the concerns in confidence. • All recipients of such reports are prohibited from engaging in retaliation. • No harm can come from reporting, but ignore and if wrongdoing, bad will come. In hindsight, most employees knew something was wrong, but didn’t act on their suspicions.

22. Profile of a Fraudster A Clean Record • Most of the fraudsters in the study had never been previously charged or convicted for a fraud-related offense. • Only seven percent of the perpetrators had been previously convicted of a fraud offense. This finding is consistent with prior ACFE studies.

23. Profile of a Fraudster Behavioral Red Flags • Living beyond one’s means (43 percent of cases) • Experiencing financial difficulties (36 percent of cases) • Control issues; unwillingness to share duties (23%) • Unusually close association with vendor/customer (22%) • “Wheeler-dealer” attitude (19.%) • Divorce/family problems (18%) • Irritability, suspiciousness or defensiveness (14%) • Addiction problems (12%) • Refusal to take vacations (10%)

24. Business within Company Case Study • Scenario – employee complains after being terminated about management conflict of interest and private company • Result – human resources reviewed with management and closed case, employee contacted hotline and complained again multiple managers terminated for conflicts • Red Flags – employees living beyond means, close relationships to customers, assets retired before useful life • Controls – capital budget analysis lacking, employee time not accounted for, management oversight lacking.

25. Red Flags; What should I do? “Red Flags” ARE NOT meant to be an absolute indicator of illegal or unethical activity. They ARE meant to indicate situations that could warrant further review. There are three general ways to address Red Flags • Do nothing • Initiate an informal review • Initiate a formal review

26. Informal Review Informal reviews mostly involve benign action taken by the reviewer(s) that the subject of the red flag doesn’t know of. • Simply making a mental note of the red flag. • Monitoring the subject of the red flag more actively than usual. • Comparing the circumstances of the red flag with other occurrences. • Review of past activity.

27. Formal Review Formal reviews are often initiated when numerous red flags are present or circumstances dictate that fraud is a reasonable possibility. • Most often the subject will be aware of the review. • Management should be engaged. • Department Management, if possible • Human Resources • Subject may be questioned about the flags and asked to explain the circumstances that caused the flags. • The Fraud Team can always assist.

28. Doing nothing Ignoring red flags is ALWAYS the worst way to dispose of them. “I had a feeling he was doing something wrong.” “I wish I would done more to look into that.” “I should have known about that.” *common responses heard during fraud investigations. source: The UPMC Fraud Team

29. WPIC P-Card Procedures • Review P-card transactions to see if purchases can be procured using: • ePro • PRISM • PantherBuy • P-cards should NOT be used for routine purchases • Default account number for P-cards should be the a hard department number • Charge the purchase directly to the correct account number by moving the expense within the P-card system • Make sure your account has a positive balance before using a P-Card

30. WPIC P-Card Reconciliation • Reconcile P-Card Statements on a monthly basis • Have P-Card user provide receipt documentation for every purchase on the P-Card statement for the month • Supervisors review the transactions • Sign the P-Card statement if transactions are appropriate and send a copy to the OGC • Cardholders should retain all the original receipts in case of audit • Report any inappropriate expenditures on P-Cards

31. Contact Information • Your Direct Reporting Manager • Grants Office – Tom Berkhoudt (412) 586-9198 • Finance Department Mike Kretz (412) 246-5697 • Janice Weigand (412) 246-6802 • Human Resources – Denise Trosky (412) 647-5411 • Compliance Officer – Dave Bobrzynski (412) 246-6809 • Fraud Team (412) 647-5774 • Anonymous Hotline (877) 983-8442 Email: fraudteam@upmc.edu