A note from Shannon Smith
April 29, 2022
Hopefully you are hearing a lot about the University’s internal control program (official name to come soon!) and our need to strengthen processes and procedures. At a recent Finance All Hands meeting, you heard from Steve Murphy on the university’s internal control enhancement program, co-sponsored by Finance and the Medical School. For the first time in recent memory, the university has committed to taking a comprehensive view of the different elements that contribute to a strong compliance and internal control environment. As the university controller, this is extremely exciting!
At this time, the program is still in its “phase 0” stage and being developed. As we further develop the program, you will hear more frequently from us on the progress. I would, however, like to discuss how this program will need to challenge the culture here at Yale.
Working at Yale, you quickly appreciate that we have a strong decentralized finance culture with limited centralized monitoring or oversight. In an environment where we rely on departments for approvals, there is inherently greater risk of errors and frauds. I recall having conversations with key stakeholders on the importance of building a fraud detection program and a central monitoring function to ensure that departments are following university policies and procedures. Universally, controllers’ offices like to discuss the importance of a strong internal control environment and sometimes we can be viewed as “preaching” this message. However, outside of Finance, the passion and appreciation for maintaining a strong internal control environment tends to be weaker.
I am so proud of the work that we perform day in and day out within the Controller’s Office to ensure the university is compliant with a myriad of regulations and requirements and produces accurate and reliable financial reporting. Over the past few years, we have made strides to improve internal controls. One great example is the establishment of the Compliance team within the Controller’s Office, who quickly brought the Financial Review Checklist (FRC) back into Finance. The team revamped and standardized our expectations with respect to what departments should be reviewing on a monthly, quarterly, and annual basis. This was great progress; however, without a platform to ensure all staff are trained on standard processes and procedures and without sufficient tools to perform central monitoring, it is difficult to be consistent across campus in executing our controls.
A key component to internal controls is the “Tone at the Top.” In essence the “Tone at the Top” is used to define an organization’s leadership and their commitment to honesty and ethical practices. The “Tone at the Top” sets forth an organization’s cultural environment and corporate values. A poor or silent “Tone at the Top” can undermine a strong internal control process, influencing how we act and the decisions we make.
The fraud that occurred in the Emergency Medicine department was a wakeup call for many. However, the incident has given the “preaching” from the Controller’s Office and Finance organization an opportunity to be heard by the broader community. Recent events have strengthened my belief that our work on internal controls cannot be just about improving or adding policies and procedures, but also must include a focus on culture and tone. In an environment where staff are encouraged to speak up, there is a greater chance that issues will be escalated or identified sooner.
This month we held our Spring Audit Committee meeting. I found the Audit Committee to be engaged, encouraging us to make positive improvements and changes to our internal control structure and culture. Specifically, the committee asked several times, and in many ways, how they can help us with our internal control program. They have heard us describe our need for cultural and operational change and are fully engaged and supportive. The Audit Committee believes that for Yale to have a best-in-class finance organization, a strong culture and “Tone at the Top” are imperative. Standardized financial processes and improvements through technology and tools, reporting and analytics, and training and communications are also key elements. One audit committee member mentioned they have seen a large uptick in frauds at the companies whose boards they serve. In their point of view, broader use of technology has made it easier for a fraud to occur. This results in the need for us as a finance organization to be more diligent in monitoring controls. Most important, the committee believes that we can be a best-in-class finance organization. They are complimentary of our Finance team, what we have done this past year, and our plans for the next several years.
Finally, President Salovey expressed his commitment and understanding that his communication and support will be integral to the success of the internal control program. He understands the importance of the “Tone at the Top.”
Hearing the engagement and support from university leadership and the Audit Committee has made me optimistic for the success of the internal controls program. We know that we have high hurdles to advance this program and that it will take a cultural shift and strong “Tone at the Top” to really integrate compliance and internal controls into everyday thinking. We also recognize that this is a university-wide effort that encompasses much more than what we traditionally think of as internal controls. We are incredibly happy to have, and encouraged by, the support from the highest levels at the University (the “Top”). We are counting on all of you to help us as we continue this journey and will keep you up to date on the progress we are making and how you play a role as a member of the Finance community.