FY2022 Internal Audit Report

The University of Texas MD Anderson Cancer CenterInternal Audit Annual Report for FY2022Project No.Project TitleReport terly Reporting / Monitoring ActivitiesMDA22-501Validation Activities - Phase I2/28/2022CompleteMDA22-502Validation Activities - Phase II8/31/2022CompleteMDA22-503IT Follow-up Validation ActivitiesN/ACompleteDevelopment - Operations-Internal / External Quality Assurance ActivitiesN/AComplete-Internal Audit Committee Preparation / ParticipationN/AComplete-Institutional Risk Assessment & Work Plan DevelopmentN/AComplete-Audit Strategic PlanningN/AComplete-COVID Screening ParticipationN/ACancelled-IT Risk Assessment FY 23N/AComplete-IT Administrative ActivitiesN/ACompleteDevelopment – Initiatives & Education-UT System CoordinationN/AComplete-Professional Organization / Association ParticipationN/AComplete-Training / Continuing Professional EducationN/AComplete-IT Knowledge Sharing and/or Training DocumentationN/ACompleteAudit / Project cancelled / postponedAudit / Project added to PlanCompliance with the Benefits Proportionality Audit Requirements for Higher EducationInstitutions:At the request of the Governor, an internal audit of the proportionality of higher educationbenefits process was performed during fiscal year 2022. The audit examined fiscal year 2020and 2021. The audit ensured compliance with Rider 8, page III-46 of the GeneralAppropriations Act (87th Legislature). A consistent audit methodology has been deployedacross UT System that assessed the reporting process and accuracy of benefits fundinginformation provided to the State Comptroller.Compliance with the Purchasing and Contracting Requirements for Higher EducationInstitutions:Senate Bill 20 (84th Legislative Session) made several modifications and additions to TexasGovernment Code (TGC) and Texas Education Code (TEC) related to purchasing andcontracting. Effective September 1, 2015, TEC 51.9337 requires that, “The chief auditor of aninstitution of higher education shall annually assess whether the institution has adopted therules and policies required by this section and shall submit a report of findings to the stateauditor.”Page 8 of 22

The University of Texas MD Anderson Cancer CenterInternal Audit Annual Report for FY2022The MD Anderson Cancer Center Internal Audit Department conducted this requiredassessment for fiscal year 2022, and found the following:Based on review of current institutional policy and the UT System Board of Regents’Rules and Regulations, MD Anderson Cancer Center has generally adopted all of therules and policies required by TEC 51.9337. Review and revision of institutional andSystem policy is an ongoing process. These rules and policies will continue to beassessed annually to ensure continued compliance with TEC 51.9337.No significant changes have been made since the assessment was conducted.Page 9 of 22

The University of Texas MD Anderson Cancer CenterInternal Audit Annual Report for FY2022III.ProjectNo.22-200Consulting Services and Non-audit Services CompletedProject TitleEnterprise RiskManagementReport DateConsulting –Facilitated ERMInitiative22-201CARES ts andContractsConsulting8/31/202222-20422-205Drug DiversionConsultingConsulting –VerbalCommentsprovided toManagementProject ObjectiveCoordinate with managementto continue enhancement ofan enterprise riskmanagement framework forthe institution.Perform a consultingengagement to ensurecompliance with the variousrequirements of CARES Actfunding.Assess whether appropriatesegregation of duties andaccess is being implementedas part of the new system.Services / Observations / Results /RecommendationsInternal Audit continues to collaborate withthe ERM team throughout the year. InternalAudit routinely shares information, ensurerisks are aligned, and ensures no duplicationof effort exists between our departments.Internal Audit performed ongoing consultingto management throughout the period to helpensure compliance with the variousrequirements of CARES Act funding.Internal Audit gained an understanding of thesystem and assessed the current status of theimplementation. This included a review of theproject timeline with identified sprints(milestones) and percentage of completion foreach sprint. As part of this process, we notedthat the implementation has been adjusted toAugust 2023.Internal Audit will continue to monitor theprogress of the implementation in FY2023and assess various aspects of theimplementation based on our approved AuditPlan.Internal Audit has been collaborating with aninternal task force aimed at optimizing thefinancial structure embedded in the variousdecentralized enterprises. Internal Auditcontinues to assist in identifying and providingguidance on mitigating potential compliancerisks related to Grants and Contracts.In coordination withInstitutional Compliance andGrants and Contracts, InternalAudit will makerecommendations related tocontrol processes, bothcentralized and decentralized,to ensure allowability of costscharged to grants, includingbut not limited to theaccuracy of effort reporting.Excepted from Public DisclosureParticipate in a consultingrole on the Medical DiversionPrevention Committee.Internal Audit participates on the MedicationDiversion Prevention Program Committee,established to prevent, identify and addressmedication diversion risks. Internal Audit’srole is to provide consultation regardingproposed actions to reduce insider threats.Page 10 of 22

The University of Texas MD Anderson Cancer CenterInternal Audit Annual Report for FY2022ProjectNo.22-206Project TitleCriminalBackgroundChecksReport DateConsulting –VerbalCommentsprovided toManagement22-210Project ObjectiveInternal Audit will continue topartner with key stakeholdersto ensure processesestablished around acomprehensive backgroundcheck have beenimplemented for allemployees, including faculty,as part of the on-boardingprocess.Services / Observations / Results /RecommendationsInternal Audit facilitated communicationbetween Human Resources, Supply Chain,and impacted process owners to discuss theimplementation of criminal backgroundchecks. Due to COVID-19 and staffing issues,the planned implementation has beendelayed, and Human Resources is reviewingoptions. Internal Audit will continue to connectprocess owners, and highlight continuingareas of risk, as a new proposal andimplementation date is developed by HumanResources and re-submitted to executiveleadership for consideration.Excepted from Public Disclosure22-211Coronavirus Aid,Relief andEconomicSecurity (CARES)Act -ProviderRelief Funds(PRF)12/1/2021Ensure the amount andmetrics included in theCARES Act Funds – PRFreporting for Period 1 (April10,2020 – June 30, 2020)were accurate and properlysupported.Internal Audit performed a validation of thePRF report and noted several minor variancesin the personnel/patient metrics as comparedto supporting documentation, as well as theneed to include other assistance receivedthroughout the period. Managementincorporated these changes into the finalreport prior to submission of the report toHHS.22-117President'sHousing, Traveland EntertainmentReport Providedby UTSTo provide data anddocumentation to the UTSAudit Office for their review ofthe President's Travel Audit.Internal Audit assisted the UT System AuditOffice with its annual review of PresidentialTravel and Business Entertainment. InternalAudit provided the population of transactionsrequested per the engagement letter andfacilitated documentation requests as neededfrom the President’s Office.22-300FY 2021 FinancialStatement Audit(Year End)12/31/2021To assist Deloitte with testingrelating to the ExternalFinancial Statement Audit.Internal Audit assisted the external financialstatement auditors with interim testing.Observations and recommendations will bemade by Deloitte to management.22-301FY 2022 FinancialStatement Audit(interim)8/31/2022To assist Deloitte with testingrelating to the ExternalFinancial Statement Audit.Internal Audit assisted the external financialstatement auditors with interim testing.Observations and recommendations will bemade by Deloitte to management.22-303Annual Report toState Auditors12/10/2021To report Internal Audit'sactivities to the Texas StateAuditor as required by TexasInternal Auditing Act.Internal Audit prepared the required AnnualReport to the State Auditor’s Office (SAO).22-304ProcurementComplianceAssessment (TEC51.9337)8/31/2022To assess compliance withTexas Education Code51.9337 related to stateprocurement requirements.As required annually by Texas EducationCode 51.9337, Internal Audit performed anassessment to determine whether theInstitution has adopted the required rules andpolicies related to purchasing of goods andservices. No exceptions were noted.---VariousInvestigationsVarious methodsofcommunicationTo conduct investigations asnecessary.Information was provided to appropriatelevels of management.Page 11 of 22

The University of Texas MD Anderson Cancer CenterInternal Audit Annual Report for FY2022IV.External Quality Assurance Review (Peer Review)Page 12 of 22

The University of Texas MD Anderson Cancer CenterInternal Audit Annual Report for FY2022V.Internal Audit Plan for Fiscal Year 2023FY 2023 Audit PlanOriginalBudgetPercent ofTotalGeneral Objective/DescriptionAssurance EngagementsExcepted from Public Disclosure500Cloud Services Cost Management600To identify and assess cloud costs and determine potential cost savings andoptimization.Revenue Reconciliations600To review daily revenue reconciliations for selected departments to ensurethat they are adequate, timely and complete.Nursing Contract Labor600Departmental Audit - Pathology - Lab Medicine800To review the process for evaluating each agency to determine whether theterms and the provisions of the contract have been met. In addition, toassess the frequency at which each agency is utilized and the process formaking those decisions.To provide a general assessment of the financial, administrative, andcompliance controls within the selected department.Departmental Audit - Genitourinary Medical Oncology800To provide a general assessment of the financial, administrative, andcompliance controls within the selected department.Departmental Audit (TBD)800To provide a general assessment of the financial, administrative, andcompliance controls within a selected department.Texas Risk and Authorization Management Program (TXRAMP) Compliance Assessment500To determine whether controls and processes are in place to ensurecompliance with Texas Government Code 2054.0593, which mandates thatstate agencies as defined by Texas Government Code 2054.003(13) mustonly enter or renew contracts to receive cloud computing services thatcomply with TX-RAMP requirements beginning January 1, 2022.Excepted from Public Disclosure600Grants and Contracts - Closeouts500To determine whether federal grants and contracts are being closed inaccordance with requirements and in a timely manner.Page 13 of 22

The University of Texas MD Anderson Cancer CenterInternal Audit Annual Report for FY2022FY 2023 Audit PlanOriginalBudgetPercent ofTotalGeneral Objective/DescriptionExcepted from Public Disclosure500Physicians Referral Service (PRS) Review - TBD600Using a risk-based approach, review the controls and processes in place fora select PRS activity.Investigational Drug Review500To ensure proper safeguarding and inventory management ofinvestigational drugs.Audit Process Innovation600PMIS Pre-Implementation (Facilities Mgt)250Facilities Management Activities/Construction - DeferredMaintenance500Using an external vendor, explore and develop technological tools as part ofthe departmental initiative to improve the efficiency of the audit process andincrease audit coverage. This project will impact an operational area, to bedetermined.During the implementation of Oracle Unifier, to determine if implementationrisks related to (i) Business Process Readiness and Solution Design, (ii)Data Conversion and Governance, (iii) Organization Change Enablement,(iv) Reporting and Analytics, and (v) Security and Internal Controls are beingappropriately addressed and mitigated.To conduct risk-based review of deferred maintenance, performed by cosourced vendor.Management Involvement on Co-Sourced ConstructionProjects200To oversee/facilitate audits of construction activities.Management Involvement on other Co-Sourced Projects250To oversee/facilitate audits of other co-sourced activities.Executive and Faculty Travel and Business Entertainment200Presidential Travel and Business Entertainment40To determine if travel and entertainment activities and expenditures ofexecutive management and faculty are conducted in accordance with UTSystem and MDACC policy.To coordinate audits by UT System to determine if travel and entertainmentactivities and expenditures of the President and spouse are conducted inaccordance with UT System and MDACC policy.Page 14 of 22

The University of Texas MD Anderson Cancer CenterInternal Audit Annual Report for FY2022FY 2023 Audit PlanTechnology and Innovation EngagementsOriginalBudgetPercent ofTotalGeneral Objective/DescriptionCo-sourcedExcepted from Public Disclosure500Excepted from Public Disclosure500Excepted from Public Disclosure500Excepted from Public Disclosure500Excepted from Public Disclosure300Excepted from Public Disclosure300Page 15 of 22

The University of Texas MD Anderson Cancer CenterInternal Audit Annual Report for FY2022FY 2023 Audit PlanOriginalBudgetPercent ofTotalGeneral Objective/DescriptionInternalExcepted from Public Disclosure600Excepted from Public Disclosure400Management Involvement on Co-Sourced IT Projects250To oversee/facilitate audits of IT activities.Reserve for Carryforward Engagements250Reserve will be used to complete any outstanding FY22 projects notcompleted by August 31.Departmental Audit - Stem Cell (including FinancialClearance Process)250To provide a general assessment of the financial, administrative, andcompliance controls within a selected department.Departmental Audit - Procedural and Therapeutics250To provide a general assessment of the financial, administrative, andcompliance controls within a selected department.Excepted from Public Disclosure250Excepted from Public Disclosure250Carry-Forward EngagementsAssurance Engagements Subtotal1504052.5%Page 16 of 22

The University of Texas MD Anderson Cancer CenterInternal Audit Annual Report for FY2022FY 2023 Audit PlanOriginalBudgetPercent ofTotalGeneral Objective/DescriptionAdvisory and Consulting EngagementsEnterprise Risk Management (ERM)50Collaborate with the ERM team in the identification and communication ofemerging and existing institutional strategic risks. (Ongoing)Collaborate with management on CARES Act funding requirements toensure compliance.In coordination with management, provide consulting in coordination with aplanned Supply Chain assessment performed by an external vendor.Participate in a consulting role in the implementation of the new humanresources solution.In coordination with Institutional Compliance and Grants and Contracts,Internal Audit will make recommendations related to control processes, bothcentralized and decentralized, to ensure allowability of costs charged togrants, including but not limited to the accuracy of effort reporting.CARES Act Funding100Supply Chain Consulting100Oracle HCM Cloud Consulting50Grants and Contracts Consulting100Excepted from Public Disclosure100Drug Diversion Consulting50Participate in a consulting role on the Medication Diversion PreventionCommittee.Criminal Background Checks Consulting50Excepted from Public Disclosure175Internal Audit will continue to partner with key stakeholders to ensureprocesses established around a comprehensive background check havebeen implemented for all employees, including faculty, as part of the onboarding process.Excepted from Public Disclosure175Page 17 of 22

The University of Texas MD Anderson Cancer CenterInternal Audit Annual Report for FY2022FY 2023 Audit PlanOriginalBudgetPercent ofTotalGeneral Objective/DescriptionGeneral Consultation with Management200To consult with management on various high-risk topics.Institutional Committee Participation200To participate, in a consulting role, on committees within the institution.Advisory and Consulting Engagements Subtotal13504.7%Required EngagementsFY 2022 Financial Statement Audit (year-end)220FY 2023 Financial Statement Audit (interim)200Annual Report to the State Auditor100Procurement Compliance Assessment40Required Engagements Subtotal5602.0%To assist Deloitte with testing relating to the External Financial StatementAudit.To assist Deloitte with testing relating to the External Financial StatementAudit.To report Internal Audit's activities to the Texas State Auditor as required byTexas Internal Auditing Act.To assess compliance with Texas Education Code 51.9337 related to stateprocurement requirements.InvestigationsReserve for Investigations1,000Investigations Subtotal10003.5%Reserve will be used to respond to any investigative requests throughoutthe year.ReserveReserve for Just-In-Time Auditing/Advisory ServicesReserve Subtotal2,39323938.3%Reserve will be used to respond to management's requests in high-riskareas, as well as to address changing risks in our environment throughoutthe year.Follow-UpQuarterly Reporting / Monitoring Activities200To report on follow-up validation activity.Validation Activities - Phase I500To conduct follow-up on outstanding recommendations for quarters 1 and 2.Validation Activities - Phase II500To conduct follow-up on outstanding recommendations for quarters 3 and 4.Page 18 of 22

The University of Texas MD Anderson Cancer CenterInternal Audit Annual Report for FY2022FY 2023 Audit PlanOriginalBudgetTe

The University of Texas MD Anderson Cancer Center Internal Audit Annual Report for FY2022 . Page . 1. of . 22. Table of Contents . I. Compliance with Texas Government Code, Section 2102.015: Posting the Internal Audit Plan, Internal Audit Annual Report, and Other Audit information on Internet Website II. Internal Audit Plan for Fiscal Year 2022