The prospect of being audited tends to make most people uneasy. But the message Mel Hudson-Nowak wants to get out to campus is that she is here to offer advice and assistance.
“I want to help people identify the right way to do things,” said the University’s director of internal auditing and advisory services. “The difference between an IRS auditor and my role is that my role is to look at the way processes are designed and see if they’re designed to achieve the desired outcome.”
She can also help determine if departments are having the right people look at their data to insure confidence in its accuracy and integrity, and make sure they are in compliance with all relevant rules and regulations.
“My expertise is in process,” Hudson-Nowak said. As she told a gathering of new directors this fall, everyone in an organization has responsibility for internal controls, from the management, which sets expectations; to employees, who design and execute internal controls; to the auditors, who monitor and evaluate those controls.
Hudson-Nowak also reminds faculty and staff they should feel comfortable using the Fraud Hotline, which is set up so employees can confidentially report any possible problems to her. That number is 419-494-1962.
“If there’s anything you think is inappropriate or unusual or that makes you uncomfortable, you should not hesitate to call. I will treat all calls seriously and confidentially,” she said.
A difference of scale
Hudson-Nowak, who lives in Michigan with her husband and two children, began work at BGSU in July. She earned an MBA in finance and marketing from Michigan State University and then was recruited by the Ford Motor Co. to work in the finance department, first in auditing and later in product development.
Her work also took her to Sweden, where she helped Volvo, a division of Ford, develop processes in accordance with the Sarbanes-Oxley Act regarding financial accounting and reporting.
The difference between BGSU and Ford is simply the scale, Hudson-Nowak said. Whereas at Ford there were 150 people in the audit office, here she has a staff of four: an auditor, an internal control coordinator and two graduate assistants. “The internal process side is not very different” between the University and Ford, she said.
BGSU benefits from having considerable financial expertise among the board of trustees, she said. She works closely with the audit committee, which she described as “very experienced and very knowledgeable.” In addition, President Ribeau, through his membership on several corporate and nonprofit boards, is aware of current practices and sees the importance of having strong financial leadership, she said.
Assessing risks, reviewing processes
One of her first major tasks at BGSU is to develop a risk assessment for the University. “I will be asking ‘What can we do with the resources we have and what can’t we do?’” and then assign priorities, she explained. She will first propose a 15-month audit plan and then revisit it yearly.
To engage the campus in the process, in November she organized a risk forum with nearly 25 people from a range of areas to gain a wider view of business and budget practices. After the forum, BGSU Counseling Center Director Dr. Craig Vickio said, "Working in the Counseling Center has certainly left me highly sensitized to the importance of mitigating risks in our work—such as the risks of students acting in ways that endanger themselves or others. My center colleagues and I have also worked hard to insure that client confidentiality is maintained and to thereby minimize any risk of a security breach. Attending Mel's risk management forum helped me to significantly enhance my awareness of other types of risks that exist in our work and also enabled me to more fully appreciate how risk management is everyone's responsibility across campus."
Another of Hudson-Nowak’s projects is to review and update the internal audit charter, which will provide the scope and authority for her office.
In addition, she is developing a process for corrective action follow-up. “It’s important to find things that need to be fixed, but it’s just as important that they actually get fixed,” she pointed out. By having a formal process that includes “severity guidelines,” she can decide when a simple notice of a process that needs to be changed would be sufficient and when more supervision is in order.
Help is available
Hudson-Nowak wants employees “to feel this is an approachable office,” and encourages everyone to call her if:
• They are doing anything new that may have unintended consequences.
• They see something in their data or financial information that doesn’t seem to make sense. “I can help you get answers so you don’t make decisions based on something you can’t explain,” she said.
• They feel they need a full or partial audit of their processes. Employees can ask her to take a look at their operations and let them know if there’s anything they should be concerned about, she said.
While she might not always be able to provide a comprehensive audit of a department, depending on what else she is working on at the time, she might examine a specific aspect of its business.
According to Hudson-Nowak, the greatest risk occurs when there is something new and different happening, whether in the area of process, personnel or computer systems. “That’s when the risk goes up,” she said. And even though people might not look forward to hearing they have a problem, “they’d rather hear it from me than from the external auditor,” she said. “I can provide an independent and objective opinion for them.”
"It's reassuring to know that Mel is available to help all of us in our efforts to address potential risks—not only by aiding us in developing procedures for managing risks but also by insuring that we are carefully reviewing and revising these procedures as new risks emerge," Vickio said.