Fiscal Misconduct Reporting

This policy establishes the procedures and responsibilities for reporting and resolving instances of known or suspected fiscal misconduct in order to protect the assets and interests of the university, ensure a coordinated approach toward resolution of fiscal misconduct, and encourage compliance with applicable University of Colorado Regent Policies and Fiscal Procedures and state of Colorado Revised Statutes.

1. There are several options for reporting known or suspected violations of university policies. Unless reporting is required to an appropriate office, members of the university community are encouraged to first report any known or suspected violations to their direct supervisor. Fraud, theft, embezzlement, abuse, or waste may be reported to the University Department of Internal Audit, who has the primary responsibility for coordinating the initial assessment, investigation, and internal reporting of known or suspected fiscal misconduct.” Concerns may also be submitted to the CU EthicsLine, university’s ethics hotline, where the reporter may choose to remain anonymous.  Regent policy 8.A.9 provides protection from retaliation for all members of the university community who act in good faith in reporting known or suspected violations of law or university policy.
   
   The contacted investigative unit shall contact other units as appropriate to establish the necessary team to progress with the review or investigation.
    
2. ​All affected departments and/or individuals shall cooperate fully with the investigative team to identify whether or not actual or suspected fiscal misconduct has occurred.
    
3. The investigative team shall keep university campus officials apprised of on-going investigations as appropriate. Given the nature of some of these investigations, there are times when the scope of the problem must be determined before notification is possible.
    
4. Loss reporting will follow standard university processes for each investigative unit and will include reporting to the Department of Internal Audit and the University Controller as noted below in section III. The report will state the circumstances and corrective action taken.

The following sections outline the basic responsibilities of those units or individuals involved with an incident of actual or suspected fiscal misconduct.

1. The responsible administrator for the unit where the known or suspected fiscal misconduct may have occurred/may be occurring is responsible for:
   1. Promptly reporting all known or suspected incidents of fiscal misconduct to the Department of Internal Audit.
   2. Not attempting to conduct an independent investigation or audit.
   3. Notifying the Department of Internal Audit to obtain guidance on how to proceed.
   4. Fully securing and strictly limiting access to any relevant computer and manual records as soon as the fiscal misconduct is suspected, or when there is reason to believe further losses may occur. Common steps may include changes in staff assignments, obtaining keys, removing access to systems/commercial credit cards, and reassigning signature and approval authority.
   5. Not confronting or accusing the individual suspected of fiscal misconduct and not making any arrangements for resolution of the matter without consulting the Department of Internal Audit, campus Human Resources officer, and/or Office of University Counsel, as appropriate.
   6. Using discretion and not discussing the circumstances with persons not involved in the incident or with persons without an essential need-to-know. Supervisors can and should be informed if first cleared by the investigative team.
   7. At the completion of any investigation, implementing cost-effective changes in policy and procedures for improved internal controls to prevent reoccurrence.
2. The University Department of Internal Audit is responsible for:
   1. Coordinating the initial assessment and investigation to determine if fiscal misconduct has occurred.
   2. Notifying other departments, units and/or university campus officials who may need to be involved in a review or investigation as appropriate.
   3. When a loss has occurred, determining how the loss occurred, the amount of the loss, and possible individuals involved, and notifying the University Controller.
   4. Gathering available evidence to support loss findings.
   5. Evaluating the systems of internal control and making recommendations for improvements.
   6. Meeting, as required, with the campus police department, the appropriate personnel officer, administration, and/or legal counsel to coordinate and assess the progress of the audit and investigative activities.
   7. Following standard audit and investigations reporting procedures, including reporting to the University Controller.
   8. Periodically reporting the status of fiscal misconduct investigations to the regent audit committee, including outcomes, impact to the university, and any proposed management action plans to strengthen the university internal control environment.
3. The campus Human Resources officer is responsible for:
   1. Notifying other departments and units as appropriate to initiate appropriate investigative procedures.
   2. Providing guidance to the appointing authority, administration, and others affected as to appropriate personnel actions to be taken if the suspect is a university employee.
   3. Providing personnel policy interpretation and guidance.
   4. Participating in the resolution process and preparing reports, as necessary.
4. The campus police department is responsible for:
   1. Conducting a preliminary assessment of an incident where sufficient facts or evidence are apparent and/or criminal misconduct is suspected.
   2. Notifying other departments, units, and/or university campus officials who may need to be involved in an investigation, as appropriate.
   3. Determining if, in fact, criminal actions have occurred, and conducting an investigation based on the determination.
   4. Coordinating legal actions with the District Attorney, Office of University Counsel, Department of Internal Audit, and external law enforcement agencies.
5. Office of University Counsel is responsible for:
   1. Notifying other departments and units (including Public Relations), as appropriate.
   2. Serving as the liaison with external legal entities and coordinating investigations which may require reporting.
   3. Consulting with campus departments and/or university campus officials as to appropriate investigative and corrective actions.
   4. Providing policy interpretation and guidance.
   5. Participating in the resolution process and preparing reports, as necessary.
   6. Consulting with the campus police department prior to finalizing any monetary or administrative agreement which may affect impending prosecution.
6. The University Controller is responsible for:
   1. Providing policy interpretation as required.
   2. Working with the affected units to implement the necessary management controls to change and improve business practices which permitted the fiscal misconduct.
   3. Applying lessons learned as best practice business process improvements to universitywide internal control activities.

Italicized terms used in this APS are defined in the APS Glossary of Terms or in this policy.

Fiscal Misconduct - In the context of this policy – and as defined by Regent Policy 13.E: Fiscal Misconduct – fiscal misconduct means a deliberate act or failure to act in the course of university employment regarding fiscal matters, contrary to established law, rule, or policy, with the intent to obtain an unauthorized benefit, which results in loss or other damage to the university or university faculty, staff, student or university affiliated entity. Fiscal misconduct includes, but is not limited to:

• embezzlement or misappropriation of university funds, goods, property, services, or other resources;
• improper handling or reporting of financial transactions;
• authorizing or receiving compensation for goods not received or services not performed;
• authorizing or receiving compensation for hours not worked;
• forgery or unauthorized alteration of financial documents or records;
• diverting funds to an unrelated private enterprise that otherwise could be available to the university; and
• suspected fiscal misconduct that is a reasonable belief or actual knowledge that fiscal misconduct has occurred or is occurring.

Fiscal misconduct also includes attempted fiscal misconduct. Attempted fiscal misconduct exists when an employee, with the intent to obtain a financial gain, engages in a deliberate act or failure to act that constitutes a substantial step towards committing fiscal misconduct, even though that act or failure to act did not result in loss or other damage to the university or university faculty, staff, student, or university affiliated entity.

1. The following references cite the legal basis (Colorado Revised Statutes) from which this policy was developed:
   1. Retaliation Prohibited, C.R.S. § 24-50.5-103
   2. Embezzlement of Public Property, C.R.S. § 18-8-407
   3. Duty to Report a Crime, C.R.S. § 18-8-115
   4. Theft, C.R.S. § 18-4-401
   5. Obtaining control over any stolen thing of value, C.R.S. § 18-4-404
   6. Forgery, C.R.S. § 18-5-102
   7. Code of Ethics, C.R.S. §§ 24-18-101 – 24-18-113
2. University Resources:
   1. University of Colorado Regent Policy 8.A.9
   2. University of Colorado Regent Policy13.E
   3. University of Colorado Fiscal Procedures
   4. Fraud and Fiscal Misconduct Awareness and Reporting, Department of Internal Audit

•  Adopted:  February 1, 1993.
• Revised:  July 1, 2009; March 1, 2023.
• Last Reviewed:  March 1, 2023.