The Board of Visitors Audit, Compliance and Risk Committee reviewed the completed audit for fiscal year 2024 during Friday’s meeting. This included recommendations to improve financial oversight in the University Medical Center among other aspects. The majority of the allotted meeting time was spent in closed session, during which voting members discussed topics such as the investigation of allegations made against University Medical Center leaders in a Sept. 5 faculty letter.
The Committee is in charge of reviews of financial, operational, compliance and reputational risks to the University — this includes University finance and compliance audits, as well as investigations when necessary.
The Committee has recently overseen an independent investigation into claims from 128 employees of the U.Va. Physicians Group alleging widespread abuses across the health system and University Medical Center. Their letter demanded the removal of Craig Kent, chief executive officer of U.Va. Health, and Melina Kibbe — dean of the School of Medicine, Medicine professor and chief health affairs officer — for alleged administrative misconduct.
The Committee convened a super executive session Friday, which only voting members may attend, to consult with its legal counsel — Washington D.C.-based international firm Williams & Connolly. The closed session agenda also listed discussion of specific employees’ performances and operations of the University Medical Center whose disclosure at this time “would adversely affect its competitive position” given market and regulatory changes.
Brian Coy, University associate vice president and chief communications officer, told The Cavalier Daily he could not provide further information regarding closed session agenda items, adding that the external Medical School investigation is ongoing.
Committee Chair Rachel Sheridan began the open session by emphasizing the substantial amount of work to be done.
“Given the materiality of issues before us, I encourage every member to fully listen and engage in this process as we seek understanding, corrective actions and accountability,” Sheridan said.
In an overview of the University's finances across the Academic and Medical divisions, Augie Maurelli, vice president for finance and chief financial officer of the University, said the balance sheet reflected healthy growth.
The University's net position increased by $757 million in the last fiscal year. Key areas were patient services and investment income, growing by $403 million and $593.5 million, respectively. This growth brings long-term investments, overseen by University of Virginia Investment Management Company, to a total of $11 billion — the result of 7.5 percent annual returns.
Operating expenses grew by $624 million, reflecting a $405 million increase for benefits and compensation along with $171 million for supplies and services, including costs for patient services at the Medical Center.
Last year, the fiscal year 2023 audit flagged 12 management points — specific areas in which the University must improve internal systems to meet compliance goals — nine of which have since been resolved, according to Maurelli. This year, three additional management points arose, bringing the current total to six.
“A 50 percent reduction in our management points, I think, symbolizes some of the work or the improvements that we're making, knowing that we still have more to do,” Maurelli said.
The Academic Division and Medical Center recently worked with the Auditor of Public Accounts to consolidate their records into a single set of audited financial statements. Maurelli said the consolidation has supported efficiency and transparency by showing specific information concerning different divisions.
David Rasnic, higher education programs audit director, said the audit team plans to finalize a review of this consolidated system next week, following a report from U.Va. Community Health, an integrated network of local health services that the University acquired in 2021. Rasnic said the acquisition created administrative challenges that have since seen progress with the addition of outside consultants supporting management.
“It was the acquisition of Community Health that exposed a number of deficiencies, certainly with the most significant of those issues being the lack of financial acumen at the Medical Center,” Rasnic said. “Then you couple that with a lack of a governance structure between the two divisions to coordinate and communicate — it really exacerbated the problem.”
While issues from the past two years centered around financial statements, Rasnic said this year’s audit focused on internal standards known as the control environment. The audit lists places for improvement in financial reporting, but also journal entries — accounts payable and cash management — areas contributing to a total of over $40 million in financial adjustments.
A lack of supporting documentation paired with management override of controls create risks for error and fraud, Rasnic said. Additionally, the University Medical Center went nine months without performing a bank reconciliation, a monthly process comparing bank statements to an organization's cash accounts. The delay led to over $30 million in overpayment and $60 million in unrecorded wires.
“It's really a historic [structure] of inadequate design controls and a lack of policies and procedures there,” Rasnic said. “You don't have controls, you don't have the policies, you bring new people in, it's really difficult for them to get plugged in and understand what's going on.”
Recommendations for the University Medical Center include improving service provider oversight and strengthening interdepartmental communications.
On the academic side, audit leaders recommended improved student loan reporting and enhancements to firewall safety. The University completed a nation-wide search for its first Director of Privacy Programs, a position designed to bolster privacy protocols, with plans to onboard the staff member in early 2025.
One ongoing audit will review NCAA Agreed-Upon Procedures dictating required revenue and expense reporting for intercollegiate athletics programs, with expected completion by February 2025. A completed financial aid audit will also be included in the Commonwealth of Virginia’s Single Audit, a comprehensive financial and compliance audit which provides an overview of how federal funds are being used.
The Committee is scheduled to reconvene during the next Board of Visitors meeting in March.