Operations, Audit and Risk Committee Meeting November 8, 2024 DRAFT

The Operations, Audit and Risk Committee met on Friday, November 8, 2024 at 10 a.m. in the Freeman Center, Room 202 with Chair Kelli Meadows presiding.

Present from the Committee

Ms. Kelli Purdy Meadows, CPA, Chair
Mr. Brentley Archer
The Honorable Ronald L. Tillett

Absent from the Committee

Dr. Daniel Gade

Other’s Present

President William G. Kelly
Mrs. Jennifer Latour, Chief of Staff
Mrs. Ashleigh Andrews, Chief People Officer and Sr. Associate Vice President
Mr. Justin Davenport, Chief Information Officer
Dr. Willy Donaldson, Faculty Representative
Ms. Kayla Faulkner, Director of Internal Audit
Dr. Larry “Chip” Filer, Vice President for Facilities and Campus Operations
Mrs. Sarah Herzog, Chief Financial Officer and Associate Vice President
Dr. Amy Sirocky-Meck, Director of Institutional Compliance/Title IX Coordinator
Other CNU faculty and staff members

Chair Meadows called the meeting to order and welcomed everyone in attendance.

Approval of September 9, 2024 Minutes

Chair Meadows asked if everyone had a chance to review the Operations, Audit and Risk Committee minutes from September 9, 2024. There being no comments, edits or suggestions, Chair Meadows called for a motion to approve the minutes as presented. A motion was provided by Chair Meadows and seconded by Mr. Ron Tillett and the minutes were approved by unanimous vote of the committee.

Chair Meadows introduced Mrs. Kayla Faulkner, Director of Internal Audit to provide the following report.

Report from the University Internal Auditor

Mrs. Faulkner presented the Charter stating it was enhanced to include the new Global Internal Audit Standards and the Committee’s responsibility to receive periodic reports on university management of Page 2 of 4 operational, compliance, strategic and reputational risks, including Environmental Health and Safety, University Police, and Institutional Compliance.

Mrs. Faulkner provided updates on progress against the FY2025 Internal Audit Work Plan which include the Identity and Access Management Audit that has begun and provided an update that the Gap Assessment against the new audit Standards is complete, and action plans have been prioritized for getting into compliance with the Standards needed to address. It was noted regarding the Identity and Access Management Audit, that due to the vacancy in the Information Security Officer position in IT, an impact on the scope and timing of the audit is expected.

Mrs. Faulkner shared a chart detailing the status of management action plans from prior audits, including the Endowed Faculty Professorships audit and the Slate audit. In total from both reports, there were 10 items we are tracking for completion: 1 action plan is complete, the deliverables for 3 plans are under review by Internal Audit, and the remaining 6 plans are in progress.

A motion to approve Resolution 1: Amendment to the Operations, Audit and Risk Committee Charter was put forth by Mr. Ron Tillett and seconded by Mr. Brently Archer with all in favor.

Chair Meadows thanked Mrs. Faulkner for the report and introduced Mrs. Jennifer Latour, Chief of Staff to provide the following report.

Award of Administrative/Professional Emeritus Status for Adelia Patrick Thompson

Mrs. Latour presented the Resolution for Administrative/Professional Emeritus Status for Adelia Patrick Thompson recommended on behalf of President Kelly. The Resolution recognizes Adelia Thompson for her outstanding work and dedication to the University as the moves into retirement.

A motion to approve Resolution 2: Award of Administrative/Professional Emeritus Status for Adelia Thompson was put forth by Chair Meadows and seconded by Mr. Ron Tillett with all in favor.

Chair Meadows thanked Mrs. Latour for the report and introduced Mrs. Diane Reed, University Comptroller to provide the following report.

ARMICS Report

Mrs. Reed presented the Annual Risk Management and Internal Control Standards (ARMICS) Fiscal Review, which showed no significant weaknesses in internal controls, a positive indicator of the university's financial health and internal controls. However, the review did identify under-collection in four revenue contracts, which, upon rectification, resulted in the successful recovery of 100% of the revenue for three of the contracts with one still in progress.

Chair Meadows thanked Mrs. Reed for her report and thanked Mrs. Reed and her team for the extensive work in this area and for completing the annual certification to the state. Chair Meadows introduced Mr. Bryan Donohue, Director of Emergency Management, to provide the following report.

Review of Full-Scale Exercise

Mr. Donohue gave an update on the success of the full-scale exercise held on September 25 in McMurran Hall. The after-action review is still being drafted but some strengths noted include strong operational knowledge from all response partners on their roles and responsibilities during an emergency situation Page 3 of 4 and proactive information collection, analysis and dissemination along with strong local and regional partnerships.

Opportunities to improve included a quicker transition to a unified command structure to facilitate efficient operations and information sharing, the addition of a collaborative common operational picture and an increase in staff to handle the volume of work during a crisis situation.

As such, adjustments are being made to the Crisis and Emergency Management Plan, to include a change to a departmental EOC (Emergency Operations Center) model; adjusting EOC activation procedures; and changes in the Emergency Management backup to the Vice President for Facilities and Campus Operations.

Mr. Donohue also shared that we would build off this exercise for future scenarios.

Chair Meadows thanked Mr. Donohue for his detailed report and then introduced Mr. Justin Davenport, Chief Information Officer, to provide his report.

Enterprise Resource Planning (ERP) Working Group

Mr. Davenport shared an update on the development of an Enterprise Resource Planning Working Group. This group is cross-functional and includes all areas impacted by an enterprise system. The group’s first meeting was just this week with a goal to have recommendations on an ERP by Spring 2025.

Information Security Officer (ISO) Transition

Mr. Davenport shared an update that the Information Security Officer has resigned, and a search will be underway to fill the position. Given the importance of the role, Shane Leasure has been appointed as the Interim ISO. Mr. Leasure also currently serves as the Deputy Chief Information Officer.

Chair Meadows thanked Mr. Davenport for the report and introduced Dr. Amy Sirocky-Meck, Director of Institutional Compliance/Title IX Coordinator to provide the following report.

Institutional Compliance Update

Dr. Sirocky-Meck shared that since September, a national search for the Assistant Director/Deputy Title IX Coordinator was initiated and has already hosted candidates on campus. Minor policy updates were made to the Harassment, Discrimination and Sexual Misconduct policy, and the annual policy certification was submitted to SCHEV. The Office of Institutional Compliance worked closely with the Clery Compliance Officer on issues related to Clery compliance including assistance with reviewing Annual Security Report before it is published, information sharing, and supporting compliance priorities with the CNU community.

Chair Meadows thanked Dr. Sirocky-Meck for the updates.

Appointments to the Administrative and Professional Faculty

Chair Meadows stated that Appointments to the Administrative and Professional Faculty are informational only and can be found under Tab 12H of BoardDocs.

There being no further business, the meeting was adjourned at 10:40 a.m.