Recognize Risk
Understanding Risk, Recognizing Warning Signs, and Taking Action
Good fiscal stewardship includes recognizing when something may put University resources, information, or operations at risk. You don't need to be a compliance expert—or know exactly what has happened—to recognize when something deserves attention.
Sometimes the first sign of a problem is simply that something seems strange, odd, or concerning. Asking questions and raising concerns can help UVA identify problems early, strengthen processes, and protect University resources.
What Should I Pay Attention To?
Financial risk can appear in many ways. Situations that may deserve a closer look include:
- Transactions or activity that are unexpected or difficult to explain
- Missing, incomplete, or inconsistent documentation
- Requests to bypass established approvals, controls, or procedures
- Unusual urgency or pressure to complete a transaction without normal review
- Financial records that don't match what you know or observe
- Access to systems, accounts, or assets that doesn't appear appropriate for someone's responsibilities
- Changes in staffing, responsibilities, systems, or processes that may have weakened an existing control
- Use of University resources that appears inconsistent with their intended purpose
One unusual situation doesn't necessarily mean misconduct has occurred. It may, however, be a reason to ask questions or seek guidance.
Fraud, Waste, Abuse, and Mismanagement
Financial concerns don't all look the same. They may involve fraud, waste, abuse, mismanagement, or another breakdown in processes or controls.
- Fraud: Intentional deception or misrepresentation for an improper benefit or to cause a loss.
- Waste: The unnecessary or inefficient use of resources.
- Abuse: Improper behavior or use of authority or resources, even when the conduct may not meet the definition of fraud.
- Mismanagement: Practices or decisions that result in poor stewardship of resources or unnecessary risk.
You don't need to determine which category applies before asking a question or reporting a concern.
Understanding Fraud Risk
One way to understand why fraud can occur is the Fraud Triangle, which describes three conditions commonly associated with fraud:
- Pressure: A motivation or perceived need that may lead someone toward inappropriate action.
- Opportunity: A situation in which inadequate or ineffective controls make inappropriate activity possible.
- Rationalization: A way of justifying inappropriate behavior to oneself.
The Fraud Diamond expands this model by adding capability—the knowledge, access, position, or other ability needed to carry out the activity.
Strong internal controls can help reduce opportunity, identify unusual activity, and make problems easier to detect.
Learn more about Internal Controls
Identity Theft and the Red Flags Rule
Identity theft is another financial risk that employees may need to recognize and respond to. UVA's Identity Theft Prevention Program (ITPP) helps protect students, families, and the University community by identifying, detecting, preventing, and responding to warning signs—or "red flags"—that may indicate identity theft.
The program was developed in accordance with the Federal Trade Commission's Identity Theft Red Flags Rule, part of the Fair and Accurate Credit Transactions Act (FACT Act). The program addresses both the opening of new covered accounts and the maintenance of existing covered accounts across the University.
Who's in Scope at UVA?
The Red Flags Rule applies when the University acts as a creditor and maintains covered accounts, including certain arrangements involving deferred payment for goods or services.
Examples of activities that may be in scope include:
- Student or parent tuition payment plans and institutional loans
- Deferred housing or dining charges and installment billing
- Certain employee receivables, such as payroll overpayments on payment plans
- Patient financial arrangements, where applicable and managed by UVA entities in scope
Activities not typically in scope include:
- One-time point-of-sale payments with no deferred payment
- Marketing communications that don't involve account access
Some activities may fall near the boundary. If you're unsure whether the Red Flags Rule applies to your work, contact Financial Compliance for guidance.
Common Red Flags at UVA Red Flags Rule FAQs
Your Responsibilities Under the Program
Employees whose work involves covered accounts have an important role in UVA's Identity Theft Prevention Program. Staff in scope should:
- Complete required training
- Follow established identity-verification procedures
- Recognize potential red flags
- Promptly report suspected red flags
How UVA Manages the Program
- Program Oversight
Senior leadership, including the Board of Visitors as appropriate, provides oversight of the Identity Theft Prevention Program. Administration of the program is delegated to the vice president and chief financial officer and the vice president and chief information officer.
Operational leads—including the University Controller, Student Financial Services/Accounts Receivable, IT Security, and HR/Payroll, as applicable—own and operate process-level controls within their areas.
- Service Providers and Vendors
Service providers involved in covered activities, such as loan servicers, payment processors, and collection services, must maintain reasonable red-flag controls. Appropriate agreements should address security and incident notification.
Program practices include:
- Including appropriate red-flags provisions in agreements
- Obtaining periodic assurance through SOC reports, questionnaires, certifications, or other appropriate methods
- Maintaining an escalation path when a vendor detects possible identity theft involving UVA accounts
- Training and Awareness
Employees whose responsibilities involve covered accounts should complete required training and stay familiar with appropriate information-security practices.
- Annual Review and Reporting
UVA reviews the Identity Theft Prevention Program regularly to help ensure it continues to address relevant risks and University activities.
- Risk assessment: Updated annually or following significant changes or incidents
- Metrics: Red flags detected, types and outcomes, control changes, and vendor issues
- Leadership reporting: Program effectiveness, recommendations, and planning for the coming year
Strange, Odd, or Concerning?
You aren't expected to investigate a situation yourself or prove that misconduct has occurred before raising a concern.
If something seems strange, odd, or concerning, ask questions or use an appropriate reporting channel. Providing information early can help the University determine whether additional review is needed.
What Should I Do Next?
If you have a question about a financial process, risk, or internal control, Financial Compliance can help you determine the appropriate next step.
If you need to report suspected fraud, waste, abuse, mismanagement, or another concern, UVA provides reporting options, including resources for anonymous reporting.
Questions for Financial Compliance: [email protected]