Resources

Appendix A: Compliance Risk Examples

Compliance Risks may include, but are not limited to:

Academic and Student Services

  • Failure to comply with financial aid regulations, resulting in audit findings or loss of eligibility
  • Non-compliance with Title IX requirements for responding to complaints of sexual misconduct
  • Mishandling of student information (e.g., FERPA violations)

Research and Sponsored Programs

  • Failure to disclose outside financial interests in research
  • Inadequate export control screening for international research collaborations
  • Mismanagement of federal research grants or cost-sharing requirements

Information Security and Data Governance

  • Use of unapproved third-party software or cloud services that violate data protection rules
  • Unauthorized access to restricted institutional data due to weak access controls
  • Failure to complete mandatory cybersecurity training or system patching

Environmental Health and Safety

  • Environmental or laboratory safety violations (e.g., improper storage of hazardous materials)
  • Non-compliance with safety protocols in research, clinical, or facilities operations

Administrative (i.e., Finance, Procurement, Human Resources)

  • Unauthorized travel or purchases made using University TCard or PCard
  • Failure to submit I9 form for new hires including student employees
  • Non-compliance with Procurement protocols (e.g. improper use of non-competitive procurement exceptions)
  • Unauthorized vendor contract execution and oversight

Appendix B: Control Effectiveness Scale

Rank Scale Existing Controls
0 N/A
1 Excellent
  • Policies mandated and updated regularly;
  • Regular mandatory training is provided to the identified responsible person(s) and is tracked and documented;
  • Regular management monitoring reviews are performed and documented.
2 Very Good
  • Policies mandated and updated regularly;
  • Regular training is provided to the identified responsible person(s), but may not be tracked or documented;
  • Regular management monitoring reviews are performed, but not documented.
3 Good
  • Policies mandated, but not updated regularly;
  • Responsible person(s) identified;
  • Training is provided when needed;
  • Some management monitoring reviews are performed but not documented.
4 Fair
  • Policies and procedures in place, but neither mandated nor updated regularly
  • Responsible person(s) identified;
  • Some formal and informal (on the job) training;
  • No management monitoring reviews.
5 Poor
  • No policies or procedures are in place;
  • No responsible person(s) identified;
  • No training (formal or informal);
  • No management monitoring reviews.

Appendix C: Impact Assessment Framework

Measure of Impact 0 – No Impact 1 – Very Low 2 – Low 3 – Moderate 4 – High 5 – Critical
A. Legal / Compliance Fully compliant No legal or regulatory enforcement action Civil violation with little/no fines Significant civil fines/penalties Serious violation, criminal prosecution probable Significant violation, criminal conviction probable; loss of accreditation or licensure
B. Health & Safety No risk of harm No injuries First aid treatment Medical treatment Death or extensive injuries Multiple deaths or several permanent disabilities
C. Financial No financial loss/impact Little financial loss or impact ≤ $499 Financial loss/impact $500–$999 Financial loss/impact $1,000–$99,999 Financial loss/impact $100,000–$499,000 Financial loss/impact ≥ $500,000 or 5% of unit’s base
D. Strategic No impact on strategic goals Slows progress on one strategic goal Slows progress on more than one strategic goal Stops progress on one strategic goal Stops progress on more than one strategic goal Loss of accreditation or license and/or reverses progress on one or more strategic goals
E. Operational Disruption No disruption Minimal disruption; no impact on service Some disruption; limited inefficiencies or delays Operational changes necessary to adjust to risk or control failure Operations must significantly shift to adjust to risk or control failure Operations are disabled
F. Reputation No public visibility Unsubstantiated, very low, or no news item Substantiated, low impact, low news profile Substantiated, public embarrassment; moderate impact, moderate news profile Substantiated, public embarrassment; high impact, high news profile; third-party actions Substantiated, public embarrassment; high and widespread news profile; third-party actions

Appendix D: Likelihood of Non-Compliance Scale

Rank Scale Frequency of Non-Compliance
1 Rare May only occur in exceptional circumstances; less than once in 10 years.
2 Unlikely Could occur at some time, at least once in 10 years.
3 Possible May occur at some time, at least once in five years.
4 Likely Will probably occur, at least once per year.
5 Almost Certain Expected to occur in most circumstances, more than once per year.

UConn Regulatory Compliance Matrix

content

Survey Definitions

Compliance Risk: The potential for legal, financial, reputational, or operational harm resulting from a failure to follow laws, regulations, external standards, or University policies. These risks may arise from specific activities, decentralized processes, gaps in oversight, or the absence of appropriate controls.

The UConn Regulatory Compliance matrix (Appendix E) further lists identified regulations with compliance risks by institutional unit. Please note that this UConn Regulatory Compliance matrix, while extensive, is not exhaustive and other compliance risks may exist for your unit.

Control: Any policy, procedure, activity, or system designed to prevent, detect, or correct non-compliance with laws, regulations, external standards, or institutional policies. Controls help ensure that operations are conducted in accordance with applicable requirements and that risks are appropriately managed.

Controls may be:

  • Preventive (e.g., system access restrictions, required pre-approvals)
  • Detective (e.g., audits, exception reports, reconciliations)
  • Corrective (e.g., policy updates, retraining, system reconfigurations after an issue is identified)

Monitoring: The ongoing activities conducted to ensure that controls are functioning as intended and that operations consistently comply with applicable laws, regulations, policies, and procedures.

Examples include but are not limited to:

  • Generating and reviewing reports to assess compliance with system access restrictions
  • Supervisors reviewing work for adherence to procedures
  • Reviewing completion rates for mandatory training
  • Conducting periodic reviews of financial transactions
  • Tracking submission of required documentation or certifications