FAQ

Here are some frequently asked questions about the Enterprise Risk Management department and their accompanying answers:

  1. Why have I been chosen for audit?

The answer to this is as simple as it is complicated. Now that may sound like an oxymoron, but allow us to explain. First and foremost, it is very important to understand that everything we do here at the Risk Management office is done because of process.  If you have been chosen, we are not out to get anyone in trouble- we merely have a job to do and co-operation with our department will help the process go very smooth, and in fact be beneficial to everyone as a whole! We are all working toward the same goal, and if we work together, we can achieve that goal much faster and much more efficient.

  1. How can I report a suspicious incident that I have witnessed?

There are many avenues about which one can report a suspicious incident on campus, in fact, reporting directly to the Risk Management office can cut out quite a few middle men, and allow us to investigate the issue that much faster. Here are a few methods to contact the college:
      1.  Cortland suspected fraud form completion: Contact Risk Management
      2.  Cortland Fraud Hotline contacting the College’s              
           Risk  Management Office direct 607-753-4581 (with voicemail)
      3.  Regular mail please write to:

SUNY Cortland
Risk Management and Internal Control Office   
Miller Building, Room 409
PO Box 2000
Cortland, NY  13045

If you prefer to contact SUNY System in Albany directly, the following options are available:          

  1. Email: audit@sysadm.suny.edu
  2. Fax: 518-320-1564
  3. Phone (voicemail): 518-320-1539
  4. For regular mail please write to:

State University of New York
Office of the University Auditor
State University Plaza – Room N120
Albany, New York 12246

In all cases, please submit as much detail as possible regarding your specific concerns along with any relevant information that you are comfortable providing.

  • Your name, e-mail address and phone number (you may choose to remain anonymous)
  • A description of the alleged wrongdoing
  • The individuals involved in the alleged wrongdoing and a description of their involvement
  • The identities of any witnesses to the alleged wrongdoing
  • The dates the alleged wrongdoing occurred and whether it is ongoing
  • The potential financial loss
  1. Who finds out about information I provide to the Enterprise Risk Management department? What are my rights?

All information provided to our department is entirely confidential; you do not need to worry about your name being thrown around in a conversation! You have enough to worry about as it is and we understand that. Not to mention, appreciate greatly that you took the time out of your day to contact us.

Consistent with New York State laws, NYS employees or other persons who lawfully report suspected improprieties shall not suffer negative consequences.

NY Civil Service Law § 75-b:

This statute provides protection to Cortland and all NYS public employees, it prohibits adverse action against any employee who discloses to management or a governmental body information that concerns a violation of law or College policy creating a malfeasance including financial damages and dangers to public health or safety. The NYS employee only needs to reasonably believes the situation is true. 

Again, unlike private employees, public employees receive whistleblower protection for reporting governmental acts that the employee reasonably believes are unlawful but which may not in fact violate a law, rule, or regulation.

Civil Service Law § 75-b requires a cure period before the whistleblower is protected. Specifically, prior to disclosing the information, the employee must make a good faith effort to provide their supervisor and the College with a reasonable opportunity to take appropriate action unless there is an imminent and serious danger to the public’s health or safety.

  1. What are appropriate internal controls

Appropriate internal controls must help the company become more efficient and organized. Inappropriate internal controls will make the workforce in any business less efficient. Conversely, appropriate and well executed internal controls contribute to a business’ ability to reach its mission.

Internal controls should not create more problems within the company once they are set. An example of appropriate controls specifically for colleges could be checking the temperature of the food in the dining halls to ensure student’s well-being. In addition, a company containing a poor system of responding to customer’s complaints is a serious internal control deficiency as these reports are often a final detective control.

If guidance is needed to determine the appropriateness of Department internal controls please do not hesitate to contact the Risk Management Office.

  1. Should our Department Strive to be Risk Free?

Probably not, every Department should first strive to accomplish Campus Priorities. Given limited resources, every Department leader must determine how to best allocate staff time and budget.

  1. What is meant by Tone at the Top?

The “tone” for any given organization (whether that be a company, workgroup, classroom ...)is set by the person(s) in the leadership role for that group or organization. The tone set may include the ethical environment, work ethic, reporting procedures, and all the way down to individual on-the-spot decision making. There may be more or less included in the tone depending on the organization and leadership. Tone from the top means leading by example if you are the position to do so. The tone setter can be a manager, professor, administrator, or you if you are in the leadership position! It is important to remember that there are people following the examples you set. It is also important to note that all members of a group or organization are responsible for consistently implementing the tone from the top.

To put into context tone from the top, imagine you are an employee at a workplace where other employees tend to take frequent smoke breaks. These breaks may only be 2-3 minutes each but over the course of the day or week can add up to a significant amount of time where employees are not doing their job. This is not fair to you, a non-smoker. You bring this up to the manager, who also takes frequent smoke breaks, and they do not see it as a big deal. However, if this manager instead agreed with you and made it clear that everyone should not be taking breaks outside of those that are regularly scheduled, the tone from the top changes and the organizational culture will change likely to the benefit of the organization or group.

  1. What are my rights under the NYS Whistleblower Act

NY Civil Service Law § 75-b:

This statute provides protection to Cortland and all NYS public employees, it prohibits adverse action against any employee who discloses to management or a governmental body information that concerns a violation of law or College policy creating a malfeasance including financial damages and dangers to public health or safety. The NYS employee only needs to reasonably believes the situation is true.

Again, unlike private employees, public employees receive whistleblower protection for reporting governmental acts that the employee reasonably believes are unlawful but which may not in fact violate a law, rule, or regulation.

Civil Service Law § 75-b requires a cure period before the whistleblower is protected. Specifically, prior to disclosing the information, the employee must make a good faith effort to provide their supervisor and the College with a reasonable opportunity to take appropriate action unless there is an imminent and serious danger to the public’s health or safety.

  1. Why Does ERM have a place in higher education

Absolutely, higher education is big business globally. Every college and university is in business to stay in business. To stay in business Cortland must manage risk, understanding that risk response involves,

  • Avoid/Terminate
  • Reduce/ Treat
  • Share/Transfer
  • Accept/Tolerate