Dennis R. Black carefully hid his thefts from the University at Buffalo by using a special bank account that few others at the university even knew existed. But Black's fraud – over a period of at least nine years when he was a UB vice president – was made easier by a variety of deficiencies in the university's system of internal and external controls, a university official said.
For one, UB's internal audit office was understaffed and barely functioning at the time of the thefts, according to Laura Hubbard, UB vice president for finance and administration.
"We only had three auditors. They weren't really doing a lot of audits," Hubbard said this week in a briefing to the UB Council, a university advisory board, on reforms and improvements put in place to prevent future fraud and theft at the university. "We can have the best budget allocation system in the world, but if we don't follow up and make sure the funds were spent the way they were intended, then we're still not performing our mission."
The university has since hired an audit director and two additional auditors, while also putting in place an annual internal audit process that focuses on areas of the university with the greatest risk of fraudulent activity, Hubbard said. "We feel like we've right-sized at this point for an institution of our size and complexity."
Internal audits and tips from whistle blowers are the most likely ways to uncover fraud in large organizations, and it was ultimately an internal audit ordered in spring of 2016 by UB President Satish K. Tripathi that led to the discovery of Black's thefts. The audit was forwarded to the state Inspector General's Office, which investigated further.
Black pleaded guilty earlier this month in State Supreme Court to stealing $320,000 in university funds for luxuries such as Broadway tickets, charitable contributions and travel to his son's wedding. The thefts dated back at least to 2007, according Erie County District Attorney John J. Flynn. Another former UB administrator, Andrea Costantino, who was director of campus living and had worked under Black, also pleaded guilty to stealing $14,664 in university funds.
Flynn, a graduate of the UB Law School, openly criticized the university for not having stricter controls that would have prevented the thefts, or at least detected them sooner. Deputy Inspector General Jeffrey Hagen said his office was still investigating at UB and throughout the State University of New York system.
"We're looking at the policies and procedures there to insure that this never happens again," Hagen said.
A dearth of internal auditing at UB wasn't the only shortcoming in the Black case. External audits over the years failed to identify problems with financial controls in the Faculty-Student Association, a university-affiliated non-profit organization that became embroiled in Black's fraud scheme.
Black, 61, served as vice president for university life and services, overseeing a sprawling enterprise of campus housing, dining and other programs. Like many universities, UB years ago created a separate non-profit corporation to run its dining operations. Public colleges and universities routinely do this as a way to run programs unencumbered by restrictions that often accompany the use of state funds. At UB, the corporation is the FSA, and it is responsible for a $40 million-per-year operation known as Campus Dining & Shops that employs 700 people and produces annual net revenues of $3.5 million.
UB charges FSA an annual assessment of 13 percent of its revenues to cover the costs of the university's overhead for supporting what FSA does. The assessment ends up in the general university fund, to be used as administrators see fit.
In addition to the general university fund assessment, Black had set up another tax on FSA to pay for overhead expenses incurred by his Office of University Life and Services. That separate tax is allowable, as long as the overhead expenses are documented, Hubbard said.
But Black had the money from the second assessment on FSA put into a special bank account that was hidden from other university officials. It was those sorts of transactions that an external audit should have raised questions about, Hubbard said.
"We felt that there were some internal control weaknesses there that could and should have been identified by external auditors," she said.
Black used credit cards to access funds from the hidden bank account for his personal use. The account had $3.2 million when the university froze it in 2016. Those funds ultimately were transferred to the university.
Several other problems helped Black's thefts go undetected. The board of the FSA was not particularly attuned to its fiduciary duties, Hubbard said. The board consisted of six students who rarely showed up to meetings, two faculty members, and four administrators who were all from the Office of University Life and Services and reported directly to Black.
"Mr. Black had an enormous control over FSA," Flynn said on Sept. 8, moments after Black pleaded guilty to two felony charges.
The FSA board was reconstituted in 2016. It still includes six students and two faculty members. But three independent directors have been added to the board. Those independent directors also comprise a newly created audit committee of the board. In addition to four administrative representatives from university life and services, three administrators from other areas of the university are now on the board, said Hubbard. FSA also hired a new outside auditor for its annual financial statements.
Other reforms implemented over the past year or so will also help the university ward off future fraud, including the use of new web-based systems for travel and for procurement of goods and services, Hubbard said. Both systems are based upon updated university policies.
Hubbard said she and Tripathi recognized the need to enhance the university's internal controls when she started at UB in 2012. But even with policy changes and reforms in place now, the university is unlikely to prevent all fraud, she said.
"The piece we want to focus on is opportunity," she said. "So the greater the extent to which we can take away the opportunity, the better. But we can't 100 percent prevent fraud without other consequences, like not being able to get business done. So we have to find a balance."