The University is not maintaining adequate internal controls over its purchasing/disbursement system.

During our testing, we noted the following internal control deficiencies over the purchasing and cash disbursements systems:

Although no improper purchases were noted in our current audit testing, failure to establish proper internal controls over the purchasing and disbursement systems creates an opportunity for fraudulent purchases and could, at a minimum, lead to the improper and unauthorized use of University assets. University expenses excluding salary, benefits and depreciation exceeded $35 million in the fiscal year ended June 30, 2003. (Finding 1, pages 27-29)

We recommended the following actions to strengthen the internal controls over the purchasing/disbursement system:

University officials partially accepted the recommendations to strengthen the internal controls over purchasing and disbursement systems. They agreed that accounts payable personnel should not have access to the purchasing screens that lead to the creation of a purchase order and stated that they had corrected the problem. They disagreed, however, with our recommendations: 1) to limit the access to the vendor database; 2) to eliminate the ability of purchasing personnel to invoice; and 3) to limit override access in budgetary controls. The University also disagreed to develop information systems controls to document a proper audit trail for purchase order changes.

In our Auditors’ Comment, we noted our recommendations allow the University officials some flexibility. We reiterated our position and views relating to internal controls over purchasing and accounts payable functions.

The University needs to improve its plan for reacting to disasters.

The University has approximately $8.5 million of computer equipment located at its Charleston campus. Most University personnel rely on data and automated processes to perform their tasks of servicing students, staff, administration, and alumni. Some of the University’s critical and financially sensitive applications are as follows:

The University’s disaster recovery plan focuses on disaster prevention and an on-site recovery approach to disaster recovery.

The University’s disaster recovery plan does not include any provisions for testing the disaster recovery plan nor for training personnel about systems recovery procedures. The University has not conducted any formal tests of the disaster recovery plan to determine whether critical systems could be restored in a reasonable amount of time in order to minimize disruptions to University operations. The University last updated their disaster recovery plan in June 2002.

Failure to adequately test the disaster recovery plan leaves the University exposed to the possibility of major disruptions of services to the students and academic and administrative employees. (Finding 2, pages 30-32) This finding has been repeated since 2001.

We continued to recommend the University revise its existing disaster recovery plan to include provisions for testing the disaster recovery plan and for training personnel about system recovery procedures. We also recommended the University should explore alternatives available to it to test disaster recovery of critical applications that would not require a full system shutdown so that they can determine if critical applications can be recovered within the required timeframe. Further, we recommended the University update their disaster recovery plan at least annually.

University officials disagreed with the finding. The University believes that it has demonstrated on several occasions its ability to restore mission-critical services in a reasonable timeframe after a disaster.

In our Auditors’ Comment we noted that information technology guidance (including the National Institute of Standards and Technology and General Accounting Office) endorse the formal testing of disaster recovery plans. Tests of disaster recovery plans verify that the plan, procedures, resources provide the capability to recover critical systems within the required timeframe. We also noted that during the course of fieldwork, the University did not provide our auditors with documentation to support its claims that its efforts to recover from failures or upgrades constitute disaster recovery testing.

The University filed emergency purchase affidavits to lease two real estate properties without the benefit of competitive bidding.

The University was scheduled to begin construction of a $46 million project to build a new Fine Arts Center in the Fall of 2002. Due to the nature of the project, the contents of the old Fine Arts building had to be removed and were not available for use beginning with the Fall semester of 2002. Therefore, the University needed to secure additional space to hold the faculty and classes that previously were located in this building.

The University formed a committee that began looking into possible sites to move the faculty and students during January of 2002. The committee began looking around the campus area and discussed possible properties that would fit the University’s needs. By early April of 2002, the committee had decided on the properties that they wanted to pursue and began negotiations with the landlords on the terms of the lease including the renovations required on these properties.

The University signed two real estate lease agreements on July 3, 2002. One lease was for $254,600 for rent covering 38 months ($6,700 per month) and an additional $153,557 for building renovations. The second lease was for $234,000 for rent covering 39 months ($6,000 per month) and an additional $258,603 for building renovations. On July 10, 2002 the University filed emergency purchase affidavits with the Office of the Auditor General for the above leases.

The Illinois Procurement Code (30 ILCS 500/40-15 and 40-20) requires that real property and capital improvement leases of the type procured by the University be competitively procured through a request for information process.

According to University management, they never seriously considered competitively procuring the lease space because they believed that the Charleston market was too small to find competitive sources of lease space available. (Finding 5, pages 35-38)

We recommended that the University begin the planning process of leasing real property and capital improvements at the earliest available opportunity so that such property may be acquired through statutorily required competition and thus can be leased in the most economically advantageous manner.

University officials disagreed with the finding and recommendation. They stated that under the Procurement Code a request for information process is not necessary to procure leases with rent less than $100,000 per year. The annual rent on the properties amount to $80,400 and $72,000, respectively. To ensure full disclosure of these transactions the emergency purchase affidavits included the cost to renovate the facilities. University officials stated that they began the process to find alternative space for departments housed in the Fine Arts Center in November 2000, 21 months in advance of the initial date established to vacate the Fine Arts building.

In our Auditors’ Comments, we noted that the two leases exceed the $100,000 annual threshold requiring a competitive procurement when the cost of building renovations are included. This method of calculating base rent is consistent with guidance from CMS. The University is simultaneously arguing that they began the process of acquiring these leases 21 months before they were signed and that they were justified in acquiring the leases on an "emergency" basis. We stand by our finding and would continue to encourage the University to begin the process of leasing real property at the earliest available opportunity and to comply with the requirements of the Procurement Code when acquiring leased property.

The remaining findings are less significant and are reportedly being given attention by the University. We will review progress toward implementing these recommendations in our next audit.

Mr. Jeffrey L. Cooley, Vice President for Business Affairs, provided responses to the findings and recommendations.

Our auditors state the Eastern Illinois University's financial statements as of and for the year ended June 30, 2003 are fairly presented in all material respects.

____________________________________

WILLIAM G. HOLLAND, Auditor General

WGH:JAF:pp

Doehring, Winders & Co. LLP were our special assistant auditors on this engagement.