REPORT DIGEST

 

EASTERN ILLINOIS UNIVERSITY

 

FINANCIAL AND COMPLIANCE AUDIT

(In Accordance with the Single Audit Act and OMB Circular A-133)

For the Year Ended:

June 30, 2003

 

Summary of Findings:

 

Total this audit                      6

Total last audit                      7

Repeated from last audit       2

 

Release Date:

March 30, 2004

 

 

 

 

 

 

 

State of Illinois

Office of the Auditor General

WILLIAM G. HOLLAND

AUDITOR GENERAL

 

 

To obtain a copy of the Report contact:

Office of the Auditor General

Iles Park Plaza

740 E. Ash Street

Springfield, IL 62703

(217) 782-6046 or TDD (217) 524-4646

 

This Report Digest is also available on

the worldwide web at

http://www.state.il.us/auditor

 

 

 

SYNOPSIS

  • The University did not maintain adequate controls over the purchasing/disbursement system.
  • The University needs to improve and test its computer disaster recovery capability.
  • The University filed emergency purchase affidavits to lease two real estate properties without the benefit of competitive bidding.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

{Expenditures and Activity Measures are summarized on the reverse page.}

 

 

    EASTERN ILLINOIS UNIVERSITY

 

FINANCIAL AND COMPLIANCE AUDIT

       For The Year Ended June 30, 2003

 

STATEMENT OF REVENUES, EXPENSES AND CHANGES IN NET ASSETS

2003

2002

OPERATING REVENUES

     Student tuition and fees

     Auxiliary enterprises (net of scholarship allowances of $1,134,446)

     Grants and contracts

     Sales and services of educational activities

     Other

               Total Operating Revenues 9;
 

OPERATING EXPENSES

     Instruction

     Auxiliary enterprises

     Institutional support

     Student services

     Academic support

     Operations and maintenance of plant

     Depreciation expense

     Public service

     Student aid

     Research

               Total Operating Expenses

Operating Income (Loss)

 

NONOPERATING REVENUES (EXPENSES)

     State appropriations

     Payments on behalf of the University

     Other nonoperating revenues (expenses), net

               Total Nonoperating Revenues (Expenses)

Income (Loss) Before Capital Contributions

Capital appropriations, capital gifts and donated assets #9;

INCREASE IN NET ASSETS

Net assets, beginning of the year (2002 restated)

Net assets, end of the year 9;

 

$39,040,593

30,197,309

12,627,031

3,818,914

2,105,484

$87,789,331

 

 

$58,254,959

22,523,655

14,221,718

13,933,442

11,329,819

10,286,699

8,613,345

6,898,650

3,927,293

1,068,794

$151,058,374

$(63,269,043)

 

 

$50,461,113

19,568,936

(1,167,914)

$68,862,135

$5,593,092

4,112,416

$9,705,508

71,059,157

$80,764,665

 

$33,258,545

26,721,857

12,534,769

3,769,328

1,783,443

$78,067,942

 

 

$57,930,752

22,541,428

13,828,308

13,693,897

11,545,527

10,648,497

7,749,403

7,380,834

3,834,947

825,972

$149,979,565

$(71,911,623)

 

 

$54,194,231

17,973,289

(244,534)

$71,922,986

$11,363

11,646,076

$11,657,439

59,401,718

$71,059,157

SELECTED ACCOUNT BALANCES

JUNE 30, 2003

JUNE 30, 2002

Cash and investments

Capital assets, net of accumulated depreciation

Revenue bonds, notes payable and capital lease obligations

Accrued compensated absences

Net assets 9;

$27,262,450

$134,120,991

$62,194,503

$15,593,689

$80,764,665

$34,007,733

$123,507,934

$65,353,228

$16,205,547

$71,059,157

SUPPLEMENTARY INFORMATION (Unaudited)

2003

2002

Average Number of Employees

     Faculty/administrative

     Civil service

     Student employees

               Total Employees

Selected Activity Measures

Annual full-time equivalent students

Full-time equivalent costs per student

 

877

832

329

2,038

 

9,628

$11,145

 

840

863

326

2,029

 

9,060

$11,572

UNIVERSITY PRESIDENT

During Audit Period and Currently: Mr. Louis V. Hencken (Interim President until 10/1/03)

 

 

 

 

 

 

 

 

 

Accounts payable personnel can access the vendor database and can create a purchase order

 

 

 

Purchasing personnel have the right to process invoices and override budgetary controls

 

 

 

 

 

 

 

Limit access to vendor database

Eliminate purchasing personnel from processing invoices

Limit access overrides to fewer employees

Enhance controls over changes to purchase order amounts

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The University’s disaster recovery plan does not include any provisions for testing the disaster recovery plan

 

The University did not update their disaster recovery plan during the last fiscal year

 

 

Need to train personnel about system recovery procedures
 

Need to test disaster recovery plan
 

Need to update the disaster recovery plan

 

 

 

 

 

 

 

 

 

 

 

Emergency purchases filed without the use of competitive bidding

 

 

 

 

 

 

 

Emergency purchases were filed for two leases, one for $254,600 in rent and $153,557 in renovations; the other for $234,000 in rent and $258,603 in renovations

 

State law requires certain leases be competitively procured through a request for information process

 

University management never seriously considered competitively procuring the lease space

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

PURCHASING/DISBURSEMENT SYSTEM INTERNAL CONTROLS NEED IMPROVEMENT

The University is not maintaining adequate internal controls over its purchasing/disbursement system.

During our testing, we noted the following internal control deficiencies over the purchasing and cash disbursements systems:

    • Accounts payable personnel have access to the vendor database on the computer system.
    • Accounts payable personnel were given access rights to create a purchase order.
    • Purchasing personnel have the right to process invoices for payment.
    • Amounts can be changed after purchase orders are entered into the purchasing system and no audit trail is produced that would document the date of, amount of, reason for, authority for, and identity of the employee making the change.
    • All purchasing personnel have been given access to override the budgetary controls on the purchasing system if a purchase order amount would cause the account to go over budget.

Although no improper purchases were noted in our current audit testing, failure to establish proper internal controls over the purchasing and disbursement systems creates an opportunity for fraudulent purchases and could, at a minimum, lead to the improper and unauthorized use of University assets. University expenses excluding salary, benefits and depreciation exceeded $35 million in the fiscal year ended June 30, 2003. (Finding 1, pages 27-29)

We recommended the following actions to strengthen the internal controls over the purchasing/disbursement system:

    • Limit the access to the vendor database by allowing only one employee from accounts payable access to it, and eliminate the right of all accounts payable employees to create purchase orders.
    • Eliminate the right of purchasing personnel to process invoices for payment.
    • Limit the access to override the purchasing system budgetary controls to only two to three employees to maintain accountability.
    • Develop information system controls over changes to purchase order amounts that include documenting a proper audit trail of the changes made.

University officials partially accepted the recommendations to strengthen the internal controls over purchasing and disbursement systems. They agreed that accounts payable personnel should not have access to the purchasing screens that lead to the creation of a purchase order and stated that they had corrected the problem. They disagreed, however, with our recommendations: 1) to limit the access to the vendor database; 2) to eliminate the ability of purchasing personnel to invoice; and 3) to limit override access in budgetary controls. The University also disagreed to develop information systems controls to document a proper audit trail for purchase order changes.

In our Auditors’ Comment, we noted our recommendations allow the University officials some flexibility. We reiterated our position and views relating to internal controls over purchasing and accounts payable functions.

 

COMPUTER DISASTER RECOVERY PLAN NEEDS IMPROVEMENT

The University needs to improve its plan for reacting to disasters.

The University has approximately $8.5 million of computer equipment located at its Charleston campus. Most University personnel rely on data and automated processes to perform their tasks of servicing students, staff, administration, and alumni. Some of the University’s critical and financially sensitive applications are as follows:

    • Financial Records System
    • Grade Processing and Reporting
    • Financial Aid Management System

The University’s disaster recovery plan focuses on disaster prevention and an on-site recovery approach to disaster recovery.

The University’s disaster recovery plan does not include any provisions for testing the disaster recovery plan nor for training personnel about systems recovery procedures. The University has not conducted any formal tests of the disaster recovery plan to determine whether critical systems could be restored in a reasonable amount of time in order to minimize disruptions to University operations. The University last updated their disaster recovery plan in June 2002.

Failure to adequately test the disaster recovery plan leaves the University exposed to the possibility of major disruptions of services to the students and academic and administrative employees. (Finding 2, pages 30-32) This finding has been repeated since 2001.

We continued to recommend the University revise its existing disaster recovery plan to include provisions for testing the disaster recovery plan and for training personnel about system recovery procedures. We also recommended the University should explore alternatives available to it to test disaster recovery of critical applications that would not require a full system shutdown so that they can determine if critical applications can be recovered within the required timeframe. Further, we recommended the University update their disaster recovery plan at least annually.

University officials disagreed with the finding. The University believes that it has demonstrated on several occasions its ability to restore mission-critical services in a reasonable timeframe after a disaster.

In our Auditors’ Comment we noted that information technology guidance (including the National Institute of Standards and Technology and General Accounting Office) endorse the formal testing of disaster recovery plans. Tests of disaster recovery plans verify that the plan, procedures, resources provide the capability to recover critical systems within the required timeframe. We also noted that during the course of fieldwork, the University did not provide our auditors with documentation to support its claims that its efforts to recover from failures or upgrades constitute disaster recovery testing.

IMPROPER EMERGENCY PURCHASES FILED

The University filed emergency purchase affidavits to lease two real estate properties without the benefit of competitive bidding.

The University was scheduled to begin construction of a $46 million project to build a new Fine Arts Center in the Fall of 2002. Due to the nature of the project, the contents of the old Fine Arts building had to be removed and were not available for use beginning with the Fall semester of 2002. Therefore, the University needed to secure additional space to hold the faculty and classes that previously were located in this building.

The University formed a committee that began looking into possible sites to move the faculty and students during January of 2002. The committee began looking around the campus area and discussed possible properties that would fit the University’s needs. By early April of 2002, the committee had decided on the properties that they wanted to pursue and began negotiations with the landlords on the terms of the lease including the renovations required on these properties.

The University signed two real estate lease agreements on July 3, 2002. One lease was for $254,600 for rent covering 38 months ($6,700 per month) and an additional $153,557 for building renovations. The second lease was for $234,000 for rent covering 39 months ($6,000 per month) and an additional $258,603 for building renovations. On July 10, 2002 the University filed emergency purchase affidavits with the Office of the Auditor General for the above leases.

The Illinois Procurement Code (30 ILCS 500/40-15 and 40-20) requires that real property and capital improvement leases of the type procured by the University be competitively procured through a request for information process.

According to University management, they never seriously considered competitively procuring the lease space because they believed that the Charleston market was too small to find competitive sources of lease space available. (Finding 5, pages 35-38)

We recommended that the University begin the planning process of leasing real property and capital improvements at the earliest available opportunity so that such property may be acquired through statutorily required competition and thus can be leased in the most economically advantageous manner.

University officials disagreed with the finding and recommendation. They stated that under the Procurement Code a request for information process is not necessary to procure leases with rent less than $100,000 per year. The annual rent on the properties amount to $80,400 and $72,000, respectively. To ensure full disclosure of these transactions the emergency purchase affidavits included the cost to renovate the facilities. University officials stated that they began the process to find alternative space for departments housed in the Fine Arts Center in November 2000, 21 months in advance of the initial date established to vacate the Fine Arts building.

In our Auditors’ Comments, we noted that the two leases exceed the $100,000 annual threshold requiring a competitive procurement when the cost of building renovations are included. This method of calculating base rent is consistent with guidance from CMS. The University is simultaneously arguing that they began the process of acquiring these leases 21 months before they were signed and that they were justified in acquiring the leases on an "emergency" basis. We stand by our finding and would continue to encourage the University to begin the process of leasing real property at the earliest available opportunity and to comply with the requirements of the Procurement Code when acquiring leased property.

OTHER FINDINGS

The remaining findings are less significant and are reportedly being given attention by the University. We will review progress toward implementing these recommendations in our next audit.

Mr. Jeffrey L. Cooley, Vice President for Business Affairs, provided responses to the findings and recommendations.

AUDITORS' OPINION

Our auditors state the Eastern Illinois University's financial statements as of and for the year ended June 30, 2003 are fairly presented in all material respects.

 

 

____________________________________

WILLIAM G. HOLLAND, Auditor General

WGH:JAF:pp

SPECIAL ASSISTANT AUDITORS

Doehring, Winders & Co. LLP were our special assistant auditors on this engagement.

 

DIGEST FOOTNOTES

#2 COMPUTER DISASTER RECOVERY PLAN NEEDS IMPROVEMENT – Previous University Responses

2002: The University disagrees with the recommendation. The University is unable to fully "test" the disaster recovery plan due to cost constraints and disruption of otherwise unduplicated mission-critical services. We believe, with our disaster recovery plan and help of our IBM standard service, we would be able to restore mission-critical services in a reasonable timeframe after a disaster.

In addition, the University does not believe the disaster recovery plan is the appropriate place for personnel training plans. Through personnel development plans, mainframe staff continue ongoing skills training to keep up with backup and storage technologies.

2001: The University accepts the Auditor’s recommendation and will revise its disaster recovery plan accordingly.