REPORT DIGEST NORTHERN ILLINOIS UNIVERSITY SINGLE AUDIT, AND COMPLIANCE EXAMINATION FOR THE YEAR ENDED JUNE 30, 2016 Release Date: March 29, 2017 FINDINGS THIS AUDIT: 12 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 0 -- 1 -- 1 Category 2: 6 -- 5 -- 11 Category 3: 0 -- 0 -- 0 TOTAL: 6 -- 6 -- 12 FINDINGS LAST AUDIT: 10 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION This digest covers our federal Single Audit and Compliance Examination of the Northern Illinois University for the year ended June 30, 2016. A separate Financial Audit as of and for the year ended June 30, 2016, was previously released on February 9, 2017. In total, this report contains 12 findings, one of which was reported in the Financial Audit. SYNOPSIS • (16-03) The University has not established adequate internal controls over contracts to ensure they are approved prior to performance and comply with all applicable state requirements. • (16-08) The University did not fully respond to Freedom of Information Act requests and did not retain documents in accordance with the Records Retention Act and its own policies. • (16-11) The University did not fully comply with requirements applicable to its property and equipment. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS INTERNAL CONTROLS OVER CONTRACTS NEED IMPROVEMENT Northern Illinois University (University) has not established adequate internal controls over contracts to ensure they are approved prior to performance and comply with all applicable state requirements. During our review of 84 contracts in effect during the year ended June 30, 2016, we noted the following: • 27 contracts (32%) were missing one or more of the required certifications or clauses. • 11 contracts (13%) did not have a contract obligation document filed with the Illinois State Comptroller’s Office. Each contract contained an order for delivery that exceeded $20,000. • 8 contracts (10%) were not approved prior to goods or services being provided. • The public procurement files for 5 contracts (6%) did not contain all the evaluation material used to determine the vendor to whom the contract was awarded. Each contract was awarded under qualified based selection procurement rules. • 2 contracts (2%) exceeding $50,000 each were approved without obtaining the vendors’ disclosure of financial interest form. Additionally, we noted the University gave a vendor two orders for tree trimming services on July 1, 2015. One order was for $55,400 while the other was for $50,000. If combined these orders would have exceeded the small purchasing threshold of $55,800 and would have been required to be put out to bid. University officials stated that these orders were not combined as two different departments requested the service and had different funding sources. We note the University has a centralized procurement function and a benefit of a centralized purchasing function is that different departments’ needs can be combined when obtaining goods and services. (Finding 3, pages 19-22). This finding has been repeated since 2012. We recommended the University implement appropriate procedures to ensure contracts are complete, are properly approved prior to performance, and supported with complete public procurement files. University officials accepted the recommendation. (For the previous University response, see Digest Footnote #1.) NEED TO COMPLY WITH THE FREEDOM OF INFORMATION AND STATE RECORDS RETENTION ACTS Northern Illinois University (University) did not fully respond to Freedom of Information Act requests and did not retain documents in accordance with the Records Retention Act and its own policies. We selected a sample of 25 responses to Freedom of Information Act requests to review the completeness of the University’s responses and noted the following: • 3 responses (12%) did not include all the information requested. The University did not inform the requestor the information was not included in the response or provide a reason as to why it was not included. One of the requestors noted that information was missing and informed the University of the oversight. The missing information was provided 5 business days after it was due based on the original request. • 1 response (4%) to a request for a listing of all e-mails written and received by an employee in the Administration and Finance office for a period of four months contained 351 e- mails or approximately 3 a day. The requestor questioned the completeness of the list and was informed the University had provided all the information it had and if the employee had deleted any e- mails during the requested timeframe it was too late to recover them. The e-mails requested would have been approximately two years old at the time of the request. (Finding 8, pages 29-30) We recommended the University strengthen controls over its process of providing responses to Freedom of Information Act requests and implement controls to ensure its employees are aware of document retention policies and procedures. University officials accepted the recommendation. NEED TO IMPROVE CONTROLS OVER PROPERTY AND EQUIPMENT The University did not fully comply with the requirements applicable to its property and equipment. We reviewed the University’s property inventory certification as of November 30, 2015 that was submitted to the Department of Central Management Services (DCMS). The inventory certification to DCMS reported 315 items, totaling $356,432, of equipment that could not be located by the University. These assets were acquired by the University during the current as well as past fiscal years. Included in this listing were approximately 107 computers, servers, CPUs, or other electronic storage devices. Additionally, we tested the final amended versions of the Agency Report of State Property (C-15) reports the University filed for all four quarters of fiscal year 2016 and noted several errors. In the University’s quarter two filing, the amount of equipment additions were understated by $4,003,750 to correct a prior period error that overstated the beginning balance of equipment. Then in the University’s quarter three filing, deletions from construction in progress were overstated by $108,044 when an amount was removed twice in error. This error was not corrected which resulted in a $108,044 understatement of the University’s reported ending construction in progress amount for both quarters three and four. (Finding 11, pages 34-35) We recommended the University strengthen its internal controls over the accountability and reporting of University property. University officials accepted the recommendation. OTHER FINDINGS The remaining findings are reportedly being given attention by the University. We will review the University’s progress towards the implementation of our recommendations in our next Single Audit and State Compliance Examination. AUDITOR’S OPINION The auditors stated the financial statements of the University as of and for the year ended June 30, 2016 are fairly stated in all material respects. The auditors also conducted a Single Audit of the Agency as required by the Uniform Guidance. The auditors stated the University complied, in all material respects, with the types of compliance requirements that could have a direct and material effect on the University’s major federal programs for the year ended June 30, 2016. ACCOUNTANT’S OPINION The accountants conducted a compliance examination of the University for the year ended June 30, 2016, as required by the Illinois State Auditing Act. The accountants stated the University complied, in all material respects, with the requirements described in the report. This Single Audit and State Compliance Examination was conducted by RSM US LLP. BRUCE L. BULLARD Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:TLK DIGEST FOOTNOTES #1 – Inadequate Controls Over Contracts – Previous University Response – The University accepts the Auditor’s recommendation. Corrective actions implemented have resulted in substantial improvement over contract review and approval, reducing the number of audit exceptions from 18 of 66 tested in FY14 to 2 of 40 tested in FY15. The University is also expanding the contract management and review process. Additional staff resources and modifications to the procurement department’s workflow will combine to ensure this finding is eliminated in the FY ’16 audit cycle.