REPORT DIGEST NORTHERN ILLINOIS UNIVERSITY COMPLIANCE EXAMINATION AND SINGLE AUDIT FOR THE YEAR ENDED JUNE 30, 2018 Release Date: March 28, 2019 FINDINGS THIS AUDIT: 13 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 0 -- 1 -- 1 Category 2: 6 -- 6 -- 12 Category 3: 0 -- 0 -- 0 TOTAL: 6 -- 7 -- 13 FINDINGS LAST AUDIT: 14 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION This digest covers our federal Single Audit and Compliance Examination of Northern Illinois University for the year ended June 30, 2018. A separate Financial Audit as of and for the year ended June 30, 2018, was previously released on March 7, 2019. In total, this report contains 13 findings, two of which were reported in the Financial Audit. SYNOPSIS • (18-04) The University has not established adequate internal controls over contracts to ensure they are approved prior to performance and comply with all applicable State requirements. • (18-05) The University did not require all employees to submit time sheets as required by the State Officials and Employees Ethics Act. • (18-08) The University has not established adequate controls over the completion of I-9 forms for employees hired by the University. • (18-12) The University did not fully comply with requirements applicable to its property and equipment. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS INADEQUATE INTERNAL CONTROLS OVER CONTRACTS The University has not established adequate internal controls over contracts to ensure they are approved prior to performance and comply with all applicable state requirements. During our review of 40 contracts for the year ended June 30, 2018, some of the items we noted are as follows: • 2 contracts (5%) were missing one or more of the required certifications or clauses. • 3 contracts (8%) in which the University obtained the required certifications after contract approval. The certifications were obtained between 10 and 283 days after the contracts were executed. • 10 contracts (25%) with a total value of $4,046,637 were not approved prior to goods or services being provided. These contracts were executed between 14 and 302 days after the commencement of services or the receipt of the goods. • 5 contracts (13%), totaling approximately $1,620,890 contained contract obligation documents that were not filed within 30 days of execution of the contract. The contract obligation documents were filed between 4 to 22 days late. • 2 contracts (5%), totaling approximately $59,300 did not have a contract obligation document filed with the Illinois State Comptroller’s Office. Each contract contained an order for delivery that exceeded $20,000. The contract obligation documents were not filed as of June 30, 2018. • 2 of 20 contracts (10%) in our sample of 40 with a total value of $165,290 did not contain the Financial/Conflict of Interest Disclosure Forms prior to the approval of the contract. Late disclosures were obtained between 1 and 6 days late. (Finding 4, pages 22-24). This finding has been repeated since 2012. We recommended the University establish and maintain internal control procedures to ensure contracts and leases are complete and properly approved prior to performance. We also recommended the University adhere to State laws, regulations, and University policies and procedures. University officials accepted the recommendation. (For the previous University response, see Digest Footnote #1.) FAILURE TO SUBMIT PROPER TIME REPORTING The University did not require all employees to submit time sheets as required by the State Officials and Employees Ethics Act. During testing over 54 payroll transactions, we noted 22 employees (19 faculty and 3 graduate assistants) did not submit time sheets documenting the time spent each day on official State business to the nearest quarter hour. The State Officials and Employees Ethics Act (the Act) (5ILCS 430) requires the University to adopt personnel policies consistent with the Act. The Act (5ILCS 430/5-5(c) further states, “The policies shall require State employees to periodically submit time sheets documenting the time spent each day on official State business to the nearest quarter hour.” (Finding 5, page 25) This finding has been repeated since 2005. We recommended the University continue its efforts to develop and implement a program to require all employees to submit time sheets in accordance with the Act. University officials accepted the recommendation and stated they continue to engage in efforts to explore alternative strategies to capture time worked by unionized faculty and graduate assistants. (For the previous University response, see Digest Footnote #2.) INADEQUATE CONTROLS OVER I-9 FORMS The University has not established adequate controls over the completion of I-9 forms for employees hired by the University. During our review of fifty (50) employees I-9 forms, we noted the following: • Seventeen I-9 forms (34%) in which the employee’s hire date was not documented. • Seven I-9 forms (14%) where the University did not timely perform verification of the employee’s eligibility. • Five I-9 forms (10%) in which the employee did not complete section 1 on or before the hire date. • Two I-9 forms (4%) in which the University failed to date their verification of the employee’s eligibility. • One I-9 form (2%) in which the date of hire did not agree to the employee’s personnel file. U.S. Citizenship and Immigration Services (USCIS) instructions for Form I?9 require Section 1 be completed no later than the first day of employment. After completing Section 1, the employee is to sign their name and document the date signed. Employers are to examine evidence of identity and employment authorization within 3 business days of the employee’s first day of employment. The employer is to document the hire date and their signature and date of their review in Section 2 of the I?9 form. (Finding 8, page 28). We recommended the University enhance their controls over the process for preparing and reviewing the I-9 Forms to ensure compliance with USCIS requirements. University officials accepted the recommendation. INADEQUATE CONTROLS OVER PROPERTY AND EQUIPMENT The University did not fully comply with requirements applicable to its property and equipment. We reviewed the University’s property inventory certification as of November 29, 2017 which was submitted to the Department of Central Management Services (DCMS). The inventory certification to DCMS reported 272 items ($268,788) of equipment that could not be located by the University. These assets were acquired by the University during prior fiscal years. Included in this listing were approximately 272 chairs, sofas, computers, servers, CPUs, or other electronic storage devices. Also, during our equipment observation we noted the following: • One sofa located in Lincoln Hall, was damaged and obsolete. In addition to the one sofa noted, Lincoln Hall currently contains other damaged and obsolete inventory due to mold that has not been completely removed from the building. As reported in Finding 2018?001, an internal memo regarding the future use of Lincoln Hall was issued in August 2013 by University management stating that academic and academic related services would be relocated to other campus facilities beginning with the 2013?2014 academic year because the Lincoln Hall facilities are dated and demand for housing is significantly less than other residential options. During 2018, University management made the decision to discontinue routine maintenance to Lincoln Hall. • One inventory item (monitor flat panel) with a value of $600 on the University’s listing could not be located on campus. (Finding 12, pages 34-35) This finding has been repeated since 2015. We recommended the University continue to strengthen its internal controls over the accountability of University property. University officials accepted the recommendation. (For the previous University response, see Digest Footnote #3.) OTHER FINDINGS The remaining findings are reportedly being given attention by the University. We will review the University’s progress towards the implementation of our recommendations in our next Single Audit and State Compliance Examination. AUDITOR’S OPINION The financial audit report was previously released. The auditors stated the financial statements of the University as of and for the year ended June 30, 2018 are fairly stated in all material respects. The auditors also conducted a Single Audit of the Agency as required by the Uniform Guidance. The auditors stated the University complied, in all material respects, with the types of compliance requirements that could have a direct and material effect on the University’s major federal programs for the year ended June 30, 2018. ACCOUNTANT’S OPINION The accountants conducted a compliance examination of the University for the year ended June 30, 2018, as required by the Illinois State Auditing Act. The accountants qualified their report on State Compliance for Findings 2018-001. Except for the noncompliance described in this finding, the accountants stated the University complied, in all material respects, with the requirements described in the report. This Single Audit and State Compliance Examination was conducted by CliftonLarsonAllen LLP. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:TLK DIGEST FOOTNOTES #1 – Inadequate Internal Controls Over Contracts – Previous University Response 2017: The University accepts the Auditors’ recommendation. The University has conducted a comprehensive review of each component of this finding and has taken corrective actions in fiscal year 2018 to address the deficiencies noted. These steps include the following: (1) Revamping internal workflow process to initiate correspondence and provide a copy of the certifications to all vendors for completion based on incoming requisitions; (2) Adopt an all-inclusive (combined State and NIU) certification form to be used in the University’s request for proposal and invitation to bid process to ensure adherence to all other certifications; (3) Continue to educate campus departments through direct communications, training, reminders, and Procurement Services’ website, to mitigate performance prior to purchase order; and (4) Revamp the process for filing contract obligation documents with the State of Illinois to ensure all purchases exceeding $20,000 are filed timely. #2 – Failure to Submit Proper Time Reporting – Previous University Response 2017: The University accepts the Auditors’ recommendation. The University has a system in place that can capture time worked and benefit usage. However, there are ongoing efforts to explore alternative strategies to capture time worked by unionized faculty and graduate assistants. #3 – Inadequate Controls Over Property and Equipment – Previous University Response 2017: The University accepts the Auditors’ recommendation. The University has taken corrective measures to strengthen controls over the accountability of assets. To assist in locating missing assets, a Missing Asset Internal Investigation Form has been developed that also captures detail of any sensitive data stored on the device. In addition, Vice-Presidents are notified of missing items to exert a sense of urgency and resources needed to locate missing assets. Also, the University has developed training for responsible officers and revamped its asset transfer process to better track when assets move between departments.