REPORT DIGEST SOUTHERN ILLINOIS UNIVERSITY SINGLE AUDIT AND STATE COMPLIANCE EXAMINATION FOR THE YEAR ENDED JUNE 30, 2016 Release Date: March 23, 2017 FINDINGS THIS AUDIT: 12 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 0 -- 0 -- 0 Category 2: 4 -- 8 -- 12 Category 3: 0 -- 0 -- 0 TOTAL: 4 -- 8 -- 12 FINDINGS LAST AUDIT: 11 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION This digest covers our federal Single Audit and Compliance Examination of Southern Illinois University (University) for the year ended June 30, 2016. A separate Financial Audit as of and for the year ending June 30, 2016, was previously released on January 19, 2017. In total, this report contains 12 findings, none of which were reported in the Financial Audit. SYNOPSIS • (16-2) The University did not have adequate procedures to ensure the Schedule of Expenditure of Federal Awards (SEFA) contained accurate information. • (16-4) The University lacked proper review procedures to document and report participant eligibility in the TRIO Upward Bound, Student Support Services and McNair programs. • (16-6) The Edwardsville campus did not complete all required monitoring of subrecipients. • (16-7) The Carbondale campus did not accurately complete return of title IV calculations for students. • (16-11) The University did not manage the National Corn-to-Ethanol Research Pilot Plant under the review and guidance of the Illinois Ethanol Research Advisory Board. • (16-12) The University’s annual inventory failed to locate 103 computer equipment items with an original acquisition value of $103,894. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS UNTIMELY AWARD CLOSE-OUT AND IMPROPER REVIEW OF PROCEDURES OVER THE SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS The University did not have adequate procedures in place to ensure the Schedule of Expenditures of Federal Awards (SEFA) contained the proper information. On each campus, federal award accounts were not completely closed out in a timely manner, causing extraneous entries on the SEFA during subsequent years. During our review of the Carbondale and Edwardsville campus SEFAs for fiscal year 2016, we noted expenditures reported for 86 and 18 federal awards, respectively, that were past the award end date and the 90 day close-out timeframe. We also noted subrecipient expenditure amounts for two grants on the Edwardsville campus SEFA did not agree to the expenditure detail for the fiscal year. (Finding 2, pages 18-21) We recommended the University review policies and procedures regarding SEFA close-out and implement additional procedures to monitor the timeliness of account close-outs and reporting of subrecipient grant expenditures. University officials accepted our recommendation and stated they have started conversations concerning potential solutions in order to ensure accuracy of the SEFA going forward. INADEQUATE PROCEDURES FOR DOCUMENTING AND REPORTING PARTICIPANT ELIGIBILITY The University did not have proper review procedures in place to document and report participant eligibility in the TRIO Upward Bound, Student Support Services and McNair programs. During our testing of 60 TRIO participant eligibility files, we noted 5 (8%) contained inadequate documentation or inconsistent reporting information. • In three cases, the eligibility determination in the participant file was inconsistent with the information reported on the Annual Performance Report. • In two cases, insufficient financial documentation was maintained to determine eligibility. (Finding 4, pages 24-26) We recommended the University implement the necessary controls to fully and accurately document and report participant eligibility and properly enter the eligibility information into the reporting system. University officials responded they have implemented our recommendation. Officials stated staff have taken necessary measures to fully and accurately document participant eligibility and properly enter eligibility information into the reporting system. INADEQUATE SUBRECIPIENT MONITORING The Edwardsville campus did not have proper procedures in place to ensure that all subrecipient monitoring activities were completed adequately. For 3 (21%) of 14 subrecipients tested, the University did not complete all the monitoring procedures as required by the University’s policies and procedures. (Finding 6, pages 29-30) We recommended the University designate back-up staff to conduct review procedures in the absence of responsible staff to ensure the subrecipient monitoring is completed in accordance with federal regulations in a timely manner. University officials stated they have implemented our recommendation, including development of new processes to ensure annual performance of required monitoring and training of key individuals should future vacancies occur. RETURN OF TITLE IV ERRORS The Carbondale campus did not accurately complete return of title IV calculations for 8 (13%) of the 60 students tested. Staff used the wrong withdrawal date for return of title IV calculations, did not provide support for withdrawal dates on administrative withdrawals, and did not return funds within the required timeframe. We noted: • For two students, the wrong withdrawal date was used, resulting in an error in the calculation of $4,973 which should have been returned to the Department of Education. • For one student, the withdrawal was not reported to the financial aid department, resulting in an error of $1,343 which should have been returned to the Department of Education. • The University retroactively withdrew five students on the last possible withdrawal date, rather than the incident date. As a result, the University did not maintain incident dates for these five students, so we were unable to determine if any aid should have been returned. (Finding 7, pages 31-32) We recommended the University establish a more thorough review to ensure human errors are caught before refunds are processed. We also recommended the Registrar’s office use the most accurate date of withdrawal based on the given circumstances to ensure accurate refunds are calculated University officials agreed with our recommendation and responded a more thorough review process has been developed and the Registrar’s Office began using the last date of attendance for withdrawal requests. NONCOMPLIANCE WITH THE SOUTHERN ILLINOIS UNIVERSITY MANAGEMENT ACT (ILLINOIS ETHANOL RESEARCH ADVISORY BOARD) Southern Illinois University (SIU) did not manage the National Corn-to-Ethanol Research Pilot Plant (Pilot Plant) under the review and guidance of the Illinois Ethanol Research Advisory Board (Advisory Board). The Advisory Board had not met since 2012 due to lack of a quorum. As a result, the Advisory Board had not performed its duties of providing review and guidance to the SIU Board of Trustees to assist in operating and managing the Pilot Plant as required by State statute. However, SIU Edwardsville had continued to manage the Pilot Plant under the guidance of a stakeholders group. Six of the thirteen Board members are appointed by the Governor and have expired terms. The Advisory Board is required to meet annually and have the following duties: • Review of annual operating plans and budget of the National Corn-to-Ethanol Research Pilot Plant, • Advising on research and development priorities and projects to be carried out at the Pilot Plant, • Advising on policies and procedures regarding the management and operation of the Pilot Plant, • Developing bylaws, • Submitting a final report to the Governor and General Assembly outlining the progress and accomplishments made during the year along with a financial report for the year, and • Establishing and operating the Pilot Plant with purposes and goals including conducting research, providing training, consulting, developing demonstration projects and serving as an independent resource to the ethanol industry. (Finding 11, pages 39-41) We recommended University officials continue to work with the seven existing Advisory Board members to schedule an annual meeting that all seven members can attend, thereby achieving a quorum, so the board can perform its duties under the Act. We further recommended the University continue to work with the Governor’s Office of Executive Appointments to fill the vacancies on the Advisory Board. University officials accepted our recommendation and indicated they would continue to work with the Governor’s Office of Executive Appointments to fill the vacancies in the Advisory Board. If those measures fail, they will attempt to obtain a quorum from statutory members of the Board. WEAKNESSES IN COMPUTER INVENTORY CONTROL The University was unable to locate 103 computer equipment items (90 from Carbondale and 13 from Edwardsville) during their annual inventory, although inventory controls have been enhanced to better locate and adequately dispose of older computer items. The original cost of these items totaled $103,894. The computers noted as missing represent 0.23% percent of the University’s total computer related inventory at June 30, 2016. Although the University had established procedures for requiring encryption on computers that could have confidential information on them, the University could not determine if the missing computer items were encrypted. However, officials were confident the missing items did not contain confidential information. Since the University was not able to identify whether the missing items contained confidential information or were encrypted, the auditors could not determine if the items had confidential information exposed. (Finding 12, pages 42-43) This finding was first reported in 2012. We recommended the University: • Continue to review current practices to determine if enhancements can be implemented to prevent the theft or loss of computers. • Continue to evaluate and secure new computers as necessary to ensure that confidential information is protected. • Perform and document an evaluation of data maintained on computers and ensure those containing confidential information are adequately tracked and protected with methods such as encryption. University officials accepted our recommendation and indicated they would continue its efforts to improve inventory practices and evaluate and secure networked computers, as necessary. Officials also stated they will explore ways to better document assessment practices in order to track computer equipment containing confidential information and demonstrate they are protected. (For previous University response, see Digest Footnote #1.) OTHER FINDINGS The remaining findings are reportedly being given attention by the University. We will review the Agency’s progress towards the implementation of our recommendations in our next engagement. AUDITOR’S OPINION The financial audit report was previously released. The auditors stated the financial statements of Southern Illinois University as of June 30, 2016, and for the year ended, are fairly stated in all material respects. The auditors also conducted a Single Audit of the University as required by the Uniform Guidance. The auditors stated the University complied, in all material respects, with the types of compliance requirements that could have a direct and material effect on the Agency’s major federal programs for the year ended June 30, 2016. ACCOUNTANT’S OPINION The accountants conducted a compliance examination of Southern Illinois University for the year ended June 30, 2016, as required by the Illinois State Auditing Act. The accountants stated the University complied, in all material respects, with the requirements described in the report. This Single Audit and State compliance examination were conducted by the firm of CliftonLarsonAllen LLP. BRUCE L. BULLARD Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:lkw DIGEST FOOTNOTES #1 – Implemented. In early fiscal year 2015, SIU began the process of inventorying all computer equipment (computers, servers, tablets, and mobile hard drives), with a sweep of approximately 226 buildings in Carbondale, Edwardsville, Alton and East St. Louis. The computer inventory project ended on January 30th at SIUC and June 30th at SIUE. As inventories were completed they were compared to the computer inventory records to identify differences, and items that were not located were removed from the records. As a result of this project, SIUC removed 579 computer items from its inventory, and SIUE removed 489 computer items from its inventory. These items have an average age of over 9 years; and therefore most are well beyond their useful life. The expected completion date of the corrective action on the inventory project of June 30, 2015 was met. While this resulted in a substantially higher number of times that were unlocated and consequently removed from inventory this year, the end result is expected to be a more accurate inventory of computer items for each campus as we move forward. Additionally, encryption efforts are, and will continue to be, on-going on each campus, as this is a process that will never be complete but rather always active. SIUE has encrypted all laptops and also all desktops with sensitive or personally identifiable information on the university domain. SIUC has encrypted over 760 laptops/desktops in areas across campus know to handle sensitive or personally identifiable information by job function. Examples would include Information Technology, Bursar’s Office, Financial Aid Office, Registrar’s Office, Graduate School, Human Resources, Payroll, General Accounting, Budget Office, etc. This approach gives us assurance that in the future, missing computers will pose a lesser risk of exposing confidential information.