Eastern Illinois University 2002 Audit

REPORT DIGEST

EASTERN ILLINOIS UNIVERSITY
FINANCIAL AND COMPLIANCE AUDIT

(In Accordance with the Single Audit Act and OMB Circular A-133)

For the Year Ended:
June 30, 2002

Summary of Findings:

Total this audit 7
Total last audit 4
Repeated from last audit 2

Release Date:
April 16, 2003

State of Illinois
Office of the Auditor General
WILLIAM G. HOLLAND
AUDITOR GENERAL

To obtain a copy of the Report contact:
Office of the Auditor General
Attn: Records Manager
Iles Park Plaza
740 E. Ash Street
Springfield, IL 62703

(217)782-6046 or TDD (217) 524-4646

This Report Digest is also available on
the worldwide web at
http://www.state.il.us/auditor

SYNOPSIS

The University did not accurately compute the amount of matching funds that it supplied for the Preparing Tomorrow’s Teachers to Use Technology grant.
The University had not established adequate controls over computer networks.
The University had not developed adequate internal controls to monitor the transactions that can be initiated through the Billing/Receivables System 434 Refunds screen.
The University was not following the property control guidelines as established by the Department of Central Management Services.

{Expenditures and Activity Measures are summarized on the reverse page.}

EASTERN ILLINOIS UNIVERSITY
FINANCIAL AND COMPLIANCE AUDIT
For The Year Ended June 30, 2002

STATEMENT OF REVENUES, EXPENSES AND CHANGES IN NET ASSETS	FY 2002*
OPERATING REVENUES Student tuition and fees Auxiliary enterprises (net of scholarship allowances of $1,134,446) Grants and contracts Sales and services of educational activities Other Total Operating Revenues OPERATING EXPENSES Instruction Research Public services Academic support Student services Institutional support Operation of plant Scholarships and fellowships Auxiliary enterprises Depreciation Total Operating Expenses Operating Income (Loss) NONOPERATING REVENUES (EXPENSES) State appropriations Payments on behalf of the University Other nonoperating revenues (expenses), net Total Nonoperating Revenues (Expenses) Income (Loss) Before Capital Contributions Capital appropriations, capital gifts and donated assets INCREASE IN NET ASSETS Net assets, beginning of the year (restated) Net assets, end of the year	$33,258,545 26,721,857 11,539,511 3,769,328 1,783,443 $77,072,684 $57,930,752 825,972 7,380,834 11,545,527 13,693,897 13,509,248 10,648,497 3,834,947 23,187,914 7,749,403 $150,306,991 $(73,234,307) $54,194,231 17,973,289 1,078,150 $73,245,670 $11,363 11,646,076 $11,657,439 $59,401,718 $71,059,157
SELECTED ACCOUNT BALANCES	JUNE 30, 2002
Cash and investments Capital assets, net of accumulated depreciation Revenue bonds, notes payable and capital lease obligations Accrued compensated absences Net assets	$34,007,733 $123,507,934 $65,080,099 $16,205,547 $71,059,157
SUPPLEMENTARY INFORMATION (Unaudited)	FY 2002
Employment Statistics Faculty/administrative Civil service Student employees Total Employees Selected Activity Measures Annual full-time equivalent students Full-time equivalent costs per student	840 863 326 2,029 9,060 $11,572
UNIVERSITY PRESIDENT
During Audit Period: Dr. Carol Surles (to 7/31/01); Mr. Louis V. Hencken (Interim President - from 8/1/01) Currently: Mr. Louis V. Hencken (Interim President)

* Due to the change in accounting principles related to the implementation of GASB Statements No. 34,35,37,38,and 39 comparative information was not presented. Comparative information will be presented in future periods.

Estimated time data was used for federal reporting instead of actual time data causing an overstatement of grant matching funds of $28,588

105 users had passwords that never expired including some with powerful access privileges

The University did not have any controls in place to determine if refund transactions entered into the refunds screen were authorized and valid

34 of 66 firearms were not listed on the University’s main property control inventory records

55 (10%) of the items selected for physical inventory testing could not be located

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

GRANT MATCHING REQUIREMENT

The University did not accurately compute the matching funds that it supplied for the Preparing Tomorrow’s Teachers to Use Technology (PT3) grant (CFDA #84.342A) for the grant period ending May 31, 2002.

Per the grant agreement, a report is required to be sent to the U. S. Department of Education detailing the amount of federal money spent for the year and the amount of matching funds supplied by the University by April 30 for the grant period ending May 31. The University is required by the grant agreement to provide at least an amount equal to 100% of the federal money spent on the grant as matching funds.

When the University prepared the report for the period ended May 31, 2002, it used an estimate of the amount of time that employees would be working on the PT3 prepared in October 2001 instead of detail records of actual time spent on the grant kept by those employees. The estimate was in most cases greater than the actual time spent on the PT3 grant, which caused the report to overstate the matching funds provided by the University by $28,588.

In addition a faculty stipend of $4,000 that was reported as part of the match was not for the same purpose as the grant and, therefore, should not have been used as matching funds.

According to University personnel who prepared the report, the above miscalculations were due to oversight.

We recommended the University prepare the report for the U.S. Department of Education PT3 grant using actual wage amounts known at the time the report is prepared and that it conduct a more thorough review of the report before it is submitted. (Finding 2, pages 28-29)

The University disagreed with our finding because it believed the estimates used had no impact, nor did they result in questioned cost. The University stated that it had fully satisfied its matching requirements. The University agreed that it could refine its procedures for estimating expenditures and has adjusted its match calculation procedures to include more frequent salary reviews and will also review all time and effort reporting for salaries paid directly by the grant.

In our Auditor’s Comment we noted that although the University made its matching requirement using October 2001 estimates, the University did not use actual detail records of time spent on the grant project that it had compiled when preparing its grant reports due April 30, 2002. We encouraged the University to refine its procedures to include actual data of time spent when preparing its grant reports. (Page 29)

INADEQUATE CONTROLS OVER NETWORK SERVER SECURITY

The University had not established adequate controls over some network servers.

The University had over $8.7 million invested in computing hardware and approximately 3,000 users had access to administrative computing resources. They rely on critical applications on the mainframe and some network servers, such as the student records system and student loans system, to conduct business. Although improvements were made compared to the prior year the following weaknesses were noted:

Password controls were not always in place. While the University’s policy establishes password change every 35 days, 105 users had passwords that never expired. Some of these accounts belonged to security administrators and others with powerful access privileges.

Some of the network’s software security features had not been activated.
Per work performed by the University’s internal audit department, it was noted that an Information Technology Section employee’s computer privileges were not revoked in a timely manner.

The principles of good internal controls require reasonable cost-effective procedures be implemented to ensure the integrity and security of information maintained on the University’s computer systems.

According to University personnel they failed to follow the security guidelines established by the University. (Finding 3, pages 30-31)

We recommended the University enforce standard security guidelines to ensure security controls are adequately addressed on the University’s local area networks.

The University accepted our recommendation and indicated that it has corrected the network server security issues.

INADEQUATE CONTROL OVER REFUND SECURITY

Adequate internal controls have not been developed to monitor the transactions that can be initiated through the Billing/Receivables System (BRS) 434 Refunds screen.

BRS is the critical and comprehensive application for keeping accurate records of student financial obligations to the University. In fiscal year 2002, the University billed students $62.9 million for tuition, fees and housing; however the University could not identify the dollar amount of transactions entered through the BRS 434 refunds screen.

The majority of BRS users have access to the systems refunds screen. The University grants access to the refunds screen for all users who have the rights to add charges to student accounts. The refund screen allows users to credit a students’ account for specific charges. The University did not have any controls or procedures in place to determine if refund transactions entered into the refunds screen were authorized and valid.

According to University personnel the condition exists due to an oversight in developing controls for the BRS system. (Finding 6, page 36)

We recommended the University limit access to the BRS 434 screen to a few employees designated to enter refund transactions. The University should also develop an approval or documentation process to review the BRS 434 screen transactions.

The University concurred with our recommendation and indicated that it now limits access to BRS screen 434 to the extent possible and that a report of transactions will be provided weekly for periodic review.

PROPERTY CONTROL

The University is not following the property control guidelines as established by the Department of Central Management Services (CMS).

During the audit we noted the following exceptions related to property control:

34 of 66 firearms were not listed on the University’s main property control inventory records as required by Illinois Administrative Code. A separate inventory list was maintained but some of these items were not on the University's main inventory list.
The University’s internal audit department noted that 243 property items with an original cost basis of $225,927 were disposed of by the University before obtaining approval from CMS and these items were not deleted from the property control records.
The University’s internal audit department noted that 22 of 103 (21%) of the inventory certification reports were not returned as of the CMS due date.
The University’s internal audit department noted that 55 out of 534 property items (10.3%) with an original cost basis of $59,657 selected for physical existence verification testing could not be located.
New carrels valued at $162,868 purchased for the library had not been tagged.

According to University personnel, the above exceptions occurred due to oversight and the division of property control responsibilities between two separate University departments. (Finding 7, pages 37-38)

We recommended the University establish written internal procedures for property control and that it follow property control rules established by CMS.

The University accepted our recommendation and indicated that internal procedures and University policy was in the process of being revised.

OTHER FINDINGS

The remaining findings are less significant and are reportedly being given attention by the University. We will review progress toward implementing these recommendations in our next audit.

Mr. Jeffrey L. Cooley, Vice President for Business Affairs, provided responses to the findings and recommendations.

AUDITORS' OPINION

Our auditors state the Eastern Illinois University's financial statements as of and for the year ended June 30, 2002 are fairly presented in all material respects.

____________________________________

WILLIAM G. HOLLAND, Auditor General

WGH:JAF:pp

SPECIAL ASSISTANT AUDITORS

Doehring, Winders & Co. LLP were our special assistant auditors on this engagement.