REPORT DIGEST GOVERNORS STATE UNIVERSITY SINGLE AUDIT, AND COMPLIANCE EXAMINATION FOR THE YEAR ENDED JUNE 30, 2016 Release Date: March 29, 2017 FINDINGS THIS AUDIT: 20 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 1 -- 0 -- 1 Category 2: 14 -- 5 -- 19 Category 3: 0 -- 0 -- 0 TOTAL: 15 -- 5 -- 20 FINDINGS LAST AUDIT: 7 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION This Digest covers our federal Single Audit and Compliance Examination of the Governors State University (University) for the year ended June 30, 2016. A separate Financial Audit as of and for the year ended June 30, 2016 was previously released on January 12, 2017. In total, this report contains 20 findings, two of which were reported in the financial audit. SYNOPSIS • (16-03) The University’s student verification procedures did not function as designed. • (16-04) The University awarded financial aid to ineligible students. • (16-10) The University had inadequate controls over property and equipment. • (16-14) The University did not comply with the Illinois State Collection Act of 1986. • (16-15) The University needs to improve controls over verification of information included on a job applicant’s resume or application prior to hiring. • (16-16) The University did not comply with the Fiscal Control and Internal Auditing Act. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS ERRORS IN THE VERIFICATION AND UPDATING OF STUDENT AID APPLICATIONS The University’s student verification procedures did not function as designed. For four of 25 student verification tested, the University did not accurately update verification data with the Central Processor. We noted the following: • For one student, the information sent to the Central Processor by the University over reported total income tax paid by $873. This error resulted in the student receiving $50 of Pell during the Fall 2015 semester and $25 of Pell in the Spring 2016 semester for which the student was not eligible. The University subsequently adjusted the student's account to correct the over award. • For one student, the information sent to the Central Processor by the University did not report untaxed pension of $3,421. This error resulted in the student receiving $150 of Pell during the Fall 2015 semester and $37 of Pell in the Spring 2016 semester, for which the student was not eligible. The University subsequently adjusted the student's account to correct the over award. • For two students, the information submitted by the University to the Central Processor did not match provided dependent verification forms as the University removed a second family member from being reported as enrolled in college because the sibling was age 25 or older. This change resulted in both students not receiving the full Pell award for which they were eligible. One student would have been eligible for a Pell award of $4,925 as opposed to the $2,263 actually received. The other student would have been eligible for a $1,525 Pell award as opposed to the $0 actually received. (Finding 3, pages 22-23). This finding has been repeated since 2013. We recommended the University improve its procedures to ensure students that have been selected for verification are accurately verified in accordance with ED regulations. University officials agreed with the finding and stated they have changed its verification process to minimize the possibility of errors. (For the previous University response, see Digest Footnote #1.) FINANCIAL AID AWARDED TO INELIGIBLE STUDENTS The University made Federal Supplemental Educational Opportunity Grant (FSEOG) awards to students who were no longer eligible for such awards. We noted ten (25%) of 40 students tested were awarded and disbursed FSEOG awards after the student had withdrawn from the University. These 10 students became ineligible for new awards on the date of their withdrawal. (Finding 4, pages 24-25). We recommended the University improve its controls to ensure that each student meets the eligibility requirements prior to awarding aid. University officials agreed with the finding and stated this was a unique occurrence and procedures have been updated to ensure it does not reoccur. INADEQUATE CONTROLS OVER PROPERTY AND EQUIPMENT The University did not fully comply with the requirements applicable to its property and equipment. We examined the University's property inventory certification as of June 30, 2016 that was submitted to the Department of Central Management Services (DCMS) and noted that the University reported 476 items ($618,999) of equipment that could not be located by the University. These assets were acquired by the University in various fiscal years up to and including fiscal year 2016. Included in the equipment that was reported as "unlocated" were numerous computers, servers, CPU's and other storage devices. The University did not immediately perform a complete assessment of the missing computers, CPU's and storage devices to determine if notifications were required as outlined in the Personal Information Protection Act (815 ILCS 530/25). Subsequent to the inventory certification, the University located 120 of these items totaling $168,863. We also noted the University owns 86 cellular phones that are assigned to and used by University employees. The phones were not assigned a tag number by the University and were not recorded on the University's property control records or reported in the University's property inventory certification to DCMS. These cellular devices would be considered items subject to theft and should have been reported to DCMS. During our review of employees who left the University it was noted that one employee had six items personally assigned (2 cellular phones (with an original cost of $1,050), USB modem (received free with 2 year contract), air cards that were installed on a laptop and I-pad mini (original cost of laptop and I-pad mini with air cards, $1,943) and a hotspot (received free with 2 year contract)). The employee's last date on the payroll was June 30, 2016. None of these items were returned to the University. We noted one (10%) disposal item (snowplow) with an original cost of $5,235, was destroyed on September 11, 2015 and removed from the University's property control listing but was still included on the June 30, 2016 property listing that was submitted to DCMS. We tested 10 equipment additions made during the year and noted the following: • Two (20%) items (digital camera and locker, valued at $3,527), were added to the University's property control listing but were not added to the June 30, 2016 property listing that was submitted to DCMS. • Two (20%) items (truck and treadmill) did not include the delivery and installation costs (totaling $385) in the purchase price of the equipment. Our physical inventory testing of 60 items on the property control records (that were included on the property listing submitted to DCMS) identified three items (5%) with a total value of $7,744 that could not be found. These items consisted of a desktop computer, a laptop computer and a LCD monitor. After further investigation, it was determined that the desktop computer was transferred to DCMS as surplus inventory on June 27, 2016; however, it was not taken off of the property control listing or the property listing submitted to DCMS. The other 2 items were on the missing property list noted above. (Finding 10, pages 36-38) We recommended the University strengthen its internal controls over the accountability of University equipment. We also recommended the University adhere to the requirements regarding property and equipment to ensure that property and equipment records are properly maintained and that a complete and accurate inventory is submitted to DCMS. Further, we recommended the University perform timely assessments regarding missing computer equipment for notification requirements under the Personal Information Protection Act. Finally, we recommended the University obtain missing equipment or reimbursement from separated employees. University officials agreed with the finding and stated they will continue to improve its property control process and reporting requirements. NONCOMPLIANCE WITH THE ILLINOIS STATE COLLECTION ACT OF 1986 The University did not comply with the requirements of the Illinois State Collection Act of 1986 (Act). As of December 31, 2015, the University's accounts receivable aging report had 2,464 accounts totaling $6,812,026 with receivable balances greater than $1,000 and were in excess of 90 days past due. We tested a sample of 30 such accounts and determined that 20 of those accounts, totaling $90,507, had not been submitted by the University for placement with the Comptroller's Offset System. (Finding 14, page 44) We recommended the University improve its procedures to ensure all debts owed to the University are placed in the Comptroller's Offset System once they exceed $1,000 and are 90 days past due. University officials agreed with the finding and stated current collection practices are in place which include turning accounts over to the Comptroller’s Offset System. INADEQUATE CONTROLS OVER VERIFICATION OF JOB APPLICANT’S INFORMATION The University did not have adequate controls over verification of information included on a job applicant's resume or application prior to hiring for a specific position. During our testing of the University's compliance with its policy and procedures for verification of information on a job applicant's resume, we noted no reference check documentation was on file for all ten personnel reviewed. (Finding 15, page 45) This finding has been repeated since 2014. We recommended the University improve its processes to ensure compliance with University policy and procedures. University officials agreed with the finding and stated the University will continue to work towards compliance. (For the previous University response, see Digest Footnote #2.) NONCOMPLIANCE WITH THE FISCAL CONTROL AND INTERNAL AUDITING ACT The University did not comply with the Fiscal Control and Internal Auditing Act (FCIAA). The University did not perform a timely evaluation of its internal fiscal and administrative controls or submit its FCIAA certification to the Office of the Auditor General by the May 1 due date. The certification was filed 54 days late. In addition, the University implemented an upgrade to their current information system which handles all of the University's major operations during fiscal year 2016. This system upgrade constitutes a major change. The Internal Auditor did not perform the required review of the system. (Finding 16, pages 46-47) We recommended the University perform timely evaluations of its systems of internal fiscal and administrative controls and timely file annual certifications regarding the evaluation with the Office of the Auditor General as required by the FCIAA. We further recommended the University comply with the Act by performing reviews of new or major modifications to EDP systems prior to installation. University officials agreed with the finding and stated the University will comply with the FCIAA requirements going forward. OTHER FINDINGS The remaining findings are reportedly being given attention by the University. We will review the University’s progress towards the implementation of our recommendations in our next engagement. AUDITOR’S OPINION The financial report was previously released. The auditors stated the financial statements of the University as of and for the year ended June 30, 2016 are fairly stated in all material respects. The auditors also conducted a Single Audit of the University as required by the Uniform Guidance. The auditors stated the University complied, in all material respects, with the types of compliance requirements that could have a direct and material effect on the University’s major federal programs for the year ended June 30, 2016. ACCOUNTANT’S OPINION The auditors conducted a compliance examination of the University for the year ended June 30, 2016, as required by the Illinois State Auditing Act. The auditors stated the University complied, in all material respects, with the requirements described in the report. This engagement was conducted by Borschnack, Pelletier & Co. BRUCE L. BULLARD Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:JGR DIGEST FOOTNOTES #1 - ERRORS IN THE VERIFICATION AND UPDATING OF STUDENT AID APPLICATIONS 2015: The University agrees with this finding and accepts the recommendation. An extensive review of the verification process has been performed and changes have been made to further minimize the possibility of any human error. While the human error aspect cannot be completely eliminated, the University’s processes are in accordance with federal regulations and funds are awarded in a manner consistent with U.S. Department of Education best practices. #2 - INADEQUATE CONTROLS OVER VERIFICATION OF JOB APPLICANT’S INFORMATION 2015: The University agrees with this finding and accepts the recommendation. The University has implemented procedures to ensure that all required documentation is forwarded to the Human Resources Department as a part of the hiring process.