REPORT DIGEST ILLINOIS STATE UNIVERSITY COMPLIANCE EXAMINATION AND SINGLE AUDIT FOR THE YEAR ENDED JUNE 30, 2019 Release Date: February 19, 2020 FINDINGS THIS AUDIT: 13 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 0 -- 1 -- 1 Category 2: 9 -- 3 -- 12 Category 3: 0 -- 0 -- 0 TOTAL: 9 -- 4 -- 13 FINDINGS LAST AUDIT: 9 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION This digest covers the University’s compliance examination (including the Single Audit) for the year ended June 30, 2019. A separate digest covers the University’s financial audit as of and for the year ended June 30, 2019. In total, this report includes 13 findings, one of which was reported in the financial audit. SYNOPSIS • (19-04) The University lacked control over its property and equipment records. • (19-07) The University did not consistently ensure its employees completed statutory training requirements. • (19-08) The University did not always ensure compliance with the University Faculty Research and Consulting Act and University policies regarding outside employment. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS INADEQUATE CONTROL OVER PROPERTY AND EQUIPMENT The Illinois State University (University) lacked control over its property and equipment records used for State compliance reporting. During testing, we noted the University’s property records and systems had certain internal control problems that hindered our ability to conclude the University’s property records used for State compliance reporting were sufficiently complete and accurate. We noted the following: • During testing of 40 deleted equipment items, we noted two items (5%), an uninterruptable power supply with an original cost of $19,356 and a sound and video system with an original cost of $22,187, had the date of the asset’s deletion changed within the University’s records from May 2013 and April 2017, respectively, to October 2018. In following up on this exception with University officials, they determined: – the University’s system retaining its property records was improperly designed to allow its property control personnel to overwrite entries; – the University was using an improper date for when an asset is disposed of by the University, as property control personnel were recording the date they “deleted” an asset from the University’s records as the date when the item was placed onto a wooden pallet and shrink-wrapped for transfer to the Department of Central Management Services (CMS), but not when CMS actually took physical custody of the asset; and, – the University had several pallets of items that had been shrink-wrapped over the past several years that had not been picked up by CMS; these items should have remained an asset of the University until picked up by CMS. The University performed an analysis of the 93 capital assets, with an original cost of $1,366,404 and associated accumulated depreciation of $1,364,017 at June 30, 2019, on these pallets and determined the beginning net position, capital assets, accumulated depreciation, and depreciation expense accounts were not materially misstated within the University’s Fiscal Year 2019 financial statements. • We were unable to agree the University’s deletions reports to its quarterly Agency Report of State Property (Form C-15s) filed with the Office of the State Comptroller during Fiscal Year 2019. We noted an unreconcilable difference of $101,142. In following up on this exception with University officials, they determined the deletions data provided to us was determined by a date defined system query which does not represent actual disposals or journal entry postings to record a deleted item. Due to these conditions, we were unable to conclude whether the University’s population records used for State compliance reporting were sufficiently precise and detailed under the Attestation Standards promulgated by the American Institute of Certified Public Accountants to test the University’s equipment. While the population limitations noted above which hindered our ability to conclude whether selected samples were representative of the population as a whole, we performed additional testing and noted the following: • The University’s Form C-15 for the fourth quarter of Fiscal Year 2019 understated the beginning balance of total assets by $3,516,892. • During testing of 80 equipment items across the University, we noted the following: – One item (1%), a goniometer totaling $119,900, was unable to be located and the University did not have any records to support the item had been disposed of by the University. – One item (1%), a computer totaling $763, was obsolete and had not been identified as transferable equipment. – Four items (5%) were not properly tagged. We noted two items – a $6,650 harpsicord and a $3,300 drawing – without a tag and two items – a $19,045 truck and a $7,000 photograph – where the tag did not match the University’s records. (Finding 4, pages 22-24) We recommended the University implement corrective action to ensure data changes within its property records cannot be performed without adequate review and approval, assets are recorded as transferred on the date an item is physically delivered to the custody of CMS, and work with CMS to either transfer the accumulated backlog of shrink-wrapped pallets or dispose of the items. Further, we recommended the University implement controls to ensure deleted items are promptly entered in the University’s accounting and property records and the quarterly Form C-15 reports agree with these entries. In addition, we recommended the University conduct an inventory to identify and tag equipment items with a net asset value of $1,000 or more in service at the University and conduct a diligent search for the missing goniometer to determine if it was lost or stolen and report the matter to the appropriate authorities. University officials agreed with our recommendation. INADEQUATE CONTROL OVER TRAINING The University did not consistently ensure its employees completed statutory training requirements. During testing of 40 employees, we noted the following: • Six of 15 (40%) new employees tested lacked evidence to support the employee had completed training on their responsibilities under the Abused and Neglected Child Reporting Act (ANCRA) and had signed a statement acknowledging their knowledge and understanding of ANCRA prior to the employee commencing employment at the University. • Three of three (100%) employees with access to social security numbers (SSNs) in the course of their employment did not have training on how to protect SSNs. • Seven of 15 (47%) new employees did not timely complete their initial ethics and sexual harassment prevention trainings. Five of these employees did not complete their training until the next annual training window for all of the University’s employees and two of these employees completed their initial training six and seven days late. (Finding 7, pages 29-30) We recommended the University ensure its new employees timely complete training requirements in accordance with ANCRA, the Identity Protection Act, and the State Officials and Employees Ethics Act. University officials agreed with our recommendation. NONCOMPLIANCE WITH THE UNIVERSITY FACULTY RESEARCH AND CONSULTING ACT The University did not always ensure compliance with the University Faculty Research and Consulting Act and University policies regarding outside employment. During Fiscal Year 2019, faculty members reported 124 instances of outside employment to the University Provost. During testing, we noted the following: • 33 of 124 (27%) instances had the Request for Approval of Secondary/Outside Employment (Form PERS 927) submitted by the faculty member for approval by the University’s Provost between one to 219 days late. • 60 of 124 (48%) instances had Form PERS 927 approved by the University’s Provost between one to 223 days late. • 55 of 117 (47%) instances did not have the Annual Report of Secondary/Outside Employment (Form PERS 928) submitted by the faculty member by the deadline of August 31, 2019. The total number of cases was reduced to reflect seven employees who resigned or retired prior to the due date of the Form PERS 928. • 23 of 117 (20%) instances had the Form PERS 928 submitted by the faculty member to the Provost during September 2019, which reduced the amount of time available for review and approval by the faculty member’s department chair and dean prior to receiving final approval from the Provost by September 30, 2019. The total number of cases was reduced to reflect seven employees who resigned or retired prior to the due date of the Form PERS 928. (Finding 8, pages 31-32) This finding has been repeated since 2012. We recommended the University Provost implement internal controls to ensure faculty members with outside research, consulting services, or employment receive written pre-approval to conduct the requested activity and annually disclose the time spent on these activities in accordance with State law and University policy. University officials stated they continue to assess the faculty research and consulting approval process, noting modifications are being made to ensure more timely approvals and annual disclosures of outside research, consulting, and employment activities. OTHER FINDINGS The remaining findings pertain to (1) noncompliance with federal regulations for nursing student loan repayments and risk assessments; (2) weaknesses with the security and control of confidential information and inadequate business continuity and disaster recovery planning; (3) failure to conduct performance evaluations; (4) an untimely report submission; (5) inadequate control over automobile certifications; and, (6) noncompliance with civil service and time reporting requirements. We will review the University’s progress towards the implementation of our recommendations in our next financial audit, Single Audit, and compliance examination. AUDITOR’S OPINION The auditors also conducted a Single Audit of the University as required by the Uniform Guidance. The auditors stated the University complied, in all material respects, with the types of compliance requirements that could have a direct and material effect on the University’s major federal programs for the year ended June 30, 2019. ACCOUNTANT’S OPINION The accountants conducted a compliance examination of the University for the year ended June 30, 2019, as required by the Illinois State Auditing Act. The accountants qualified their report on State compliance for Finding 2019-004. Except for the noncompliance described in this finding, the accountants stated the University complied, in all material respects, with the requirements described in the report. This Single Audit and compliance examination was conducted by RSM US LLP. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:djn