REPORT DIGEST NORTHERN ILLINOIS UNIVERSITY COMPLIANCE EXAMINATION AND SINGLE AUDIT FOR THE YEAR ENDED JUNE 30, 2019 Release Date: April 8, 2020 FINDINGS THIS AUDIT: 12 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 0 -- 0 -- 0 Category 2: 3 -- 9 -- 12 Category 3: 0 -- 0 -- 0 TOTAL: 3 -- 9 -- 12 FINDINGS LAST AUDIT: 13 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION This digest covers our federal Single Audit and Compliance Examination of Northern Illinois University for the year ended June 30, 2019. A separate Financial Audit as of and for the year ended June 30, 2019, was previously released on February 11, 2020. In total, this report contains 12 findings, none of which were reported in the Financial Audit. SYNOPSIS • (19-3) The University has not established adequate internal controls over contracts to ensure they are approved prior to performance and comply with all applicable State requirements. • (19-5) The University did not have adequate controls in place to ensure that required criminal background investigations were conducted prior to employment for those employees hired for security sensitive positions. • (19-7) The University has not established adequate controls over the completion of I-9 forms for employees hired by the University. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS INADEQUATE INTERNAL CONTROLS OVER CONTRACTS The University has not established adequate internal controls over contracts to ensure they are approved prior to performance and comply with all applicable state requirements. During our review of a sample of 40 contracts for the year ended June 30, 2019, some of the items we noted are as follows: • 9 contracts (23%) totaling $318,561 were not approved prior to goods or services being provided. The contracts were executed between 5 to 146 days after the commencement of services or the receipt of the goods. • 3 contracts (8%) totaling $113,444 contained contract obligation documents that were not filed within 30 days of execution of the contract. The contract obligation documents were filed between 10 to 60 days late. • 3 contracts (8%) totaling $904,512 did not have a contract obligation document filed with the Illinois State Comptroller’s Office. Each contract contained an order for delivery that exceeded $20,000. The contract obligation documents were not filed as of June 30, 2019. • 2 contracts (5%) totaling $176,699 did not contain the Financial/Conflict of Interest Disclosure prior to the approval of the contract. In these two instances, disclosures were not obtained as of June 30, 2019. • 2 of 13 grant contracts tested, totaling $6,007, were not posted to the Procurement Bulletin within 14 calendar days after the execution of the contract. (Finding 3, pages 17-19). This finding has been repeated since 2012. We recommended the University establish and maintain internal control procedures to ensure contracts are complete and properly approved prior to performance. We also recommended the University adhere to State laws, regulations, and University policies and procedures. University officials accepted the recommendation. NONCOMPLIANCE WITH CAMPUS SECURITY ENHANCEMENT ACT OF 2008 The University did not have adequate controls in place to ensure that required criminal background investigations were conducted prior to employment for those employees hired for security sensitive positions. The Campus Security Enhancement Act of 2008 (Act) requires that each public institution of higher education shall, through written policy and procedures, identify security- sensitive positions and make provision for the completion of criminal background investigations prior to employing individuals in those positions. During our testing over the hiring of a sample of 25 employees in security sensitive positions, we noted four employees were hired prior to the completion of the criminal background investigation. These background investigations were performed between 1 to 7 days after the employee was hired. (Finding 5, page 21) We recommended the University comply with the requirements of the Act and existing University policies and procedures. University officials accepted the recommendation. INADEQUATE CONTROLS OVER I-9 FORMS The University has not established adequate controls over the completion of I-9 forms for employees hired by the University. During our review of a sample of forty (40) employee hires, we noted the following: • One employee (3%) dated and completed the I-9 form prior to accepting the written job offer. • Three employees (8%) did not complete Section 1 of the I-9 form on or before their respective hire date. • Three employees (8%) did not have their respective hire date documented on Section 2 of the I-9 form. • Two employees (5%) failed to date their completion of Section 1 of the I-9 form. • One employee (3%) did not have their verification of employee eligibility performed timely by the University. • One employee‘s I-9 form (3%) failed to document the date of the University’s verification of the employee’s eligibility. U.S. Citizenship and Immigration Services (USCIS) instructions for Form I?9 require Section 1 be completed no later than the first day of employment. After completing Section 1, the employee is to sign their name and document the date signed. Employers are to examine evidence of identity and employment authorization within 3 business days of the employee’s first day of employment. The employer is to document the hire date and their signature and date of their review in Section 2 of the I?9 form. (Finding 7, page 23) We recommended the University enhance their controls over the process for preparing and reviewing the I-9 Forms to ensure compliance with USCIS requirements. University officials accepted the recommendation. OTHER FINDINGS The remaining findings are reportedly being given attention by the University. We will review the University’s progress towards the implementation of our recommendations in our next Single Audit and State Compliance Examination. AUDITOR’S OPINION The financial audit report was previously released. The auditors stated the financial statements of the University as of and for the year ended June 30, 2019 are fairly stated in all material respects. The auditors also conducted a Single Audit of the University as required by the Uniform Guidance. The auditors stated the University complied, in all material respects, with the types of compliance requirements that could have a direct and material effect on the University’s major federal programs for the year ended June 30, 2019. ACCOUNTANT’S OPINION The accountants conducted a compliance examination of the University for the year ended June 30, 2018, as required by the Illinois State Auditing Act. The accountants stated the University complied, in all material respects, with the requirements described in the report. This Single Audit and State Compliance Examination was conducted by CliftonLarsonAllen LLP. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:TLK