REPORT DIGEST

 

SOUTHERN ILLINOIS UNIVERSITY

 

FINANCIAL AND COMPLIANCE AUDIT

(In accordance with the Single Audit Act and OMB Circular A-133)

For the Year Ended:

June 30, 2003

 

Summary of Findings:

 

Total this audit                       3

Total last audit                       4

Repeated from last audit        2

 

Release Date:

March 24, 2004

 

 

 

 

State of Illinois

Office of the Auditor General

WILLIAM G. HOLLAND

AUDITOR GENERAL

 

To obtain a copy of the Report contact:

Office of the Auditor General

Iles Park Plaza

740 E. Ash Street

Springfield, IL 62703

(217) 782-6046 or TDD (217) 524-4646

 

This Report Digest is also available on

the worldwide web at

http://www.state.il.us/auditor

 

 

SYNOPSIS

 

  • The University had some computer security weaknesses.
  • The University did not ensure that all of its campuses were adequately suited to recover from disasters affecting its computer operations.
  • The University’s Graduate Student 601 Continuing Education requirement did not comply with the Board of Trustees’ policies.

 

 

 

 

 

 

 

 

 

 

 

{Expenditures and Activity Measures are summarized on the reverse page.}

  SOUTHERN ILLINOIS UNIVERSITY

FINANCIAL AND COMPLIANCE AUDIT

 FOR THE YEAR ENDED JUNE 30, 2003

 

STATEMENT OF REVENUES, EXPENSES AND CHANGES IN NET ASSETS

FY2003

FY 2002*

OPERATING REVENUES

      Student tuition and fees

      Auxiliary enterprises (net of scholarship allowances of 4,964,267)

      Grants and contracts

      Sales and services of educational activities

      Other

            Total Operating Revenues

OPERATING EXPENSES

      Instruction

      Research

      Public services

      Academic support

      Student services

      Institutional support

      Operation of plant

      Scholarships and fellowships

      Auxiliary enterprises

      Depreciation

      Other

            Total Operating Expenses

Operating Income (Loss)

NONOPERATING REVENUES (EXPENSES)

      State appropriations

      Payments on behalf of the University

      Other nonoperating revenues (expenses), net

            Net Nonoperating Revenues (Expenses)

Income (Loss) Before Capital Contributions

      Capital appropriations, additions to endowments and capital grants and gifts

INCREASE IN NET ASSETS

Net assets, beginning of the year (restated)

Net assets, end of the year

 

$114,958,280

64,914,964

81,993,496

69,202,526

364,298

$331,433,564

 

$215,399,317

45,042,557

53,751,664

80,617,219

42,418,011

57,209,271

59,180,579

18,032,631

61,046,594

27,428,733

(65,467)

$660,061,109

($328,627,545)

 

$227,406,113

75,905,748

38,322,584

$341,634,445

$13,006,900

$45,519,549

$58,526,449

$273,680,561

$332,207,010

 

$106,699,023

62,159,940

78,744,716

66,179,388

421,763

$314,204,830

 

$224,982,962

46,855,509

54,603,766

82,386,346

40,245,072

57,018,284

52,525,332

17,916,102

58,346,691

27,748,218

517,825

$665,146,107

($350,941,277)

 

247,925,736

71,694,105

31,742,674

$351,362,515

$421,238

$19,267,008

$19,688,246

$261,647,545

$281,335,791

SELECTED ACCOUNT BALANCES

JUNE 30, 2003

JUNE 30, 2002

Cash and investments

Capital assets, net of accumulated depreciation

Revenue bonds, notes payable and capital lease obligations

Accrued compensated absences

Net assets

$170,668,713

$418,358,275

$157,524,290

$46,709,694

$332,207,010

$164,974,648

$357,706,316

$151,563,175

$48,798,582

$281,335,791

SUPPLEMENTARY INFORMATION (Unaudited)

FY 2003

FY 2002

Employment Statistics

      Faculty/administrative

      Civil service

      Student employees

            Total Employees

Selected Activity Measures

Annual full-time equivalent students

Full-time equivalent costs per student

 

3,850

3,508

2,003

9,361

 

28,034

$23,545

 

3,952

3,597

2,035

9,584

 

27,574

$24,122

UNIVERSITY PRESIDENT

During Audit Period: Dr. James E. Walker

Currently: Dr. James E. Walker

 

 

 

 

 

 

 

 

 

Weaknesses in computer security controls

 

 

 

 

 

 

 

 

 

 

 

 

Inadequate disaster contingency planning at both SIUE and SIUC

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The University undercharged graduate students $77,000 in tuition

INTRODUCTION

Our 2003 audit of Southern Illinois University is presented in three volumes: Compliance Audit; Financial Audit; and Supplementary Financial Information. The findings and recommendations are contained in the Compliance Audit volume.

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

COMPUTER SECURITY WEAKNESSES

The University did not have adequate security controls over its computer operations. Although progress has been made since the last audit, we continued to note the following weaknesses:

  • Appropriate and consistent global security settings had not been established and implemented for accessing the University's computer networks;
  • Not all systems (including some critical systems) were adequately protected via the University’s firewall; and
  • At SIUE, password changes were not required for several systems including the Student Information System (SIS) and the payroll system. These systems contain critical and confidential information and should require a routine password change interval.

The University, through the Computer Advisory Committee, is in the process of developing procedures to correct some of these weaknesses. (Finding 1, pages 19 – 20)

We recommended the University continue its efforts to ensure that consistent and adequate University-wide policies and procedures are established for its computing operations. University officials accepted our recommendation.

 

INADEQUATE DISASTER CONTINGENCY PLANNING

The University did not ensure that all University campuses had established adequately developed and tested disaster contingency plans for recovering from disaster situations.

The University’s Edwardsville Campus (SIUE) had not established an adequate plan for ensuring recovery of its computer operations in the event of a disaster. Although some technical recovery and necessary components were maintained, SIUE’s contingency plan did not contain the necessary detail to be considered adequate. Additionally, a test to ensure recoverability of critical computer systems had not been performed. Management is working with an outside contractor to develop a more formal written plan.

The University’s Carbondale Campus (SIUC) had formalized its contingency plan, however, SIUC had not performed a comprehensive recovery test. Management indicated that such a test is being planned. (Finding 2, pages 21 – 23)

We recommended the University ensure that contingency planning is consistently performed, adequately documented, and tested at each campus to ensure the University’s critical systems can be recovered in the event of a disaster. University officials accepted our recommendation.

 

GRADUATE STUDENT 601 CONTINUING EDUCATION REQUIREMENT

The University’s Graduate Student 601 Continuing Education requirement does not comply with Board of Trustee’s policies.

The University’s Graduate Student 601 Continuing Education course requires a graduate student not enrolled in other courses to enroll and be charged in-state tuition for 1 credit hour of 601. This tuition is charged at the in-state tuition rate, regardless of actual student residency. Furthermore, graduate students with account balances of less than $1,000 are granted registration cancellation waivers each semester, which allows these students to enroll in 601 without having paid their balances prior to registering.

The Board of Trustee’s policy indicates that tuition fees are collected in payment of instruction. It is not clear whether this policy includes graduate students enrolled in 601. The policy also requires all amounts due to the University by students be paid in advance of registering and requires that out of state students be charged two times the tuition of in state students.

During the Fall 2002 and Spring 2003 semesters, 1,483 graduate students were enrolled in 601. Of these, 499 were out of state residents. These students were undercharged approximately $77,000 in tuition. (Finding 3, pages 24 – 25)

We recommended the University amend its current practice and policy related to the assessment of tuition charges for the 601 Continuing Education Requirement. University officials accepted our recommendation.

Mr. Ron Cremeens, Internal Audit Director, provided the University's response.

AUDITORS’ OPINION

Our auditors stated the financial statements of the University as of June 30, 2003 and for the year then ended are fairly presented in all material respects.

 

 

____________________________________

WILLIAM G. HOLLAND, Auditor General

WGH:KAL:pp

SPECIAL ASSISTANT AUDITORS

Kerber, Eck & Braeckel LLP were our special assistant auditors for this audit.