The University did not have adequate security controls over its computer operations. Although progress has been made since the last audit, we continued to note the following weaknesses:

The University, through the Computer Advisory Committee, is in the process of developing procedures to correct some of these weaknesses. (Finding 1, pages 19 – 20)

We recommended the University continue its efforts to ensure that consistent and adequate University-wide policies and procedures are established for its computing operations. University officials accepted our recommendation.

The University did not ensure that all University campuses had established adequately developed and tested disaster contingency plans for recovering from disaster situations.

The University’s Edwardsville Campus (SIUE) had not established an adequate plan for ensuring recovery of its computer operations in the event of a disaster. Although some technical recovery and necessary components were maintained, SIUE’s contingency plan did not contain the necessary detail to be considered adequate. Additionally, a test to ensure recoverability of critical computer systems had not been performed. Management is working with an outside contractor to develop a more formal written plan.

The University’s Carbondale Campus (SIUC) had formalized its contingency plan, however, SIUC had not performed a comprehensive recovery test. Management indicated that such a test is being planned. (Finding 2, pages 21 – 23)

We recommended the University ensure that contingency planning is consistently performed, adequately documented, and tested at each campus to ensure the University’s critical systems can be recovered in the event of a disaster. University officials accepted our recommendation.

The University’s Graduate Student 601 Continuing Education requirement does not comply with Board of Trustee’s policies.

The University’s Graduate Student 601 Continuing Education course requires a graduate student not enrolled in other courses to enroll and be charged in-state tuition for 1 credit hour of 601. This tuition is charged at the in-state tuition rate, regardless of actual student residency. Furthermore, graduate students with account balances of less than $1,000 are granted registration cancellation waivers each semester, which allows these students to enroll in 601 without having paid their balances prior to registering.

The Board of Trustee’s policy indicates that tuition fees are collected in payment of instruction. It is not clear whether this policy includes graduate students enrolled in 601. The policy also requires all amounts due to the University by students be paid in advance of registering and requires that out of state students be charged two times the tuition of in state students.

During the Fall 2002 and Spring 2003 semesters, 1,483 graduate students were enrolled in 601. Of these, 499 were out of state residents. These students were undercharged approximately $77,000 in tuition. (Finding 3, pages 24 – 25)

We recommended the University amend its current practice and policy related to the assessment of tuition charges for the 601 Continuing Education Requirement. University officials accepted our recommendation.

Mr. Ron Cremeens, Internal Audit Director, provided the University's response.

Our auditors stated the financial statements of the University as of June 30, 2003 and for the year then ended are fairly presented in all material respects.

____________________________________

WILLIAM G. HOLLAND, Auditor General

WGH:KAL:pp

Kerber, Eck & Braeckel LLP were our special assistant auditors for this audit.