REPORT DIGEST SOUTHERN ILLINOIS UNIVERSITY Single Audit and Compliance Examination For the Year Ended June 30, 2014 Release Date: March 12, 2015 FINDINGS THIS AUDIT: 7 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 0 -- 0 -- 0 Category 2: 2 -- 5 -- 7 Category 3: 0 -- 0 -- 0 TOTAL: 2 -- 5 -- 7 FINDINGS LAST AUDIT: 19 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General WILLIAM G. HOLLAND, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION This digest covers our Single Audit and Compliance Examination of Southern Illinois University (the “University”) for the year ended June 30, 2014. A separate Financial Audit as of and for the year ending June 30, 2014, was previously released on January 15, 2015. In total, this report contains 7 findings, none of which were reported in the Financial Audit. SYNOPSIS • (14-1) The University’s Carbondale campus did not report enrollment status changes timely to the National Student Data System in a timely manner. • (14-2) The University inaccurately completed Return of Title IV calculations for students. • (14-6) The University was unable to locate 280 computers and other computer-related items with an original acquisition value of $348,889 during their annual inventory. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS UNTIMELY NATIONAL STUDENT LOAN DATA SYSTEM REPORTING - CARBONDALE CAMPUS Enrollment status changes were not reported to National Student Loan Data System (NSLDS) in a timely manner by the Carbondale campus. The University is required to confirm and report to the NSLDS the enrollment status of students who receive Federal student loans. The Carbondale Campus failed to timely report enrollment status within sixty days from the date that the University determined the status change of the student. During our testing of 25 students for NSLDS reporting, 5 (20%) students were reported to the NSLDS after the sixty day time frame. Three students, who graduated in Spring 2014, were not received by the NSLDS until September 2014 and one student, who graduated in Summer 2014, was not received by the NSLDS until October 2014. Also, there was one graduate student with an error in reporting the social security number at the time that the status for graduate would have been updated. The student has since re-enrolled; therefore, the graduate status was never reported to NSLDS. (Finding 1, pages 17-18) We recommended the University establish formalized review and reconciliation procedures regarding information submitted to NSLDS to meet reporting requirements and to ensure reporting is completed timely. University officials accepted our recommendation and indicated it has been partially implemented. ERRORS IN RETURN OF TITLE IV CALCULATIONS - EDWARDSVILLE AND CARBONDALE CAMPUSES The University did not accurately complete Return of Title IV calculations for students. The University used the wrong withdrawal date for the Return of Title IV calculations or did not complete a Return of Title IV calculation for students that had dropped classes within the census date. Out of the 60 students tested at the Edwardsville campus, we noted 5 (8%) students in which the Edwardsville campus did not accurately complete the Return of Title IV calculation. For one student, the wrong withdrawal date was used for an official withdrawal, resulting in an error in the Return of Title IV calculation of $123, which should have been returned to the Department of Education. For the remaining 4 out of 5 students, the date used for the withdrawal on the Return of Title IV calculation was the University’s last date of withdrawal instead of the date the student actually initiated the withdrawal process; however, all of these students had earned all their aid and no funds are required to be returned to the Department of Education. Out of 60 students tested at the Carbondale campus, we noted 6 (10%) students in which the Carbondale campus did not accurately complete the Return of Title IV calculation. For one student, the wrong withdrawal date was used for an official withdrawal, resulting in an error in the Return of Title IV calculation of $170 which should have been returned to the Department of Education. For the remaining 5 out of 6 students, the students withdrew within the University’s refund policy and before the school’s census date and no Return of Title IV calculation was completed and all aid was cancelled and returned to the Department of Education. Under federal regulations, institutions are required to complete accurate Return of Title IV calculations for students who begin attendance and subsequently withdraw. According to University officials, on the Edwardsville campus the errors were the result of a misalignment in departmental policies and procedures between the Office of the Registrar and the Office of Financial Aid. On the Carbondale campus, all but one of the errors were caused by an institutional policy of crediting all charges to and removing all aid from students who withdrew during the full refund policy period but attended classes; rather than allowing the student to retain the financial aid for the time attended. (Finding 2, pages 19-20) This finding was first reported in 2012. We recommended the University implement policies and procedures to properly determine the withdrawal date to be in compliance with Federal regulations. In addition, we recommended the University determine if students’ accounts should be adjusted due to the calculation error. University officials accepted our recommendation and indicated they have modified procedures for determining the official withdraw date. (For previous University response, see Digest Footnote #1.) WEAKNESSES IN COMPUTER INVENTORY CONTROL Southern Illinois University (University) was unable to locate 280 computers and other computer-related items (226 from Carbondale and 54 from Edwardsville) with an original acquisition value of $348,889 during their annual inventory. Of the 280 missing items, 34 (with an acquisition value of $20,981) were reported as stolen from SIUC, and the remaining were classified by the University as lost during fiscal year 2014. The majority of these items are now fully depreciated (more than five years old); only 81 items have any remaining useful life. The computers noted as missing represent only 2.3% of the University’s total computer inventory at June 30, 2014. During testing, the auditors noted the University had not protected its computers with encryption software, thus increasing the risk that confidential information could be exposed. Confidential information routinely collected and maintained by the University includes education records, health records, personal information, and sensitive information. University officials stated computers reported as missing were unable to be located by the department staff during annual inventory procedures; however, in many instances these computers are later located by department staff. University officials also stated that encryption efforts are underway on each campus; however, the estimated timeframe for completion has been extended due to the significant resources needed and other priorities. (Finding 6, pages 26-27) This finding was first reported in 2012. We recommended the University: • Review current practices to determine if enhancements can be implemented to prevent the theft or loss of computers; • Ensure confidential information is adequately secured with methods such as encryption or redaction; and • Continue to perform an assessment to determine if the missing computers contain confidential information. University officials accepted our recommendation and indicated it has been partially implemented. (For previous University response, see Digest footnote #2.) OTHER FINDINGS The remaining findings are reportedly being given attention by the University. We will review the University’s progress towards the implementation of our recommendations in our next engagement. AUDITOR’S OPINION The financial audit report was previously released. The auditors stated the financial statements of the Southern Illinois University as of and for the year ended June 30, 2014, are fairly stated in all material respects. The auditors also conducted a Single Audit of the University as required by OMB Circular A-133. Our auditors stated the University complied, in all material respects, with the types of compliance requirements that could have a direct and material effect on each of the University’s major federal programs for the year ended June 30, 2014. ACCOUNTANT’S OPINION The accountants conducted a compliance examination of the University for the year ended June 30, 2014, as required by the Illinois State Auditing Act. The auditors stated the University complied, in all material respects, with the requirements described in the report. WILLIAM G. HOLLAND Auditor General WGH:JAF SPECIAL ASSISTANT AUDITORS Our Special Assistant Auditors for this engagement were CliftonLarsonAllen LLP. DIGEST FOOTNOTES #1 - ERRORS IN RETURN OF TITLE IV CALCULATIONS - EDWARDSVILLE AND CARBONDALE CAMPUSES Accept. The calculation was corrected immediately upon notification of the error. We are pursuing two options for verifying future calculations. Additionally, we will determine an appropriate source of institutional funds from which to credit these students’ accounts. #2- WEAKNESSES IN COMPUTER INVENTORY CONTROL Accept. SIU has been actively working to enhance efforts to reduce the number of computers reported lost or stolen and to protect data on its computers. Both campuses have taken measures to communicate the importance of accurate inventory procedures to staff and to locate computers reported as missing. This is evidenced by the updated count of unlocated computers of 207 for fiscal year 2013 (121 from Carbondale and 86 from Edwardsville) rather than the initial 357 mentioned above. This represents a reduction in computers reported as lost or stolen from the prior year. Additionally, measures have been taken to identify individuals with access to confidential information, and plans are in progress to encrypt data on computers with access to confidential data by June 2014.