REPORT DIGEST

WESTERN ILLINOIS UNIVERSITY

FINANCIAL AND COMPLIANCE AUDIT
(In accordance with the Federal Single Audit Act of 1984 and OMB Circular
A-133)
For the Year Ended
June 30, 1997

Summary of Findings:

Release Date:
April 23, 1998





State of Illinois
Office of the Auditor General

WILLIAM G. HOLLAND
AUDITOR GENERAL

Iles Park Plaza
740 E. Ash Street
Springfield, IL 62703
(217) 782-6046

SYNOPSIS

• Western Illinois University entered into a contracting arrangement with a private corporation without prior approval of the University's governing board which resulted in several statutory violations.

• During a tour of campus facilities we noted improperly stored items in the outdoor physical plant storage yard. The storage yard was not well maintained.

• Local Area Network computer security standards needed to be improved.

{Financial Information is summarized on the reverse page.}

FY 1997

FY 1996

June 30, 1997

June 30, 1996

Contract Not Approved by WIU

Surplus Items Not Transferred to CMS

Security over Local Area Computer Networks needed improvement

INTRODUCTION

We conducted a Financial and Compliance audit of Western Illinois University for the year ended June 30, 1997.

FINDINGS, CONCLUSIONS, AND
RECOMMENDATIONS

UNAPPROVED CONTRACTING ARRANGEMENT WITH A PRIVATE CORPORATION

 

Certain Western Illinois University officials entered into a contracting arrangement with a private corporation without prior approval of the University's governing board, which resulted in several statutory violations.

 

The University was chosen as the Material Distribution Services (MDS) center by the National Center for Research in Vocational Education (NCRVE). The NCRVE is a federally funded grant program located at a California university. NCRVE contracts with its research partners (which include private corporations and other colleges and universities) to conduct research projects and author articles. Once completed, the finished articles are sent to the MDS center for printing and distribution.

 

A private corporation initiated a research project which was beyond the means of the NCRVE Grant to fund. Through verbal agreements by the NCRVE, the private corporation, and Western Illinois University (MDS) the project was funded by the corporation with the understanding that reimbursement would be made by the MDS center (WIU) once the project was sold.

 

University central administration personnel stated they were not aware of this agreement until receiving a reimbursement request. University central administration personnel stated that when they realized no written contract was in place, payment was denied.

 

This situation resulted in the following:

• Contract not Reduced to Writing - Prior to beginning the project, University officials (MDS) did not reduce the agreement to writing in order to get advance approval from the Board. University business procedures require all contracts in excess of $1,000 to be reduced to writing in the form of a legal contract. Costs had escalated to $260,006 by the time the agreement had been reduced to writing and approved by the Board of Trustees. The University was in violation of both the State Comptroller Act (15 ILCS 405/15) and University business procedures.

• Cash Advance - As part of the agreement, the private corporation sent to the University (MDS) a check for $50,000 for start-up printing costs. This $50,000 was repaid as part of the $260,006 payment that was ultimately made to the private corporation.

• Purchasing Violation - A second printing of the project's work product was required. However, the private corporation contracted with another printer in Illinois to do the second printing. The cost of the second printing was $41,211. This arrangement was in violation of the Illinois Purchasing Act, 30 ILCS 505/6a, which states that all purchases, contracts, and expenditure of funds shall be awarded pursuant to a competitive selection process. (Finding 2, pages 20-21)

We recommended the University improve controls over contracts and cooperative agreements with other universities to ensure such contracts and agreements have the approval of the University Board and University top management and to ensure the University complies with applicable laws.

 

The University responded it acknowledges the need for internal controls and notes that such controls disclosed this transaction. The University further responded it will continue to communicate and emphasize the need for pre-approvals of contractual agreements to all campus fiscal agents.

 

IMPROPER STORAGE OF ITEMS

 

During a tour of campus facilities we noted improperly stored items in the outdoor physical plant storage yard, and the yard was not well maintained. We specifically noted the following:

• Six surplus, abandoned vehicles were located in the storage yard. Agencies are required to transfer surplus property to the Department of Central Management Services (CMS), in order to make property available to other State agencies. University personnel indicated they intend to transfer these vehicles to CMS. However, it appeared the vehicles had been in the storage yard for several months. CMS could have provided these vehicles to other agencies, or could have generated State revenue by selling the vehicles in a surplus property auction.

• Several drums of paint were located in the storage yard. Prudent business practices require agencies to properly dispose of hazardous materials. University personnel indicated they were in the process of trying to properly dispose of the materials.

• Six cartons of new light fixtures were exposed to the outdoor elements. (Finding 3, pages 22-23)

We recommended the University comply with CMS requirements regarding surplus property and the disposal of property, and properly safeguard University property.

University officials responded they planned to take corrective action on each of the conditions we described in our finding.

 

LOCAL AREA NETWORK SECURITY PROBLEMS

 

The University's policies and procedures to control and monitor microcomputers and Local Area Networks of computers (LANs) were inadequate. The Information Systems department did not maintain adequate procedures or ensure proper distribution or compliance.

 

Policies are documented in the LAN Procedures Technical Manual (October 1997). However, adequate enforcement and monitoring of these policies and procedures did not exist.

 

The University had at least 32 LANs established at the Macomb campus with approximately 2,424 workstations. The LAN operating systems, the number of users defined to each LAN, and their primary usage varied by network. The degree of formality and the extent and effectiveness of LAN administration procedures were also found to vary by network.

 

Our review found that the University had established standards, but it did not consistently enforce these standards on individual LANs. In addition, we noted that the standard default password change interval was excessive. For example, three of the LANs reviewed had password change intervals of 90 days, 180 days, and 365 days. One LAN did not even establish a password change interval, thus allowing users to never change their passwords.

 

Our review also noted that the LAN policies and procedures did not adequately address the following:

• Backup, tape rotation, and off-site standards;
• Software licensing and monitoring;
• Physical security requirements for file servers, distribution equipment, and critical components; and
• Guest account restrictions. (Finding 1, page 16)

The University concurred with our recommendation that they review their existing standard security guidelines to ensure security controls are adequately addressed on all University LANs.

 

AUDITORS' OPINION

Our auditors state the June 30, 1997 financial statements of Western Illinois University are fairly presented.

____________________________________
WILLIAM G. HOLLAND, Auditor General

WGH:JTD:pp

 

SPECIAL ASSISTANT AUDITORS

Geo. S. Olive & Co., LLC were our special assistant auditors for this audit.