REPORT DIGEST

CHICAGO STATE UNIVERSITY

STATE COMPLIANCE EXAMINATION
FOR THE YEAR ENDED JUNE 30, 2022

Release Date:  April 13, 2023

FINDINGS THIS AUDIT: 14

CATEGORY:  NEW -- REPEAT -- TOTAL
Category 1:  0 -- 1 -- 1
Category 2:  5 -- 8 -- 13
Category 3:  0 -- 0 -- 0
TOTAL:  5 -- 9 -- 14

FINDINGS LAST AUDIT: 10

Category 1: Findings that are material
weaknesses in internal control and/or
a qualification on compliance with
State laws and regulations (material
noncompliance).
Category 2: Findings that are
significant deficiencies in internal
control and noncompliance with State
laws and regulations.
Category 3: Findings that have no
internal control issues but are in
noncompliance with State laws and
regulations.

State of Illinois, Office of the
Auditor General
FRANK J. MAUTINO, AUDITOR GENERAL

To obtain a copy of the Report
contact:
Office of the Auditor General, Iles
Park Plaza, 740 E. Ash Street,
Springfield, IL 62703
(217) 782-6046 or TTY (888) 261-2887

This Report Digest and Full Report are
also available on the worldwide web at
www.auditor.illinois.gov

INTRODUCTION

This digest covers the Compliance
Examination of Chicago State
University (University) for the year
ended June 30, 2022.  A separate
digest covering the University’s
financial audit as of and for the year
ended June 30, 2022, was previously
released on February 23, 2023.  In
addition, a separate digest covering
the University’s Single Audit for the
year ended June 30, 2022, was
previously released on March 30, 2023.
In total, this report contains
fourteen findings, six of which were
reported in the Financial Audit and
Single Audit.

SYNOPSIS

• (22-07) The University did not have
adequate controls over its contractual
services expenditures.
• (22-08) The University did not have
adequate internal controls over its
service providers.
• (22-09) The University did not fully
comply with the requirements of the
Chicago State University Law regarding
flexible hours positions.

FINDINGS, CONCLUSIONS, AND
RECOMMENDATIONS

INADEQUATE CONTROLS OVER CONTRACTUAL
SERVICES EXPENDITURES

The Chicago State University
(University) did not have adequate
controls over contractual services
expenditures.

During our review of 25 contracts
(totaling $6,205,786), including
purchase orders, executed during the
fiscal year ended June 30, 2022, we
noted the following:

• Two contracts (totaling $4,388,389)
were executed subsequent to the start
date of the contracts. The contract
execution dates were 12 and 43 days
from the commencement of services.

• Six contracts (totaling $304,756)
were filed two days late to the Office
of Comptroller and two contracts
(totaling $190,000) were not filed
with the Office of Comptroller.

• Disclosure of financial interest
statement of one contract (totaling
$75,000) was not obtained.

• Two exempt purchases (totaling
$230,000) were not published timely in
the Illinois Procurement Bulletin. The
contracts were published 23 and 34
days from the contract execution date.

• One professional contract (totaling
$155,000) was not approved by the
Board of Trustees.

• Two contracts (totaling $4,734,889),
each exceeding $250,000, were not
signed and approved by the Chief
Financial Officer and/or Chief Legal
Counsel.

• Six contracts (totaling $259,776)
were not supported with three price
quotations and at least one of the
three quotes from a Business
Enterprise Program Certified Vendor.
(Finding 7, pages 24-26)   This
finding has been reported since 2016.

We recommended the University
establish appropriate procedures to
ensure all contracts are completed,
approved, and properly executed prior
to the commencement of services.
Further, we recommended the University
review its procedures to ensure
disclosures are obtained prior to the
execution of contracts, contracts are
supported by three price quotes when
required, posted in the Illinois
Procurement Bulletin, and filed with
the Office of Comptroller in
accordance with the State statutes and
guidelines.

University officials agreed with the
recommendation and stated the
University provides monthly
procurement training for staff and
continues to update its procurement
documentation and guidelines.
University officials also stated
purchasing activities that do not
conform to established requirements
prompt the engagement of senior campus
leadership with noncompliant
departments.


LACK OF ADEQUATE CONTROLS OVER REVIEW
OF INTERNAL CONTROLS OVER SERVICE
PROVIDERS

The University did not have adequate
internal controls over its service
providers.

During our testing of two service
providers, we noted the University had
not:

• Implemented a regular review process
to monitor specified performance
measures, problems encountered, and
compliance with contractual terms for
two (100%) service providers.

• Monitored and documented the
operation of the Complementary User
Entity Controls (CUECs) relevant to
the University’s operations identified
in the SOC reports for two (100%)
service providers.

• Obtained and reviewed System and
Organization Controls (SOC) reports of
the subservice organizations or
performed alternative procedures to
determine the impact of the subservice
organization on the University’s
internal control for two (100%)
service providers.

• Conducted an analysis to determine
the impact of the noted deviations
within the SOC report on the
University’s internal control for one
(50%) service provider. (Finding 8,
pages 27-29) This finding has been
reported since 2020.

We recommended the University:

• Implement a regular review process
to monitor specified performance
measures, problems encountered, and
compliance with contractual terms with
the service providers.
• Review SOC reports and monitor and
document the operation of CUECs
relevant to the University’s
operations.
• Obtain and review SOC reports for
subservice providers or perform
alternative procedures to determine
the impact on the University’s
internal control environment.
• Document the deviations noted in the
SOC reports and perform an analysis of
the impact of those deviations on the
University’s internal control
environment.

University officials agreed with the
recommendation and stated the
University has amended contracts to
include requirements to ensure SOC
reports are received and reviewed as
applicable.


NONCOMPLIANCE WITH THE CHICAGO STATE
UNIVERSITY LAW

The University did not fully comply
with the requirements of the Chicago
State University Law regarding
flexible hours positions.

The University Board of Trustees
(Board) established goals for flexible
hours positions at the University. The
Board passed a resolution in 2013 to
achieve a goal of having 20% of its
employees working flexible schedules
by 2016. During testing, we noted the
University reached its 20% goal;
however, the University did not begin
the process of evaluating the
effectiveness and efficiency of the
flexible hours program. (Finding 9,
page 30)

We recommended the University evaluate
the effectiveness
and efficiency of the program in
compliance with the requirements of
the Chicago State University Law.

University officials agreed with the
recommendation and stated the
University is implementing a
corrective action plan to demonstrate
an evaluation on the efficiency and
effectiveness of the flexible hours
program.

OTHER FINDINGS

The remaining findings pertain to
inadequate internal controls over
census data, weaknesses over computer
security, failure to obtain student
verification documents, noncompliance
with special tests and provisions,
failure to notify students upon
disbursement of funds,  lack of
adherence to controls and
noncompliance with requirement
applicable to Education Stabilization
Fund,  weaknesses in cybersecurity
programs and practices, inadequate
disaster recovery process, change
control weaknesses, weaknesses over
maintenance of employment eligibility
verification forms, and employee
performance evaluations not completed.
We will review the University’s
progress towards the implementation of
our recommendations in our next
engagement.

ACCOUNTANT’S OPINION

The accountants conducted a State
compliance examination of the
University for the year ended June 30,
2022, as required by the Illinois
State Auditing Act.  The accountants
qualified their report on State
compliance for Finding 2022-001.
Except for the noncompliance described
in this finding, the accountants
stated the University complied, in all
material respects, with the
requirements described in the report.

This State Compliance Examination was
conducted by Roth & Company, LLP.

JANE CLARK
Division Director


This report is transmitted in
accordance with Section 3-14 of the
Illinois State Auditing Act.

FRANK J. MAUTINO
Auditor General

FJM:vrb