REPORT DIGEST EASTERN ILLINOIS UNIVERSITY Financial Audit, Single Audit, and Compliance Examination For the One Year Ended June 30, 2012 Release Date: March 28, 2013 Summary of Findings: Total this audit: 16 Total last audit: 8 Repeated from last audit: 3 State of Illinois, Office of the Auditor General WILLIAM G. HOLLAND, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • The University did not properly capitalize interest costs incurred related to the construction of the University’s Renewable Energy Center. • The University did not account for the University’s Student Self-Insurance Health Plan in accordance with the accrual basis of accounting. • The University did not ensure information submitted by students applying for financial aid was properly verified. • The University was unable to locate certain computer equipment during their annual inventory. • The University needs to improve internal controls related to the College Student Immunization Act requirements. • The University did not exercise adequate internal control over the University’s vehicles. • The University did not accurately account for its participation in the State University Risk Management Association (SURMA). FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS NEED TO CAPITALIZE INTEREST COST INCURRED ON CONSTRUCTION IN PROGRESS Eastern Illinois University (University) did not properly capitalize interest costs incurred related to the construction of the University’s Renewable Energy Center. In November 2009, the University began construction on the Renewable Energy Center to replace the University’s steam plant. While the Renewable Energy Center produced some steam to support campus operations during Fiscal Year 2012, the Renewable Energy Center was not functioning as designed or intended. The University has been working with the University’s contractor to identify and remedy issues preventing the Renewable Energy Center from operating at full capacity. During testing, the auditors noted the University properly recorded the Renewable Energy Center as construction in progress as it was not ready for its intended use. The University, however, did not capitalize interest costs of $2,011,486 incurred during Fiscal Year 2012. The auditors proposed an adjusting journal entry to correct this error and the University made the adjustment to the financial statements. (Finding 1, pages 19-20) We recommended the University capitalize interest cost in accordance with generally accepted accounting principles. University officials complied with the auditors’ recommendation and recorded an adjustment to the University’s Fiscal Year 2012 ledger. NEED TO ADOPT ACCRUAL BASIS ACCOUNTING FOR THE UNIVERSITY’S STUDENT SELF-INSURANCE HEALTH PLAN The University did not account for the University’s Student Self-Insurance Health Plan in accordance with the accrual basis of accounting. The University administers a self-insured health plan for students funded by fees paid by the users of the plan, as described in Note 16 on pages 49-50 of the University’s financial statements. During testing, the auditors noted the University accounted for expenditures related to this health plan on the cash, rather than accrual, basis of accounting. The auditors analyzed Fiscal Year 2012 expenditures paid between July 1, 2012 through October 16, 2012, noting unrecorded self-insurance claims payable and a resultant understatement of self-insurance expense by $128,018. This amount was deemed immaterial by University management and was not adjusted in the final financial statements. (Finding 2, pages 21-22) We recommended the University account for the activities of the University’s Student Self-Insurance Health Plan on the accrual basis of accounting. University officials agreed with the auditor’s recommendation. NEED TO IMPROVE VERIFICATION PROCESS The University did not ensure information submitted by students applying for financial aid was properly verified. The verification process helps ensure accurate information was reflected on the Institutional Student Information Report (ISIR). During audit testing, the following conditions were noted: • For three of 60 (5%) students tested, the information within the ISIR did not match the verification information submitted by the student’s parents. As a result, each student’s Expected Family Contribution should have been increased, reducing the total aid provided to the students by $800. Subsequent to our examination, the University corrected these errors and repackaged each student’s financial aid award with the correct information. • For one of 60 (2%) students tested, the University did not “lock” the ISIR following completion of the verification process. The University allowed the student to make changes after verification, but prior to the packaging of the student’s financial aid award. (Finding 3, pages 23-24) We recommended the University enhance controls over student aid verification to ensure supporting documentation submitted by students agrees with information in the ISIR. Further, the University should lock the ISIR following completion of verification procedures. University officials agreed with the recommendation and stated they will work to enhance the procedures involved in student aid verification. NEED TO ENHANCE CONTROLS OVER THE UNIVERSITY’S COMPUTER INVENTORY The University was unable to locate certain computer equipment during their annual inventory. The University could not locate 36 computers (33 desktops and laptops and three handheld computers), five external hard drives, and one flashdrive during their annual inventory. These items were deemed by the University to have been lost or stolen during Fiscal Year 2012, totaling $58,432. During testing, the auditors noted the University had not protected its computers with encryption software, thus increasing the risk that confidential information could be exposed. Confidential information routinely collected and maintained by the University includes education records, health records, personal information, and sensitive information. In addition, the University did not perform a detailed assessment and therefore was unable to assess whether the missing computers contained confidential information. (Finding 7, pages 31-32) We recommended the University perform a detailed assessment to determine if any of the missing computers contained confidential information, review current practices to determine if enhancements can be implemented to prevent the theft or loss of computers, establish procedures to immediately notify security personnel of any missing or stolen computers to allow them to assess if a computer may have contained confidential information, and ensure confidential information is secured with methods such as encryption or redaction. University officials agreed with our recommendation, indicating the University has begun taking corrective action. Further, the University reported 12 of the missing items have recently been found on campus. NEED TO IMPROVE INTERNAL CONTROLS OVER COMPLIANCE WITH THE COLLEGE STUDENT IMMUNIZATION ACT The University had internal control weaknesses over compliance with the College Student Immunization Act (Act). The Act imposes specific duties and responsibilities on higher education students and institutions within the State of Illinois. During testing, the auditors noted the following internal control weaknesses: • The sum of the various categories of students does not agree to the total number of students reported by the University to the Department of Public Health. The University was unable to reconcile the difference. • The University provided the auditors with a listing of new students enrolled for Fall 2011 (2,268) that did not agree with the number of new covered students enrolled in Fall 2011 reported to the Department of Public Health (2,386). The University was unable to provide a reconciliation of the difference to the auditors. • The data reported for noncompliant covered students contains discrepancies. Specifically, the 458 new students should represent the minimum number of noncompliant students across the entire covered student population. The University, however, only reported a total population of 116 “noncompliant covered students”. (Finding 8, pages 33-35) We recommended the University establish and maintain a system of internal controls to monitor covered student compliance, identity noncompliant students and preclude them from registering in subsequent academic terms, accurately report summary information to the Department of Public Health, and provide sufficient audit trails for accountability. University officials agreed with our recommendation. NEED TO IMPROVE CONTROLS OVER THE UNIVERSITY’S VEHICLES The University did not exercise adequate internal control over the University’s vehicles. Some of the conditions noted during our testing follow: • The University does not collect and maintain odometer readings on a regular basis for University-owned vehicles. • The University does not have a policy in place requiring all University-owned vehicles undergo regular service and/or repairs in order to maintain the vehicles in a road worthy and safe operating condition. • During annual certification testing for employees assigned to a specific University-owned or University- leased vehicle on an ongoing basis, the auditors noted: -- Three of five (60%) individuals filing certifications for an assigned vehicle did not agree with the user of the vehicle as recorded on the University’s operable vehicle listing. -- The auditors noted seven vehicles classified as “loaner” vehicles on the University’s operable vehicle listing assigned to specific individuals; however, these individuals did not file an annual certification with the University President. • The University did not ensure all University-owned vehicles were identified by a special registration plate (U-plate). • The University did not timely update the operable vehicle listing. The auditors noted that two vehicles were sold in 2009 and 2010 but remained on the list. (Finding 12, pages 43-46). We recommended the University collect, maintain, and review odometer readings, adopt a policy and implement controls to ensure all University vehicles undergo regular service and/or repair, ensure all University- owned vehicles display the special registration plate (U-plate), ensure all employees assigned a specific University-owned or University-leased vehicle file the annual certification with the University President, and timely update the University’s operable vehicle listing. University officials agreed with our recommendation and indicated they are implementing corrective action. NEED TO RECORD KNOWN TRANSACTIONS IN THE UNIVERSITY’S FINANCIAL STATEMENTS The University did not accurately account for its participation in the State University Risk Management Association (SURMA). During testing, the auditors noted the University failed to appropriately record the University’s share of excess capital contributions to SURMA, electing to record the excess capital contributions at last fiscal year’s amount of $729,712 instead of this fiscal year’s amount of $686,692. As a result of this error, the University’s assets are overstated by $43,020 and insurance expense is understated by $43,020. This amount was deemed immaterial by the University’s management and was not adjusted in the final financial statements. (Finding 13, pages 47-48) We recommended the University implement controls to monitor the activities of SURMA and properly account for SURMA in accordance with Generally Accepted Accounting Principles. University officials disagreed with our recommendation, noting the transaction was not material and does not lead to a material misstatement of the financial statements. In an auditors’ comment, we noted the management of the University made a decision not to record potential adjustments to the financial statements on the concept of materiality. Materiality judgments are critical in determining whether the financial statements are fairly presented in accordance with generally accepted accounting principles. Inherent in the rendering of an audit opinion is the recognition that the financial statements cannot precisely present financial position or results of operations. Such precision is not attainable because of limitations in the accounting measurement process, such as an accounting estimate. Considering the facts and circumstances listed in the finding, the specific accounts and amounts were not subject to an accounting estimate. In fact, these amounts were actual adjustments that could and should have been made to the financial statements, regardless of materiality. OTHER FINDINGS The remaining findings are reportedly being given attention by the University. We will review the University’s progress towards the implementation of our recommendations in our next audit. AUDITORS’ OPINION Our auditors stated the financial statements of the Eastern Illinois University as of and for the year ended June 30, 2012 are fairly stated in all material respects. WILLIAM G. HOLLAND Auditor General WGH:djn:rt SPECIAL ASSISTANT AUDITORS Our special assistant auditors for this engagement were CliftonLarsonAllen, LLP.