REPORT DIGEST

 

NORTHERN ILLINOIS UNIVERSITY

 

COMPLIANCE EXAMINATION (In accordance with the Federal Single Audit Act and OMB Circular A-133)

For the Year Ended: June 30, 2009

 

Summary of Findings:

Total this audit:  6

Total last audit:  4

Repeated from last audit:  3

 

Release Date: May 13, 2010

 

State of Illinois

Office of the Auditor General

WILLIAM G. HOLLAND

AUDITOR GENERAL

 

 

To obtain a copy of the Report contact:

Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703

(217)    782-6046 or TTY (888) 261-2887

 

This Report Digest and Full Report are also available on the worldwide web at http://www.auditor.illinois.gov

 

 

 

INTRODUCTION

 

            This report addresses the State Compliance Examination and Federal Single Audit of Northern Illinois University for the year ended June 30, 2009 conducted in accordance with OMB Circular A-133.  The Financial Audit and Report Required under Government Auditing Standards for the year ended June 30, 2009 were previously issued. 

 

SYNOPSIS

 

•           The financial information in the University Compliance Reports contained corrections to opening fund balances totaling $5.8 million in the June 30, 2009 report and $3.0 million in the June 30, 2008 report. 

 

•           The cash and investment balances reported to the Illinois Office of the Comptroller on the quarterly Locally Held Funds report was overstated by $2.2 million. 

 

•           The University had not assured adequate disposal of confidential information. 

 

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS

 

CORRECTION OF ERRORS IN COMPLIANCE REPORT FINANCIAL INFORMATION

 

            The financial information in the June 30, 2009 and 2008 Compliance Reports contained corrections to opening fund balances.

 

            The June 30, 2009 Compliance Examination Report contained condensed financial information schedules for other entities which included restatements of beginning cost center fund balances for accruals and additions to the cost centers the University failed to identify.  The Residence Hall cost center beginning balance was increased by $5,123,912, the Continuing Education and Public Service cost center beginning balance was increased by $12,117 and the Student Programs and Services cost center beginning balance was increased by $679,099.

 

            The June 30, 2008 Compliance Examination Report contained condensed financial information schedules for other entities which included restatements of beginning cost center fund balances for accruals and additions to the cost centers the University failed to identify.  The Residence Hall cost center beginning balance was increased by $2,335,102, the Auxiliary Business Operations cost center beginning balance was increased by $560,884 and the Indirect Cost Support cost center beginning balance was increased by $153,971. 

 

            University officials stated the misstatements were due to accruals not being identified with the appropriate entity and new cost centers being omitted.  (Finding #2, page 22)

 

            We recommended the University assess its internal controls over financial reporting to identify accruals with the appropriate entity and new cost centers and ensure they are included in the University’s financial schedules in the compliance report.

 

            The University agreed with our recommendation and stated that all financial report schedules in the compliance report would be based upon the audited financial statements.

 

 

LOCALLY HELD FUNDS REPORT NOT ACCURATE

 

            The cash and investment balances reported to the Illinois Office of the Comptroller (Comptroller) on the quarterly Locally Held Funds report for June 30, 2009, did not agree to the cash and investment balances reported its financial statements.

 

            During our examination we noted a $2,164,540 overstatement of the cash and investment amounts reported on the June 30, 2009 Locally Held Funds report as compared to the amount of cash and investments reported in the University’s financial statements.  The University explained the difference, but did not file a revised report as recommended in the prior year’s finding.

 

            According to University management this is a timing issue that will never be resolved.  The report is due according to SAMS Procedure by July 31.  All accruals and adjustments that are made post June 30th are included in the financial statements.  The difference between the two reports is that activity.  The University does not believe it is required to continuously restate a filed report to make it agree with the financial statements.  (Finding #3, pages 23-24)  This finding was first reported in 2007. 

            We recommended the University prepare the locally held funds report so that year-end cash and investment balances agree to those reported in its financial statements.  The University should file a revised report if it subsequently determines the cash and investment balances as originally filed are significantly different from those reported in the financial statements.

 

            The University disagreed with the finding.  University officials stated that they had complied with SAMS Procedure 33.13.20 and had supplied the State a reconciliation between the quarterly report and the financial statement presentation.  Further, the auditors’ recommendation of filing a revised quarterly report did not eliminate the finding or speak to the underlying issue of timing.

 

            In an Auditors’ Comment we noted the University had not complied with SAMS Procedure 33.13.20.  The report filed with the Illinois Office of the Comptroller for the last quarter of fiscal year 2009 overstated the ending cash and investment balance by $2,164,540.  In last quarter of fiscal year 2008 the University filed a report that differed from the ending balance of cash and investments by $328,646 (Finding 08-3) and in the last quarter of fiscal year 2007 the University filed a report that understated the cash and investment balance by $31 million (Finding 07-5). 

 

            The University acknowledged that the report filed in the last quarter of fiscal year 2009 was filed in error by describing a reconciliation that they provided to the Comptroller.  By filing inaccurate reports with the Comptroller’s office, the University undermines the Comptroller’s ability to perform its statutory responsibility under the State Comptroller Act (15 ILCS 405/16) to capture the receipts, disbursements and ending balances in State locally held funds on a quarterly basis.  (For the previous University response, see Digest Footnote #1.)

 

DISPOSAL OF CONFIDENTIAL INFORMATION NOT ADEQUATE

 

            The University had not assured adequate disposal of confidential information. 

 

            Although the University had established policies relating to the security of confidential and personal health information, and had established procedures for disposing of confidential information, we found instances of non-compliance with existing procedures. 

 

            While performing walkthroughs at the University’s Health Services facility, we noted the following:

 

•           Personal and confidential information was not always placed within the lockable shred bins.  We found personal and confidential information including lab reports and hospital reports showing patient name, address, patient number, date of birth and diagnosis/subscription information or tests performed within recycle/waste bins located near copiers.

 

•           One bin used for disposing confidential information to be shredded was not locked.  This bin was located near a copier off a hallway accessible by students and staff.

 

            University personnel stated policies and procedures exist regarding the adequate disposal of confidential information.  (Finding #6, pages 29-30)

 

            We recommended the University assess its procedures for safeguarding and subsequent disposal of all confidential information and assure compliance with established policies and procedures.  Further, the University should assure University-wide procedures for properly disposing confidential information are enforced and periodically communicated to all University personnel. 

 

            University officials disagreed with the finding and stated there were no cited examples of documents containing information deemed to be confidential under current law disposed of improperly.  The fundamental premise of the auditor’s finding is based on his subjective interpretation of what data could be acquired for purposes of exploiting a “human engineering” vulnerability.

 

            Although the University disagreed that this issue rises to the level of a finding, we do agree that it is prudent and responsible to take action to help eliminate potential exposures of information that could be leverage for nefarious purposes. The University stated it would perform in-service briefings and business process reviews to help refresh the general awareness of staff regarding overall information and document controls.

 

            In an Auditors’ Comment we noted that assuming the University’s reference to “human engineering” vulnerability is referring to the capacity of individuals to find ways to exploit confidential information, we continue to believe steps – such as not leaving personal medical information out in the open – can and should be taken.  To that end we are pleased the University agrees “…it is prudent and responsible to take action to help eliminate potential exposures of information…”  We strongly believe that deficiencies in safeguarding confidential information are a significant internal control weakness that should be reported to promote corrective action. 

 

OTHER FINDINGS

 

            The remaining findings are reportedly being given attention by the University.  We will review the University’s progress toward the implementation of our recommendations in our next financial audit, State compliance examination and federal Single audit. 

 

AUDITORS' OPINION

 

            We conducted a compliance examination of the University for the year ended June 30, 2009 as required by the Illinois State Auditing Act, the Single Audit Act and OMB Circular A-133.  A financial audit and report required under Government Auditing Standards covering the year ending June 30, 2009 were issued separately. 

 

 

WILLIAM G. HOLLAND, Auditor General

 

WGH:JAF:pp

 

SPECIAL ASSISTANT AUDITORS

 

Our special assistant auditors for this engagement were Clifton Gunderson LLP.

 

 

DIGEST FOOTNOTES

 

 

#1:  LOCALLY HELD FUNDS REPORTING – Previous University Response

 

SAMS Procedure 33.13.20 requires the University to file its Report on Locally Held Funds for the quarter ended June 30 by July 31.  The University is in compliance with Procedure 33.13.20.  Adjustments to cash and investments occur after the July 31 deadline and these adjustments are included in the financial statements submitted to the Comptroller’s Office.  The University will comply with the recommendation but notes that it still will not be in compliance as the original Form C17 will still be required to be revised after the initial filing.  Changing the SAMS Procedure 33.13.20 reporting deadline for the quarter ended June 30 to match the GAAP package deadline would eliminate the need for multiple filings by all State agencies.