REPORT DIGEST NORTHERN ILLINOIS UNIVERSITY COMPLIANCE EXAMINATION AND SINGLE AUDIT FOR THE YEAR ENDED JUNE 30, 2017 Release Date: March 29, 2018 FINDINGS THIS AUDIT: 14 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 2 -- 1 -- 3 Category 2: 7 -- 4 -- 11 Category 3: 0 -- 0 -- 0 TOTAL: 9 -- 5 -- 14 FINDINGS LAST AUDIT: 12 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION This digest covers our federal Single Audit and Compliance Examination of the Northern Illinois University for the year ended June 30, 2017. A separate Financial Audit as of and for the year ended June 30, 2017, was previously released on March 15, 2018. In total, this report contains 14 findings, four of which were reported in the Financial Audit. SYNOPSIS • (17-07) The University did not comply with regulations regarding outstanding refund checks. • (17-08) The University has not established adequate internal controls over contracts to ensure they are approved prior to performance and comply with all applicable State requirements. • (17-10) The University did not fully comply with requirements applicable to its property and equipment. • (17-12) The University has inadequate internal controls in place to monitor and maintain the accounts payable master vendor file. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS OUTSTANDING REFUND CHECKS Northern Illinois University (University) did not comply with regulations regarding outstanding refund checks. We noted the University is not returning funds to the U.S. Department of Education within the required timeframe. In 3 of 40 items tested, from a statistically valid sample, we noted the University did not return $6,077 of funds to the U.S. Department of Education. (Finding 7, page 27) We recommended the University establish and maintain internal controls to ensure outstanding refund checks are returned to the U.S. Department of Education in accordance with program regulations. University officials accepted the recommendation. INADEQUATE INTERNAL CONTROLS OVER CONTRACTS The University has not established adequate internal controls over contracts to ensure they are approved prior to performance and comply with all applicable state requirements. During our review of 40 contracts for the year ended June 30, 2017, we noted the following: • 4 contracts (10%) were missing one or more of the required certifications or clauses. • 7 contracts (18%) were not approved prior to goods or services being provided. The contract execution dates ranged from 16 to 55 days from the commencement of service. • 9 contracts (23%) did not have a contract obligation document filed with the Illinois State Comptroller’s Office. Each contract contained an order for delivery that exceeded $20,000. • 10 contracts (25%) contained a contract obligation document that was not filed within 30 days of contract execution. The contract obligation documents were filed between 2 and 402 days late. • 2 of 19 contracts (11%) requiring the Financial/Conflict of Interest Disclosure Forms were missing. (Finding 8, pages 28-29). This finding has been repeated since 2012. We recommended the University establish and maintain internal control procedures to ensure contracts are complete and properly approved prior to performance. University officials accepted the recommendation. (For the previous University response, see Digest Footnote #1.) INADEQUATE CONTROLS OVER PROPERTY AND EQUIPMENT Northern Illinois University (University) did not fully comply with requirements applicable to its property and equipment. We reviewed the University’s property inventory certification as of November 29, 2016 which was submitted to the Department of Central Management Services (DCMS). The inventory certification to DCMS reported 1,288 items ($1,624,740) of equipment that could not be located by the University. These assets were acquired by the University during past fiscal years. Included in this listing were approximately 520 computers, servers, CPUs, or other electronic storage devices. (Finding 10, page 31) This finding has been repeated since 2015. We recommended the University continue to strengthen its internal controls over the accountability of University property. University officials accepted the recommendation. (For the previous University response, see Digest Footnote #2.) INADEQUATE PROCEDURES OVER MAINTENANCE OF THE ACCOUNTS PAYABLE MASTER VENDOR FILE Northern Illinois University (University) has inadequate internal controls in place to monitor and maintain the accounts payable master vendor file. The University’s accounts payable master vendor file had 46,007 active vendors that included 35,757 suppliers, 5,372 employees and 4,878 students as of June 30, 2017. During our review of the master vendor file, we noted the following: • There were 35,610 (77%) active vendors with no activity in the past 2 years; 24,447 (53%) active vendors with no activity in the past 5 years; and 2,987 (7%) active vendors with no activity in the past 10 years. • The master vendor file included 717 (1.6%) vendors to which there has never been a payment. • There was one active vendor with 198 different addresses approved for payment; another 27 active vendors with over 25 different addresses approved for payment and another 582 active vendors with over 5 different addresses approved for payment. Effective internal controls include a periodic review and deactivation of vendors without activity for a reasonable amount of time. Further, the accounts payable aster vendor file should be maintained and reviewed periodically to ensure the completeness, accuracy and validity of the vendor master file data. (Finding 12, pages 33-34) We recommended the University review and enhance internal controls in order to appropriately monitor and maintain the accounts payable master vendor file. University officials accepted the recommendation. OTHER FINDINGS The remaining findings are reportedly being given attention by the University. We will review the University’s progress towards the implementation of our recommendations in our next Single Audit and State Compliance Examination. AUDITOR’S OPINION The financial audit report was previously released. The auditors stated the financial statements of the University as of and for the year ended June 30, 2017 are fairly stated in all material respects. The auditors also conducted a Single Audit of the Agency as required by the Uniform Guidance. The auditors stated the University complied, in all material respects, with the types of compliance requirements that could have a direct and material effect on the University’s major federal programs for the year ended June 30, 2017. ACCOUNTANT’S OPINION The accountants conducted a compliance examination of the University for the year ended June 30, 2017, as required by the Illinois State Auditing Act. The accountants qualified their report on State Compliance for Findings 2017-001, 2017-002 and 2017-003. Except for the noncompliance described in these findings, the accountants stated the University complied, in all material respects, with the requirements described in the report. This Single Audit and State Compliance Examination was conducted by CliftonLarsonAllen LLP. Jane Clark Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:TLK DIGEST FOOTNOTES #1 – Inadequate Internal Controls Over Contracts – Previous University Response 2016: The University accepts the Auditor’s recommendation. Management has conducted a comprehensive review of each component of this finding and is taking the following corrective actions that will eliminate material exception: 1) Develop terms and conditions boilerplate for purchase orders, which reference attestation to all state-mandated certifications, and revise current certification form in the University’s request for proposal and invitation to bid forms to cover adherence to all other certifications that may not be included in the State’s form. 2) Receive clarification of SAMs Manual from IL Comptroller’s Office on the filing of contract obligations documents as relates to services. 3) The process for reviewing and negotiating Architectural, Engineering, and Land Surveying Qualifications Based selection contracts has been revamped to ensure all files are complete. 4) Continue to develop and expand newly created contract management process to eliminate performance or delivery before contract. #2 – Inadequate Controls Over Property and Equipment – Previous University Response 2016: The University accepts the Auditor’s recommendation. The University will continue to review and amend its processes to strengthen control over University assets. The University will work to leverage technology and retrain staff to ensure accurate recording of assets and reporting of the C-15 report.