REPORT DIGEST SOUTHERN ILLINOIS UNIVERSITY Single Audit and Compliance Examination For the Year Ended: June 30, 2015 Release Date: March 17, 2016 FINDINGS THIS AUDIT: 11 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 0 -- 0 -- 0 Category 2: 5 -- 5 -- 10 Category 3: 1 -- 0 -- 1 TOTAL: 6 -- 5 -- 11 FINDINGS LAST AUDIT: 7 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS IMPROPER REVIEW PROCEDURES OVER THE SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS - EDWARDSVILLE AND CARBONDALE CAMPUSES The University did not have proper procedures in place to ensure the Schedule of Expenditures of Federal Awards (SEFA) and Notes to the SEFA contained proper information. On each campus, federal award accounts were not completely closed out in a timely manner causing extraneous entries on the SEFA during subsequent years. During our review of the Carbondale campus SEFA for fiscal year 2015, we noted expenditures reported for awards that were past the award end date. 43 federal awards with expired award end dates were noted during review. The award expiration dates occurred as follows: • 12 of the 43 awards ended in the fiscal year ended June 30, 2013 • 31 of the 43 awards ended in the fiscal year ended June 30, 2014 During our review of the Edwardsville campus SEFA for fiscal year 2015, we noted expenditures reported awards that were past the award end date. 17 federal awards with expired award end dates were noted during review. The award expiration dates occurred as follows: • 2 of the 17 awards ended in the fiscal year ended June 30, 2011 • 6 of the 17 awards ended in the fiscal year ended June 30, 2012 • 6 of the 17 awards ended in the fiscal year ended June 30, 2013 • 3 of the 17 awards ended in the fiscal year ended June 30, 2014 Finally, during review of the Notes to the SEFA for subrecipients, it was noted that vendor payments were included in the amount reported as subrecipients. (Finding 2, pages 18-20) We recommended the University implement review policies and procedures to ensure the SEFA and Notes to the SEFA are accurate and contain complete information. University officials accepted our recommendation and indicated they would take the necessary steps to ensure the accuracy of the SEFA and supporting documentation. ERRORS IN ENROLLMENT REPORTING FOR NATIONAL STUDENT LOAN DATA SYSTEM - EDWARDSVILLE AND CARBONDALE CAMPUSES Error records returned by the National Student Loan Data System (NSLDS) were not corrected and resubmitted within the required 10 days. The University is required to confirm and report to the NSLDS the enrollment status of students who receive Federal student loans. The Carbondale and Edwardsville campuses use a third-party vendor to process their enrollment reporting to the NSLDS. During the year, the vendor had internal control issues that prevented them from correcting error records and returning them to the Secretary within the required 10 days. The vendor acknowledged these issues in their 2015 compliance attestation report dated October 30, 2015. Neither campus had a process in place to oversee the work provided by the vendor to timely determine that the error records were not corrected and returned within 10 days. (Finding 3, pages 21-22) We recommended the University implement formalized review procedures to verify that NSLDS error records are corrected and returned timely to the Secretary. University officials accepted our recommendation and indicated they are exploring ways to timely detect and remedy noncompliance. INADEQUATE REVIEW OVER PARTICIPANT ELIGIBILITY APPLICATIONS FOR THE TRIO UPWARD BOUND PROGRAM - EDWARDSVILLE CAMPUS The Edwardsville campus did not have proper review procedures in place to determine participant eligibility in the TRIO Upward Bound programs at the East St. Louis campus. During our testing of participant eligibility for the Upward Bound programs, we noted that several applications did not contain sufficient documentation to determine eligibility and/or there was a lack of evidence of proper review before the participant was accepted into the program. During our test work of 40 participant files for the Upward Bound programs, we noted 6 participant files that contained conflicting eligibility support or improper review procedures. • In three cases, sufficient documentation was not included in the participant application to support potential first generation college student classification. • In one case, a complete participant application was not received or reviewed before the student was accepted into the program. • In two cases, participant applications were not reviewed and signed by the program director before the participant was accepted into the program. (Finding 5, pages 25-27) We recommended the University implement the necessary controls to properly identify eligible participants for the Upward Bound programs. University officials accepted our recommendation and indicated additional measures have been implemented to ensure the program director is more actively involved in the application review process. WEAKNESSES IN COMPUTER INVENTORY CONTROL The University was unable to locate 1,068 computers (579 from Carbondale and 489 from Edwardsville) during their annual inventory. These items were noted as missing by University staff during a system-wide inventory cleanup effort conducted on its campuses during fiscal year 2015. The original cost of these items total $1,477,354.38. The computers noted as missing represent 3.6% percent of the University’s total computer inventory at June 30, 2015. During testing, the auditors noted the University had not protected its computers with encryption software in the past, thus increasing the risk that confidential information could be exposed on the missing computers identified in this finding. The University performed procedures to determine whether the missing computers contained confidential information and based on the procedures performed they did not identify any instances where confidential information was exposed. Confidential information routinely collected and maintained by the University includes education records, health records, personal information, and sensitive information. The University performed a formal risk assessment of computer equipment in their possession to identify all computer equipment that contained confidential information during fiscal year 2015. For computer equipment in their possession identified with confidential information the University took corrective action to encrypt or protect confidential information identified on the computer equipment going forward. (Finding 8, pages 32-33) This finding was first reported in 2012. We recommended the University: • Review current practices to determine if enhancements can be implemented to prevent the theft or loss of computers. • Continue to evaluate and secure new computers as necessary to ensure that confidential information is protected. University officials accepted our recommendation and indicated they had implemented corrective action by inventorying all computer equipment and encrypted all laptops with sensitive or personally identifiable information in fiscal year 2015. (For previous University response, see Digest Footnote #1) NONCOMPLIANCE WITH THE SOUTHERN ILLINOIS UNIVERSITY MANAGEMENT ACT (ILLINOIS ETHANOL RESEARCH ADVISORY BOARD) Southern Illinois University (SIU) did not manage the National Corn-to-Ethanol Research Pilot Plant (Pilot Plant) under the review and guidance of the Illinois Ethanol Research Advisory Board (Advisory Board). The Advisory Board has not met in three years due to not having a quorum on the Advisory Board because all six of the Governor appointed positions to the Advisory Board have expired terms. As a result of not meeting in three years, the Advisory Board is not performing its duties of providing review and guidance to the SIU Board of Trustees to assist in operating and managing the Pilot Plant as required by State statute. However, SIU Edwardsville has continued to manage the Pilot Plant under the guidance of a stakeholders group, which was established in the absence of the Governor appointed Advisory Board. The Advisory Board shall have the following duties: • Review of annual operating plans and budget of the National Corn-to-Ethanol Research Pilot Plant, • Advising on research and development priorities and projects to be carried out at the Pilot Plant, • Advising on policies and procedures regarding the management and operation of the Pilot Plant, • Developing bylaws, • Submitting a final report to the Governor and General Assembly outlining the progress and accomplishments made during the year along with a financial report for the year, • Establishing and operating the Pilot Plant with purposes and goals including conducting research, providing training, consulting, developing demonstration projects and serving as an independent resource to the ethanol industry The last documented contact with the Governor’s Office was on October 3, 2015. The Research Center opened in fiscal year 2004 and the Advisory Board has developed by-laws. (Finding 11, pages 37-38) We recommended the University continue to work with the Governor’s Office of Executive Appointments to fill the vacancies in the Advisory Board so it can perform its duties under the Act. University officials agreed with our recommendation and indicated they would continue to work with the Governor’s Office of Executive Appointments to fill the vacancies in the Advisory Board. OTHER FINDINGS The remaining findings are reportedly being given attention by the University. We will review the University’s progress towards the implementation of our recommendations in our next engagement. AUDITOR’S OPINION The financial audit was previously released. The auditors stated the financial statements of Southern Illinois University as of and for the year ended June 30, 2015, are fairly stated in all material respects. The auditors also conducted a Single Audit of the University as required by OMB Circular A-133. Our auditors stated the University complied, in all material respects, with the types of compliance requirements that could have a direct and material effect on each of the University’s major federal programs for the year ended June 30, 2015. ACCOUNTANT’S OPINION The accountants conducted a compliance examination of the University for the year ended June 30, 2015, as required by the Illinois State Auditing Act. The auditors stated the University complied, in all material respects, with the requirements described in the report. FRANK J. MAUTINO Auditor General FJM:JAF SPECIAL ASSISTANT AUDITORS Our Special Assistant Auditors for this engagement were CliftonLarsonAllen LLP. DIGEST FOOTNOTES #1 - WEAKNESSES IN COMPUTER INVENTORY CONTROL Partially implemented. In early fiscal year 2015, SIU began the process of inventorying all computer equipment (computers, servers, tablets and mobile hard drives). A sweep of all buildings is complete; approximately 226 buildings in Carbondale, Edwardsville, Alton and East St. Louis. The SIUE campus is nearing the final phase of this project. The SIUC campus computer inventory project ended on January 30th. The follow-up to this project will be done during the annual equipment inventory. As inventories are completed, they will be compared to the computer inventory records to identify differences. The expected completion date of the corrective action on the inventory project is June 30, 2015. The encryption efforts are also underway on each campus; however, it was necessary to extend the estimated timeframe for completion due to the significant resources needed and other priorities.