Audit Report University System of Maryland Bowie State University September 2001
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Audit Report
University System of Maryland Bowie State University
September 2001
This report and any related follow-up correspondence are available to the public and may be obtained by contacting the Office of Legislative Audits or the Department of Legislative Services - Office of the Executive Director, 90 State Circle, Annapolis, Maryland. Alternate formats may be requested by contacting the Office of Legislative Audits at 410-946-5900, 301-970-5900 (voice), or 1-877- 486-9964 (toll-free voice), 410-946-5999 or 301-970-5999 (fax), and 1-800-735-2258 (Maryland Relay Service). Audit reports can also be viewed or downloaded from the Internet. Our web site address is http://www.ola.state.md.us/.
September 28, 2001 Delegate Samuel I. Rosenberg, Co-Chair, Joint Audit Committee Senator Nathaniel J. McFadden, Co-Chair, Joint Audit Committee Members of Joint Audit Committee Annapolis, Maryland Ladies and Gentlemen: We have audited the University System of Maryland, Bowie State University for the period beginning March 4, 1998 and ending January 7, 2001. Our audit disclosed that certain expenditures incurred by credit cards and for cellular telephone charges were not subject to review and approval by supervisory personnel. These expenditures included a number of questionable charges for which the University could not substantiate the business nature of the transactions. Furthermore, we noted a number of internal control and record keeping deficiencies in such areas as disbursements, computer security, cash receipts, student accounts receivable and equipment. For example, the University had not established adequate procedures to ensure that certain cash receipts were deposited timely and properly controlled, nor had the University reconciled its detailed student accounts receivable records to the corresponding balance in the general ledger.
Respectfully submitted, Bruce A. Myers, CPA Legislative Auditor
2
(This Page Intentionally Left Blank)
3
Table of Contents Executive Summary 5 Background Information 7
Agency Responsibilities 7 Current Status of Findings From Preceding Audit Report 7
Findings and Recommendations 9 Disbursements
Finding #1 – Proper Internal Controls Were Not Established Over Certain 9 Credit Card and Cellular Telephone Charges Resulting in Questionable Expenditures
* Finding #2 – Proper Internal Controls Were Not Established Over 10 Disbursement Transactions
Computer Security * Finding #3 – Monitoring of Access to Critical Resources and Password 11
Control Need Improvement Cash Receipts * Finding #4 – Adequate Controls Were Not Established Over Certain 12
Collections Student Accounts Receivable
Finding #5 – Accounts Were Not Submitted for Collection as Required 13 Finding #6 – Reconciliations of Control and Detail Records were 13
Inadequate Equipment * Finding #7 - Records Were Not Adequately Maintained 14
Audit Scope, Objectives, and Methodology 17 Agency Response Appendix
* Denotes item repeated in full or part from preceding audit.
4
(This Page Intentionally Left Blank)
5
Executive Summary
Legislative Audit Report on the University System of Maryland Bowie State University
September 2001
• The University did not establish adequate procedures to review and approve charges made on certain credit cards assigned to senior management employees or charges incurred as a result of cellular telephones assigned to various University employees. We noted numerous charges for items that appeared to be of a personal nature and for which the University could not substantiate the business nature of the expenditures.
The University should require all credit card and cellular telephone charges to be subject to independent supervisory review and approval to help ensure that the charges are valid expenditures of the University.
• The University did not establish independent on-line approval
requirements for all critical disbursement transactions. This resulted in disbursements totaling $5.4 million being processed without independent on-line approval. The University should fully utilize available security features by establishing independent on-line approval requirements for all critical disbursement transactions.
• The University did not adequately monitor access to critical computer
resources.
The University should ensure that critical computer access is adequately monitored.
• Other procedural and record keeping deficiencies were noted with
respect to cash receipts, student accounts receivable and equipment. For example, the University had not established adequate procedures to ensure that certain cash receipts were deposited timely and properly controlled.
The University should take the recommended actions to improve procedures and record keeping in these areas.
6
(This Page Intentionally Left Blank)
7
Background Information Agency Responsibilities Bowie State University is part of the University System of Maryland. The University provides a broad range of baccalaureate, masters and doctoral programs. The University’s student population exceeds 4,800 students. Current Status of Findings From Preceding Audit Report Our audit included a review to determine the current status of the 10 fiscal/compliance findings contained in our preceding audit report dated February 17, 1999. We determined that the University satisfactorily addressed six of these findings. The remaining four findings are repeated in this report. In its response to our preceding audit report, the University generally agreed to implement the recommendations related to those findings.
8
(This Page Intentionally Left Blank)
9
Findings and Recommendations Disbursements Finding #1 Certain credit card and cellular telephone charges were not subject to independent supervisory review and approval. Furthermore, we noted numerous credit card and cellular telephone charges that were questionable. Analysis The University had not established adequate procedures to review and approve charges made on five credit cards that were issued to senior management employees in October 2000 for travel and business expenses. Charges on these credit cards for the period from October 2000 to May 2001 totaled $51,569. In addition, reviews of charges to the University’s 32 cellular telephones were not always performed as required. The charges on these phones totaled approximately $30,000 from July 2000 to May 2001. We noted numerous charges on these credit cards and cellular telephones that appeared to be of a personal nature and there was no evidence on file to substantiate the business nature of the charges. For example, the following charges were paid by the University and were not reimbursed by the employees incurring the charges: • Two credit cards were routinely used by two senior management employees
for travel from Baltimore to their states of residence prior to employment at the University. These travel expenses included airfare, rental car, and taxicab charges totaling $3,882. The University had previously paid relocation expenses to these two management employees at the time they were hired. Furthermore, these two credit cards were used for travel costs such as airfare, lodging, and rental cars totaling $1,437 associated with an out-of-state trip to attend a personal function.
• Credit cards were frequently used for restaurant charges that were not
adequately documented in accordance with University policy that requires all charges for meals greater than $25 be documented to describe the purpose of the meal and list the individuals in attendance. For example, we noted such a charge totaling $601 in April 2001 for a local restaurant without any of the documentation required by the University’s policy.
10
• An administrative assistant incurred cellular telephone charges totaling $2,378
during March and April 2001. Although this employee advised us that all of these calls were business related, we noted that a significant number of calls (453 of 1,964 calls) were made or received between Friday evening and Sunday night when the University’s business offices were closed. Furthermore, we noted that 44 of the calls during April 2001 were made or received between 12:00 a.m. and 6:00 a.m.
Recommendation #1 We recommend that the University ensure that all credit card and cellular telephone charges are subject to independent supervisory review and approval. In addition, we recommend that the University take action to ensure that the cards and telephones are not used for personal purposes. Furthermore, we recommend that the University review all charges processed to date, obtain reimbursement for any expenditures that are of a personal nature, and take any disciplinary action considered appropriate. Finding #2 Proper internal controls were not established over the processing of certain disbursement transactions. Analysis The University did not fully use the security features available to establish proper internal controls over disbursements. Consequently, unauthorized transactions could be processed that may not be readily detected. During fiscal year 2000, the University processed disbursements totaling approximately $19.9 million, which were ultimately processed through the State’s Financial Management Information System. Independent on-line approvals were not established for critical disbursement transactions. Specifically, two employees could both initiate and process certain disbursement transactions without being subject to independent approval and could release disbursement transactions to the Comptroller of the Treasury – General Accounting Division for payment. During the period from July 1, 2000 to January 7, 2001, these employees both initiated and approved disbursement transactions totaling approximately $5.4 million. A similar situation was commented upon in our preceding audit report.
11
Recommendation #2 We again recommend that the University fully utilize the available security features by establishing independent on-line approval requirements for all critical disbursement transactions. Computer Security Finding #3 The University’s monitoring of access to critical computer resources and password control need improvement. Analysis The University’s monitoring of access to critical computer resources and password control need improvement. The University’s Office of Information Technology operates a computer network that includes a minicomputer for financial applications and student grades, Internet connectivity, two firewalls and servers for email and remote access. The University’s firewalls help protect network resources from Internet based intrusions and risks, while logging sensitive events. Our review disclosed the following: • Fifteen minicomputer users were given necessary direct access to critical
production files. The security software logged all accesses to these critical files by these 15 users. However, the University’s security officer did not review the security reports of these logged accesses. Similar conditions have been commented upon in our three preceding audit reports.
• We were advised that the University’s two network firewall logs were only
reviewed as time permitted. As a result, a significant number of log entries were not reviewed. Also, the reviews performed were not documented. Accordingly, there was a lack of assurance that sensitive actions, such as changes to the firewall configuration, were identified for follow up and review.
• Minimum password lengths on the administrative minicomputer, two firewall
devices and the remote access server were either three or five characters. These enforced minimum password lengths were not adequate for effective security and control, since shorter passwords are much more easily compromised than longer passwords.
12
Recommendation #3 We again recommend that the University improve minicomputer security by reviewing security reports of logged direct accesses to critical production files. We also recommend that all firewall logging information be reviewed for significant events. The University should document all reviews and investigations performed and retain the information for audit verification. Finally, we recommend that the password lengths on the University’s minicomputer, two firewall devices, and remote access server be increased to at least eight characters. Cash Receipts Finding #4 The University had not established procedures to ensure that certain collections were deposited timely and properly controlled. Analysis Collections initially received by one University location, which totaled approximately $390,000 during fiscal year 2001, were not deposited in a timely manner or adequately controlled. Specifically, we noted the following deficiencies: • Our test of 20 receipts collected at that location during fiscal years 2000 and
2001 totaling $265,860 disclosed that 10 receipts totaling $209,519 were not forwarded to the University’s accounting office for deposit for periods ranging from 5 to 36 days after they were received.
• Independent verifications were not performed for collections initially received
at that location to ensure that all receipts received were subsequently forwarded to the University’s accounting office for further processing and deposit.
The Comptroller of the Treasury’s Accounting Procedures Manual requires that receipts be deposited no later than the first business day after receipt and that an employee independent of the cash receipts function trace collections from initial point of recordation to the related validated deposit slip. A similar situation concerning deposit verifications by another University location was commented upon in our preceding audit report.
13
Recommendation #4 We recommend that the University ensure that all collections received are deposited in a timely manner. In addition, we again recommend that an employee independent of the cash receipts function verify that the University’s accounting office received all recorded collections from other locations and that these verifications be documented. We have advised the University on accomplishing the necessary separation of duties utilizing existing personnel. Student Accounts Receivable Finding #5 Delinquent student accounts were not transferred to the Department of Budget and Management’s Central Collection Unit as required. Analysis The University did not transfer certain delinquent student accounts to the Department of Budget and Management’s Central Collection Unit in accordance with the University’s approved deviation from the Unit’s policy. Our test of 30 delinquent student accounts totaling $119,822 disclosed that 6 accounts totaling $21,081 had been outstanding for periods of up to 11 months after the required dates of transfer. The University’s deviation from the Unit’s policy requires that delinquent accounts be transferred to the Unit at the end of the late registration period for the subsequent semester. The University’s student accounts receivable totaled approximately $7.5 million as of January 12, 2001, of which $1.5 million was at least 90 days old. Recommendation #5 We recommend that the University forward delinquent accounts to the Department of Budget and Management’s Central Collection Unit in accordance with the Unit’s requirement. Finding #6 Adequate reconciliations of student accounts receivable records were not performed. Analysis The University had not adequately reconciled the aggregate balances of its detail student accounts receivable records with the corresponding balance in the general
14
ledger during our audit period. Although the University generated a monthly report that identified the differences between these two records, the differences identified were not investigated and resolved. Our review of the aforementioned monthly reports from January to June 2001 disclosed that the University identified significant differences. For example, the June 2001 reconciliation included an unreconciled difference in excess of $1 million (the general ledger balance exceeded the aggregate balance of the detail accounts). Recommendation #6 We recommend that the University periodically reconcile the aggregate balance of its detail student accounts receivable records with the corresponding balance recorded in the general ledger. We also recommend that any differences identified be promptly investigated and resolved, and that this reconciliation process be documented. Equipment Finding #7 Equipment records were not adequately maintained and equipment balances were not accurately reported to the University System of Maryland Office. Analysis The University’s equipment records were not adequately maintained and the year-end balance of capital equipment was not accurately reported. As of January 30, 2001, the book value of the University’s capital and non-capital equipment, as recorded in the University’s records, totaled approximately $8.4 million. Specifically, we noted the following: • The University did not maintain an equipment control account as required by
the University System of Maryland’s Policy for Capitalization and Inventory Control.
• The University’s detail equipment records were not always complete as
required by the aforementioned Policy. Specifically, these records were not always updated to reflect additions and the complete results of physical inventories. For example, our test of 49 equipment purchases during fiscal years 2000 and 2001 totaling $96,825 disclosed that 20 purchases totaling $29,637 were either not recorded in the detail records or were recorded with no cost.
15
• The University reported to the University System of Maryland Office that its
year-end balance of capital equipment (items with a unit value of $5,000 or more) totaled approximately $2.8 million as of June 30, 2000 even though the University’s detail equipment records only reflected an aggregate balance totaling approximately $2.5 million. The University could not explain the reason for the $300,000 difference between the amount reported and its records.
A similar situation concerning the adequacy of the University’s detail equipment records has been commented upon in our three preceding audit reports. Recommendation #7 We recommend that the University maintain an equipment control account independent of the detail records and that the control account balance be periodically reconciled to the aggregate balance of the detail records. In addition, we again recommend that the University ensure that equipment acquisitions are properly recorded in its detail records. Furthermore, we recommend that the University accurately report its year-end capital equipment balance to the University System of Maryland Office.
16
(This Page Intentionally Left Blank)
17
Audit Scope, Objectives, and Methodology We have audited the University System of Maryland - Bowie State University for the period beginning March 4, 1998 and ending January 7, 2001. The audit was conducted in accordance with generally accepted government auditing standards. As prescribed by the State Government Article, Section 2-1221 of the Annotated Code of Maryland, the objectives of this audit were to examine the University’s financial transactions, records and internal control, and to evaluate its compliance with applicable State laws, rules, and regulations. We also determined the current status of the findings included in our preceding audit report. In planning and conducting our audit, we focused on the major financial related areas of operations based on assessments of materiality and risk. Our audit procedures included inquiries of appropriate personnel, inspection of documents and records, and observation of the University’s operations. We also tested transactions and performed other auditing procedures that we considered necessary to achieve our objectives. Our audit did not include certain support services (such as endowment accounting and bond financing) provided to the University by the University System of Maryland Office. These support services are included within the scope of our audit of the University System of Maryland Office. In addition, we did not audit the University’s Federal financial assistance programs for compliance with Federal laws and regulations because the University System of Maryland Office engages an independent accounting firm to annually audit such programs administered by components of the System. The University’s management is responsible for establishing and maintaining effective internal control. Internal control is a process designed to provide reasonable assurance that objectives pertaining to the reliability of financial records, effectiveness and efficiency of operations including safeguarding of assets, and compliance with applicable laws, rules, and regulations are achieved. Because of inherent limitations in internal control, errors or fraud may nevertheless occur and not be detected. Also, projections of any evaluation of internal control to future periods are subject to the risk that conditions may change or compliance with policies and procedures may deteriorate.
18
Our reports are designed to assist the Maryland General Assembly in exercising its legislative oversight function and to provide constructive recommendations for improving State operations. As a result, our reports generally do not address activities we reviewed that are functioning properly. This report includes findings relating to conditions that we consider to be significant deficiencies in the design or operation of internal control that could adversely affect the University’s ability to maintain reliable financial records, operate effectively and efficiently, and comply with applicable laws, rules, and regulations. Our report also includes findings regarding significant instances of noncompliance with applicable laws, rules or regulations. The response from the University System of Maryland Office, on behalf of the University, to our findings and recommendations, is included as an appendix to this report. As prescribed in the State Government Article, Section 2-1224 of the Annotated Code of Maryland, we will advise the System regarding the results of our review of its response.
RESPONSE TO THE LEGISLATIVE AUDIT REPORT UNIVERSITY SYSTEM OF MARYLAND
BOWIE STATE UNIVERSITY MARCH 4, 1998 TO JANUARY 7, 2001
2
Disbursements Finding # 1 Certain credit card and cellular telephone charges were not subject to independent supervisory review and approval. Furthermore, we noted numerous credit card and cellular telephone charges that were questionable. The University agrees with the recommendations. The President and the Internal Auditor are reviewing the charges on the credit card on a monthly basis and the President will approve the charges. The procedures relating to the credit card have been revised to clearly state that the card is issued for business use only and the procedures will be enforced. Current charges relating to use of cellular phones are reviewed and certified as valid business calls by the immediate supervisor of the employee to whom the cellular phone is assigned and returned to the Office of Telecommunications, in accordance with existing procedures for telephones. The University is reviewing and reevaluating the practice of providing cellular telephones to University employees to determine if this practice is cost effective and beneficial to the University. As a result of the reevaluation, some cell phones have been cancelled and the decision on others is being finalized.
The reviews of all charges on the credit cards and cellular phones from date of issue through June 2000 are in progress and are anticipated to be complete by October 31, 2001. Based on the findings of the review, the University will seek reimbursement for any personal expenses identified and will take disciplinary action, if that is determined to be appropriate. Finding # 2 Proper internal controls were not established over the processing of certain disbursement transactions. The University agrees with the recommendation. The Controller’s Office will make better use of the available security features in the FMIS system. The two employees identified will no longer have the capability to release disbursement transactions. This function will be the responsibility of appropriate supervisory employees.
RESPONSE TO THE LEGISLATIVE AUDIT REPORT UNIVERSITY SYSTEM OF MARYLAND
BOWIE STATE UNIVERSITY MARCH 4, 1998 TO JANUARY 7, 2001
3
Computer Security Finding # 3 The University's monitoring of access to critical computer resources and password control need improvement. The University agrees with the recommendations. To improve minicomputer security, the University has established procedures to ensure a more effective review of security reports of logged direct accesses to critical production files to specifically identify and investigate significant events. University network personnel are routinely reviewing the firewall logging information. These reviews and investigations are documented and the documentation will be retained for audit verification. The University has increased the password lengths on the administrative computer, remote access server and two firewall devices to at least eight characters. Cash Receipts Finding # 4 The University had not established procedures to ensure that certain collections were deposited timely and properly controlled. The University agrees with the recommendations. Wiseman Centre deposits are being made with the central cashier no later than the first business day after the Wiseman Centre Office receives payments. On a weekly basis, the Assistant Director of Wiseman Centre, who is independent of the cash receipts function, is verifying that all recorded receipts have been deposited and is documenting the verification process. The procedures have been implemented. Student Accounts Receivable Finding # 5 Delinquent student accounts were not transferred to the Department of Budget and Management's Central Collection Unit as required. The University agrees with the recommendation. The University will forward delinquent accounts to the Department of Budget and Management's Central Collection Unit in accordance with accordance with the University’s approved deviation from the Unit’s policy.
RESPONSE TO THE LEGISLATIVE AUDIT REPORT UNIVERSITY SYSTEM OF MARYLAND
BOWIE STATE UNIVERSITY MARCH 4, 1998 TO JANUARY 7, 2001
4
Finding # 6 Adequate reconciliations of student accounts receivable records were not performed. The University agrees with the recommendations. The Controller's Office is now reconciling the detail student accounts receivable records with the corresponding record maintained on FRS subsequent to the monthly close. The explanation and resolution of any difference noted is documented. Equipment Finding # 7 Equipment records were not adequately maintained and equipment balances were not accurately reported to the University System of Maryland Office. The University agrees with the recommendations. Material Management has established an equipment control account for capital and sensitive equipment. The Materials Manager, who does not maintain the detail records, maintains the control account. The Material Manager will reconcile the control account to the aggregate balance of the detail records at least monthly and the reconciliation will be documented. The year-end balance of capital equipment has been reported for FY 2001 and correctly reflects the total value of capital equipment recorded in the year end capital property detail report.
Related Documents
