AUXILIARY ORGANIZATIONS SAN FRANCISCO STATE UNIVERSITY Audit Report 12-02 July 21, 2012 Henry Mendoza, Chair William Hauck, Vice Chair Lupe C. Garcia Steven M. Glazer Hugo N. Morales Glen O. Toney Members, Committee on Audit University Auditor: Larry Mandel Senior Director: Mike Caldera Audit Manager: Caroline Lee Senior Auditors: Gordon Eng, Jamarr Johnson, Dominick Owens, Kim Tran, and Salesian Yuen Internal Auditor: Gina Yi Staff BOARD OF TRUSTEES THE CALIFORNIA STATE UNIVERSITY
CONTENTS Executive Summary... 1 Introduction... 6 Background... 6 Purpose... 8 Scope and Methodology... 8 OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES SAN FRANCISCO STATE UNIVERSITY FOUNDATION Operating and Administrative Agreements... 12 Fiscal Compliance... 13 Campus Oversight and Control... 14 Investments... 15 THE UNIVERSITY CORPORATION, SAN FRANCISCO STATE Corporate Governance... 16 Fiscal Compliance... 16 Property and Equipment... 17 Endowment Administration... 18 FRANCISCAN SHOPS, INC. Segregation of Duties... 20 Personnel and Payroll... 20 Property and Equipment... 21 Information Technology... 22 Payment Card Industry Data Security Standard... 22 Data Security and Assessment... 23 ii
CONTENTS ASSOCIATED STUDENTS OF SAN FRANCISCO STATE UNIVERSITY Fees, Revenues, and Receivables... 25 Property and Equipment... 26 SAN FRANCISCO STATE UNIVERSITY STUDENT CENTER, INC. Operating and Administrative Agreements... 28 Cash Receipts and Handling... 29 Cashiering... 29 Uncleared Collections... 30 Fees, Revenues and Receivables... 31 Personnel and Payroll... 32 Employee Separation... 32 Student Employees... 33 Information Technology... 34 iii
CONTENTS APPENDICES APPENDIX A: APPENDIX B: APPENDIX C: APPENDIX D: Personnel Contacted Statement of Internal Controls Campus Response Chancellor s Acceptance ABBREVIATIONS ABS AS CFO COO Corporation CSU DSS EO Foundation ICSUAM PCI RFIN SAQ SFSU Shops Student Center Auxiliary Business Services Associated Students of San Francisco State University Chief Financial Officer Chief Operating Officer The University Corporation, San Francisco State California State University Data Security Standard Executive Order San Francisco State University Foundation Integrated California State University Administrative Manual Payment Card Industry Resolution of the Committee on Finance Self Assessment Questionnaire San Francisco State University Franciscan Shops, Inc. San Francisco State University Student Center, Inc. iv
EXECUTIVE SUMMARY In July 1981, the Board of Trustee policy concerning auxiliary organizations was adopted in the Resolution of the Committee on Finance (RFIN) 7-81-4. Executive Order 698, Board of Trustees Policy for The California State University Auxiliary Organizations, dated March 3, 1999, required that the Office of the University Auditor conduct internal compliance/internal control reviews of auxiliary organizations, and the Board of Trustees instructed that such reviews be conducted on a triennial basis pursuant to procedures established by the chancellor. San Francisco State University (SFSU) management is responsible for establishing and maintaining an adequate system of internal compliance/internal control and assuring that each of its auxiliary organizations similarly establishes such a system. This responsibility, in accordance with California Code of Regulations, Title 5, Section 42402 et seq. and Executive Order 698, Board of Trustees Policy for The California State University Auxiliary Organizations et seq., includes requiring the documentation of internal control, communicating requirements to employees, and assuring that its system of internal compliance/internal control is functioning as prescribed. In fulfilling this responsibility, estimates and judgments by management are required to assess the expected benefits and related costs of control procedures. The objectives of a system of internal compliance/internal control are to provide management with reasonable, but not absolute, assurance that: Auxiliary operations are conducted in accordance with policies and procedures established in the State Administrative Manual, Education Code, Title 5, and Trustee policy. Assets are adequately safeguarded against loss from unauthorized use or disposition. Transactions are executed in accordance with management s authorization and recorded properly to permit the timely preparation of reliable financial statements. We visited the SFSU campus and its auxiliary organizations from March 12, 2012, through April 20, 2012, and made a study and evaluation of the system of internal compliance/internal control in effect as of April 20, 2012. This report represents our triennial review. Our study and evaluation at San Francisco State University Foundation did not reveal any significant internal control problems or weaknesses that would be considered pervasive in their effects on the accounting and administrative controls. However, we did identify other reportable weaknesses that are described in the executive summary and in the body of the report. In our opinion, the accounting and administrative control in effect as of April 20, 2012, taken as a whole, was sufficient to meet the objectives stated above. Our study and evaluation at The University Corporation, San Francisco State did not reveal any significant internal control problems or weaknesses that would be considered pervasive in their effects on the accounting and administrative controls. However, we did identify other reportable weaknesses that are described in the executive summary and in the body of the report. In our opinion, the accounting and Page 1
EXECUTIVE SUMMARY administrative control in effect as of April 20, 2012, taken as a whole, was sufficient to meet the objectives stated above. Our study and evaluation at Franciscan Shops, Inc. did not reveal any significant internal control problems or weaknesses that would be considered pervasive in their effects on the accounting and administrative controls. However, we did identify other reportable weaknesses that are described in the executive summary and in the body of the report. In our opinion, the accounting and administrative control in effect as of April 20, 2012, taken as a whole, was sufficient to meet the objectives stated above. Our study and evaluation at Associated Students of San Francisco State University did not reveal any significant internal control problems or weaknesses that would be considered pervasive in their effects on the accounting and administrative controls. However, we did identify other reportable weaknesses that are described in the executive summary and in the body of the report. In our opinion, the accounting and administrative control in effect as of April 20, 2012, taken as a whole, was sufficient to meet the objectives stated above. Our study and evaluation at San Francisco State University Student Center, Inc. revealed certain conditions that, in our opinion, could result in errors and irregularities if not corrected. Specifically, the auxiliary did not maintain adequate control over the following areas: operating and administrative agreements, cash receipts and handling, fees, revenues, and receivables, and information technology. These conditions, along with other weaknesses, are described in the executive summary and in the body of the report. In our opinion, except for the effect of the weaknesses described above, accounting and administrative control in effect as of April 20, 2012, taken as a whole, was sufficient to meet the objectives stated above. As a result of changing conditions and the degree of compliance with procedures, the effectiveness of controls changes over time. Specific limitations that may hinder the effectiveness of an otherwise adequate system of controls include, but are not limited to, resource constraints, faulty judgments, unintentional errors, circumvention by collusion, and management overrides. Establishing controls that would prevent all these limitations would not be cost-effective; moreover, an audit may not always detect these limitations. The following summary provides management with an overview of conditions requiring their attention. Areas of review not mentioned in this section were found to be satisfactory. Numbers in brackets [ ] refer to page numbers in the report. SAN FRANCISCO STATE UNIVERSITY FOUNDATION OPERATING AND ADMINISTRATIVE AGREEMENTS [12] The San Francisco State University Foundation (Foundation) performed functions not authorized by its operating agreement with the California State University (CSU) Trustees. Page 2
EXECUTIVE SUMMARY FISCAL COMPLIANCE [13] The Foundation did not maintain board-designated reserves in accordance with its reserve policy. CAMPUS OVERSIGHT AND CONTROL [14] Foundation budgets for fiscal years 2010/11 and 2011/12 had not been approved by the campus president. INVESTMENTS [15] The Foundation s investment policy needed improvement. Specifically, the policy did not address investment return objectives, investment quality, and concentration of assets. THE UNIVERSITY CORPORATION, SAN FRANCISCO STATE CORPORATE GOVERNANCE [16] The University Corporation, San Francisco State (Corporation) had not filed amended Bylaws with the chancellor s office in a timely manner. FISCAL COMPLIANCE [16] The Corporation reserves for fiscal years 2009/10, 2010/11 and 2011/12 had not been approved by the campus president. PROPERTY AND EQUIPMENT [17] Administration of Corporation property and equipment needed improvement. Specifically, the Corporation had not accounted for all property and equipment during its last physical inventory, and one asset selected for physical inspection could not be located. ENDOWMENT ADMINISTRATION [18] Corporation administration of endowment spending accounts was not supported by a written agreement. FRANCISCAN SHOPS, INC. SEGREGATION OF DUTIES [20] Certain duties and responsibilities related to payroll and personnel processing were not appropriately segregated at the Franciscan Shops, Inc. (Shops). Page 3
EXECUTIVE SUMMARY PERSONNEL AND PAYROLL [20] The Shops did not always complete separation documentation for employees. PROPERTY AND EQUIPMENT [21] The Shops did not always document proper approval prior to disposal of fixed assets. INFORMATION TECHNOLOGY [22] The Shops did not fully address the Payment Card Industry Data Security Standard (PCI DSS) requirements. Specifically, a risk assessment had not been completed and documented to determine comprehensive compliance obligations for credit card data maintained on auxiliary servers, transmitted throughout the campus network, and stored manually in local files, and an annual PCI DSS Self Assessment Questionnaire was not completed. In addition, the Shops did not perform an assessment and inventory of protected data residing on their operations file server. ASSOCIATED STUDENTS OF SAN FRANCISCO STATE UNIVERSITY FEES, REVENUES, AND RECEIVABLES [25] Administration of Associated Students of San Francisco State University (AS) accounts receivable collections procedures needed improvement. Specifically, a delinquent account receivable was not adequately documented, and a long outstanding receivable was not written off in a timely manner. PROPERTY AND EQUIPMENT [26] Administration of AS fixed assets needed improvement. For example, proper approvals were not documented prior to the removal of assets, and disposed assets were not always removed from the fixed asset system. SAN FRANCISCO STATE UNIVERSITY STUDENT CENTER, INC. OPERATING AND ADMINISTRATIVE AGREEMENTS [28] The San Francisco State University Student Center, Inc. (Student Center) performed a function not authorized by its operating agreement with the CSU Trustees. CASH RECEIPTS AND HANDLING [29] Administration of Student Center cash receipts required improvement. Specifically, the Student Center did not log checks received in the mail that were not made payable to them, checks were exchanged with third parties without the use of transfer receipts, checks received at the information desk were not Page 4
EXECUTIVE SUMMARY restrictively endorsed immediately upon receipt, and a listing of individuals with access to the safe, along with the date the combination was last changed, was not maintained. In addition, procedures had not been developed for the administration of uncleared collections, and uncleared collection accounts were not always reviewed and cleared in a timely manner. FEES, REVENUES, AND RECEIVABLES [25] Administration of Student Center accounts receivable procedures needed improvement. Specifically, AS did not always maintain documentation on file to show evidence that accounts were pursued for collection prior to being written off. In addition, uncollectible accounts were not always written off in a timely manner. PERSONNEL AND PAYROLL [31] The Student Center did not complete separation documentation for student employees. In addition, the Student Center neither monitored nor documented approvals for student employees working more than 20 hours per week. INFORMATION TECHNOLOGY [34] Backup data for sensitive payroll information at the Student Center was stored on an external drive and was not safely secured in a locked cabinet or safe. Page 5
INTRODUCTION BACKGROUND Education Code 89900 states, in part, that the operation of auxiliary organizations shall be conducted in conformity with regulations established by the Trustees. Education Code 89904 states, in part, that the Trustees of the California State University (CSU) and the governing boards of the various auxiliary organizations shall: Institute a standard systemwide accounting and reporting system for businesslike management of the operation of such auxiliary organizations. Implement financial standards that will assure the fiscal viability of such various auxiliary organizations. Such standards shall include proper provision for professional management, adequate working capital, adequate reserve funds for current operations and capital replacements, and adequate provisions for new business requirements. Institute procedures to assure that transactions of the auxiliary organizations are within the educational mission of the state colleges. Develop policies for the appropriation of funds derived from indirect cost payments. The Board of Trustee policy concerning auxiliary organizations was originally adopted in July 1981 in the Resolution of the Committee on Finance (RFIN) 7-81-4. Executive Order 698, Board of Trustees Policy for The California State University Auxiliary Organizations, dated March 3, 1999, represents policy of the Trustees addressing CSU auxiliary organization activity and governing the internal management of the system. CSU auxiliary organizations are required to comply with Board of Trustee policy (California Code of Regulations, Title 5, Section 42402 and Education Code, Section 89900). This executive order requires that the Office of the University Auditor will perform an internal compliance/internal control review of auxiliary organizations. The review will be used to determine compliance with law, including statutes in the Education Code and rules and regulations of Title 5, and compliance with policy of the Board of Trustees and of the campus, including appropriate separation of duties, safeguarding of assets, and reliability and integrity of information. According to Board of Trustee instruction, each auxiliary organization shall be examined on a triennial basis pursuant to procedures established by the chancellor. San Francisco State University Foundation The San Francisco State University Foundation (Foundation) was established in July 2008 as a non-profit public benefit corporation. The Foundation supports San Francisco State University (SFSU) through fundraising, acceptance of donor gifts, and management of endowments. The Foundation is authorized to receive and process gifts, bequests, endowments, trusts, and other gifts, and to acquire and develop real property. The Foundation does not have employees and relies on the university s auxiliary business services (ABS) unit and university advancement personnel for accounting and administrative support Page 6
INTRODUCTION services. The Foundation is governed by a board of directors composed of community members, faculty, staff, students, alumni, and the campus president. The University Corporation, San Francisco State The University Corporation, San Francisco State (Corporation), formerly known as the San Francisco State University Foundation, Inc., was originally established in 1946. In June 2007, the Foundation was re-structured and began operating as a new non-profit public benefit corporation; thereafter it became known as the Corporation. The Corporation is responsible for the administration of projects and nonfederal funds it receives from outside sponsors, as well as SFSU campus programs and other trust and agency accounts. The Corporation also administers sublease agreements for food and vending services provided by third parties. The Corporation has a limited number of employees and relies on the university s ABS unit for accounting and administrative support services. The Corporation is governed by a board of directors composed of faculty, staff, alumni, and the campus president or his/her designee. Franciscan Shops, Inc. The Franciscan Shops, Inc. (Shops) was established in 1982 as a non-profit public benefit corporation, existing solely to provide excellent services and products for the benefit of SFSU students, staff, faculty, and the campus community. The Shops is responsible for commercial operations, including the bookstore, two convenience stores, and the copy center. The Shops performs all accounting in-house and is governed by a 12-member board of directors. Associated Students of San Francisco State University Associated Students of San Francisco State University (AS) was established in 1944 as a non-profit public benefit corporation responsible for providing programs and services integral to the university s educational mission. AS promotes student self-government and provides facilities and programs to satisfy the needs and interests of its members, including a child care center, legal resource center, women s center, and a typing center; an events production program; and other programs that provide various networking, counseling, and mentoring activities. AS also offers graduate and undergraduate scholarships. The AS relies on the university s ABS unit for accounting and administrative support services and is governed by a board of directors composed of representatives from the student body. San Francisco State University Student Center, Inc. The San Francisco State University Student Center, Inc. (Student Center) was opened on campus in 1975, established as an unincorporated association with 501(c)(3) status in 1976, and then incorporated as a non-profit public benefit corporation in 1996 with the specific and primary purpose of enhancing the educational, social, and cultural development of students, faculty, alumni, and staff of the university. The Student Center serves the student population by providing myriad services and programs, including restaurants, meeting rooms, a conference hall, a game room, automated teller machines, transit passes, art exhibits, concerts, and community-based events. In addition, space is leased to AS for administrative purposes. Fiscal and administrative functions are shared between the Student Center and the university s Page 7
INTRODUCTION ABS unit. The Student Center is governed by a board of directors composed of faculty, staff, alumni, and the campus president or his/her designee. PURPOSE The principal audit objectives were to determine compliance with the Education Code, Title 5, and directives of the Board of Trustees and the Office of the Chancellor and to assess the adequacy of controls and systems. Specifically, we sought assurances that: Legal and regulatory requirements are complied with. Accounting data is provided in an accurate, timely, complete, or otherwise reliable manner. Assets are adequately safeguarded from loss, damage, or misappropriation. Duties are appropriately segregated consistent with appropriate control objectives. Transactions, accounting entries, or systems output is reviewed and approved. Management does not intentionally override internal controls to the detriment of control objectives. Accounting and fiscal tasks, such as reconciliations, are prepared properly and completed timely. Deficiencies in internal controls previously identified were corrected satisfactorily and timely. Management seeks to prevent or detect erroneous recordkeeping, inappropriate accounting, fraudulent financial reporting, financial loss, and exposure. SCOPE AND METHODOLOGY Our study and evaluation were conducted in accordance with the International Standards for the Professional Practice of Internal Auditing issued by the Institute of Internal Auditors, and included the audit tests we considered necessary in determining that accounting and administrative controls are in place and operative. The management review emphasized, but was not limited to, compliance with state and federal laws, Board of Trustee policies, and Office of the Chancellor policies, letters, and directives. For those audit tests that required annualized data, fiscal years 2009/10 and 2010/11 were the primary periods reviewed. In certain instances, we were concerned with representations of the most current data; in such cases, the test period was July 1, 2011, to April 20, 2012. Our primary focus was on internal compliance/internal control. Specifically, we reviewed and tested: Formation of the auxiliary. Functions the auxiliary performs on the campus. Creation and operation of the auxiliary s board. Establishment of policies and procedures based upon sound business practices. Maintenance of arms-length in business transactions between the auxiliary and the campus. Campus oversight of auxiliary operations. Additionally, for the period reviewed, we examined other aspects of compliance of the campus and each auxiliary with the Education Code and Title 5 as they relate to the operation of CSU auxiliary Page 8
INTRODUCTION organizations. Individual codes and regulations added to the scope of our review were identified through an assessment of risk. Similarly, internal controls were included within our scope based upon risk. Therefore, the scope of our review varied from auxiliary to auxiliary. A preliminary survey of CSU auxiliaries at each campus was used to identify risks. Risk was defined as the probability that an event or action would adversely affect the auxiliary and/or the campus. Our assessment of risk was based upon a systematic process, using professional judgments on probable adverse conditions and/or events that became the basis for development of our final scope. We sought to assign higher review priorities to activities with higher risks. As a result, not all risks identified were included within the scope of our review. Based upon this assessment of risks, we specifically included within the scope of our review the following: San Francisco State University Foundation Operating and Administrative Agreements Facilities Agreements Corporate Governance Fiscal Compliance Operational Compliance Program Compliance Campus Oversight and Control Segregation of Duties Cash Disbursement Investments Trusts and Other Liabilities Endowment Administration Auxiliary Programs Information Technology The University Corporation, San Francisco State Operating and Administrative Agreements Facilities Agreements Corporate Governance Fiscal Compliance Operational Compliance Program Compliance Campus Oversight and Control Segregation of Duties Cash Receipts and Handling Cash Disbursement Petty Cash and Change Funds Fees, Revenues, and Receivables Purchasing and Accounts Payable Personnel and Payroll Page 9
INTRODUCTION The University Corporation, San Francisco State (cont.) Property and Equipment Trusts and Other Liabilities Auxiliary Programs Information Technology Franciscan Shops, Inc. Operating and Administrative Agreements Facilities Agreements Corporate Governance Fiscal Compliance Operational Compliance Program Compliance Campus Oversight and Control Segregation of Duties Cash Receipts and Handling Cash Disbursement Petty Cash and Change Funds Investments Fees, Revenues, and Receivables Purchasing and Accounts Payable Personnel and Payroll Property and Equipment Auxiliary Programs Information Technology Associated Students of San Francisco State University Operating and Administrative Agreements Corporate Governance Fiscal Compliance Operational Compliance Program Compliance Campus Oversight and Control Segregation of Duties Cash Receipts and Handling Cash Disbursement Fees, Revenues, and Receivables Purchasing and Accounts Payable Personnel and Payroll Property and Equipment Auxiliary Programs Information Technology Page 10
INTRODUCTION San Francisco State University Student Center, Inc. Operating and Administrative Agreements Facilities Agreements Corporate Governance Fiscal Compliance Operational Compliance Program Compliance Campus Oversight and Control Segregation of Duties Cash Receipts and Handling Cash Disbursement Petty Cash and Change Funds Investments Fees, Revenues, and Receivables Purchasing and Accounts Payable Personnel and Payroll Property and Equipment Auxiliary Programs Information Technology We have not performed any auditing procedures beyond April 20, 2012. Accordingly, our comments are based on our knowledge as of that date. Since the purpose of our comments is to suggest areas for improvement, comments on favorable matters are not addressed. Page 11
OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES SAN FRANCISCO STATE UNIVERSITY FOUNDATION OPERATING AND ADMINISTRATIVE AGREEMENTS The San Francisco State University Foundation (Foundation) performed functions not authorized by its operating agreement with the California State University (CSU) Trustees. We found that the following functions were not included in the operating agreement: Loans, scholarships, grants-in-aids, stipends, and related financial assistance. Public relations, fundraising, fund management, and similar development programs. Title 5 42501 states that a written agreement on behalf of the state of California by the chancellor of the CSU and colleges and the auxiliary organization is required for the performance by such auxiliary organization of any of the functions listed in 42500. Title 5 42502 states that the operating agreement should specify the function or functions which the organization is to manage, operate, or administer. The Foundation secretary and treasurer stated her belief that because the Foundation did not provide loans, scholarships, or stipends directly to the student or financial aid office, inclusion of this function in the operating agreement was not required. She further stated that the exclusion of fundraising efforts as an approved function in the operating agreement was due to oversight. Failure to include all functions administered by the auxiliary in the operating agreement increases the risk of misunderstandings and miscommunication regarding rights and responsibilities. Recommendation 1 We recommend that the Foundation amend its operating agreement to include the following functions: a. Loans, scholarships, grants-in-aids, stipends, and related financial assistance. b. Public relations, fundraising, fund management, and similar development programs. Campus Response The Foundation operating agreement has been amended to include the above functions. Page 12
OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES FISCAL COMPLIANCE The Foundation did not maintain board-designated reserves in accordance with its reserve policy. Specifically, we found that reserves were not allocated into the reserve categories identified in the Foundation s reserve policy. The Foundation Net Assets Reserves Policy, Section II.E.3, lists reserve guidelines as: a) working capital/current operations cash or cash equivalents to meet a minimum of six months operating budget, b) capital acquisition/replacement as determined by the finance and investment committee, when necessary, and c) planned future operations, as determined by the finance and investment committee, when necessary. Section IV states that annually, the board delegates the responsibility for reviewing financial reserves to the finance and investment committee. The finance and investment committee will review reserve adequacy on an annual basis and report to the university president as required by CSU policy. The Compilation of Policies and Procedures for California State University Auxiliary Organizations sets sound business practice guidelines for auxiliary organizations operating within the CSU system. Section 8.1.1.2 A-2, Basis for Financial Standards and Fiscal Viability Financial Statements, states that annually each auxiliary governing board shall review the fiscal viability of the auxiliary organization to include an evaluation of the need for reserves in the following areas: a) working capital, b) current operations, c) capital replacement, and d) planned future operations. The Compilation of Policies and Procedures for California State University Auxiliary Organizations sets sound business practice guidelines for auxiliary organizations operating within the CSU system. Section 8.9.9, Reserves and Net Assets, states, in part, that an auxiliary must implement financial standards, which will assure fiscal viability, including proper provision for professional management, adequate working capital, adequate reserve funds for current operations and capital replacements, and adequate provisions for new business requirements. Title 5 42401 and 42402 state that the campus president shall require that auxiliary organizations operate in conformity with policy of the Board of Trustees and the campus. One of the objectives of the auxiliary organizations is to provide fiscal procedures and management systems that allow effective coordination of the auxiliary activities with the campus in accordance with sound business practices. Sound business practice mandates appropriate allocation of reserves into the designated reserve categories. The Foundation secretary and treasurer stated that the failure to allocate reserves into designated reserve categories was due to a miscommunication between the Foundation and auxiliary business services (ABS). Failure to maintain adequate reserve funding in accordance with auxiliary policy increases the risk of misunderstandings and miscommunication regarding available reserves, as well as the risk that the auxiliary will be unable to fund future needs. Page 13
OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES Recommendation 2 We recommend that the Foundation maintain board-designated reserves in accordance with its reserve policy. Campus Response In the May 2012 financial statements, the Foundation established a designated operating reserve fund that includes funds for six months of operating expenses per the Foundation policy. CAMPUS OVERSIGHT AND CONTROL Foundation budgets for fiscal years 2010/11 and 2011/12 had not been approved by the campus president. Title 5 42402 states that the campus president shall require that each auxiliary organization submit its programs and budgets for review at a time and in a manner specified by the president. Should the president determine that any program or appropriation planned by an auxiliary organization is not consistent with policy of the Board of Trustees and the campus, the program or appropriation shall not be implemented. Further, should a program or appropriation which had received approval, upon review, be determined by the president to be operating outside the acceptable policy of the Board of Trustees and the campus, then that program or appropriation shall be discontinued by direction of the president until further review is accomplished and an appropriate adjustment is made. The Foundation secretary and treasurer stated that the budget was discussed in board and committee meetings that the campus president may have attended, but the lack of formal approval was due to oversight. Lack of adequate budget review and approval by the campus president increases the risk that auxiliary programs and appropriations planned by the auxiliary will be inconsistent with Board of Trustees and campus policy. Recommendation 3 We recommend that the Foundation ensure that its annual budgets are approved by the campus president. Campus Response The Foundation has implemented a process to ensure that the campus president s formal signature is included in the approval process. The president has reviewed and approved the fiscal year 2012/13 budget; this approval is documented in a signed memo. Page 14
OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES INVESTMENTS The Foundation s investment policy needed improvement. Specifically, the policy did not include the following categories for alternative investments: Investment return objectives. Investment quality. Concentration of assets. The Investment Policy for CSU Auxiliary Organizations states that return objectives must be specific and measurable, so they can be evaluated as to whether the portfolio is meeting its investment goals. It further states that determining what percentage of the portfolio will be invested in various asset classes stocks, bonds, real assets, private capital, hedge funds is the single most important component of an investment policy. The policy further states that a strong investment policy should explain why each asset class is included in the portfolio and the specific role it is expected to play. Moreover, it states that although benchmarks are not available for alternative asset classes, return objectives (an absolute return of 8 percent, for example) or manager universes (available from consultants, custodians, or third-party providers) usually serve as benchmarks for alternative asset classes. Title 5 42401 and 42402 indicate that the campus president shall require that auxiliary organizations operate in conformity with policy of the Board of Trustees and the campus. One of the objectives of the auxiliary organizations is to provide fiscal procedures and management systems that allow effective coordination of the auxiliary activities with the campus in accordance with sound business practices. Sound business practice mandates comprehensive policies and procedures for investments, including alternative investments. The Foundation secretary and treasurer stated that the investment strategy to increase diversification in alternative investments occurred within the past year and a half. She further stated that even though the current investment policy had not been updated to reflect the above categories, they were considered when making decisions about alternative investments. The absence of a comprehensive investment policy increases the risk that funds will be handled inappropriately and contrary to the expectations of the campus and donors. Recommendation 4 We recommend that the Foundation include the above categories for alternative investments in its investment policy. Campus Response The Foundation has updated its investment policy to reflect its current practice in managing alternative investments. Page 15
OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES THE UNIVERSITY CORPORATION, SAN FRANCISCO STATE CORPORATE GOVERNANCE The University Corporation, San Francisco State (Corporation) had not filed amended Bylaws with the chancellor s office in a timely manner. We found that amendments to the Bylaws made on June 25, 2010, and June 7, 2011, had not been filed with the chancellor s office. The Compilation of Policies and Procedures for California State University Auxiliary Organizations sets sound business practice guidelines for auxiliary organizations operating within the CSU system. Section 11.6.1, Reporting Changes in Articles of Incorporation and Bylaws, states that when an auxiliary organization makes changes to its Articles of Incorporation or Bylaws, a complete amended copy is to be submitted to Financing and Treasury at the Office of the Chancellor within 30 calendar days. The submission should indicate the date the changes were approved by the governing board and/or members. The director of ABS stated that Bylaws were not filed with the chancellor s office due to oversight. Failure to file amendments to Bylaws in a timely manner increases the risk of misunderstandings and may increase legal liability. During our fieldwork, the Corporation provided documentation showing evidence that a complete amended copy of its Bylaws had been filed with the chancellor s office. FISCAL COMPLIANCE The Corporation reserves for fiscal years 2009/10, 2010/11, and 2011/12 had not been approved by the campus president. The Compilation of Policies and Procedures for California State University Auxiliary Organizations sets sound business practice guidelines for auxiliary organizations operating within the CSU system. Section 8.1.1.2 A-4, Basis for Financial Standards and Fiscal Viability Financial Standards, states that annually each auxiliary governing board shall review the fiscal viability of the auxiliary organization to include the submission of a report annually to the president, which includes a plan to build and maintain appropriate reserves. Such a report may be a part of the annual budget submission. Title 5 42401 and 42402 state that the campus president shall require that auxiliary organizations operate in conformity with policy of the Board of Trustees and the campus. One of the objectives of the auxiliary organizations is to provide fiscal procedures and management systems that allow Page 16
OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES effective coordination of the auxiliary activities with the campus in accordance with sound business practices. Sound business practice mandates that the campus president approve reserves. The director of ABS stated that reserves were not approved by the campus president due to oversight. Lack of adequate reserves review and approval by the campus president increases the risk that auxiliary programs and appropriations planned by the auxiliary will be inconsistent with Board of Trustees and campus policy. During our fieldwork, the Corporation provided documentation showing evidence that the campus president had approved the reserves for fiscal years 2009/10, 2010/11, and 2011/12. PROPERTY AND EQUIPMENT Administration of Corporation property and equipment needed improvement. We found that: The Corporation had not accounted for all property and equipment during its last physical inventory in 2010. Specifically, 19 assets, valued at $10,159 as of December 2011, were not verified, and adequate follow-up was not performed to determine the disposition of the assets. One asset, valued at $6,722, was missing, and this status was not reported in a timely manner to the Corporation by the project director. The Corporation Fixed Asset Procedures states that a physical inventory will be conducted every two years by the university property office as appointed by the chief operating officer (COO)/chief financial officer (CFO) of the Corporation. A detailed listing of the Corporation assets will be sent to the university property office in which to perform the physical inventory. It is the fiduciary responsibility of the project director/manager to notify the Corporation of any substantive change in an asset or its location. It is the responsibility of the COO/CFO to ensure the integrity of the recorded value of fixed assets. It further states that when equipment is discovered to be missing or lost, the project director/manager or the individual responsible shall immediately report the missing or lost equipment to the Corporation by completing the Fixed Asset Disposition Form. The Compilation of Policies and Procedures for California State University Auxiliary Organizations sets sound business practice guidelines for auxiliary organizations operating within the CSU system. Section 8.9.7, Property and Equipment, states that the auxiliary should establish a written system that ensures physical inspection of property and equipment on a service life schedule. Title 5 42401 and 42402 indicate that the campus president shall require that auxiliary organizations operate in conformity with policy of the Board of Trustees and the campus. One of the objectives of the auxiliary organizations is to provide fiscal procedures and management systems that Page 17
OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES allow effective coordination of the auxiliary activities with the campus in accordance with sound business practices. Sound business practice mandates sufficient administration over property and equipment. The director of ABS stated that the physical inventory was performed by the university property office, and the office was unable to contact the project directors to verify the fixed assets. She further stated that the project director travels frequently and therefore, did not notify the Corporation of the missing asset in a timely manner. Insufficient administration of property and equipment increases the risk that property may be lost or stolen or misrepresented in the financial statements. Recommendation 5 We recommend that the Corporation: a. Account for all property and equipment. b. Reiterate Corporation fixed asset procedures to project directors and implement a process to ensure the timely reporting of missing assets to the Corporation. Campus Response The Corporation follows existing campus process regarding asset tracking. This process is managed by the fiscal affairs property office. The Corporation will obtain appropriate documentation on items cited. Fiscal affairs will amend campus asset tracking procedures to include escalation and consequences for failing to respond to inquiries from the property office. Estimated completion: October 31, 2012 ENDOWMENT ADMINISTRATION Corporation administration of endowment spending accounts was not supported by a written agreement. Title 5 42401 and 42402 indicate that the campus president shall require that auxiliary organizations operate in conformity with policy of the Board of Trustees and the campus. One of the objectives of the auxiliary organizations is to provide fiscal procedures and management systems that allow effective coordination of the auxiliary activities with the campus in accordance with sound business practices. Sound business practice mandates that endowment funds held and administered by others be properly supported by complete, written agreements. The Foundation secretary and treasurer stated that when the endowment assets were transferred from the Corporation to the Foundation, it was implicitly understood that corresponding spending accounts Page 18
OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES would remain at the Corporation. She further stated that the board approved a Certificate of Compliance and Approval, which included an attachment of the list of endowment funds and their values; however, it did not include a list of the corresponding scholarships and campus accounts as part of the transfer. The absence of a written agreement increases the risk of misunderstanding and miscommunication regarding rights and responsibilities. Recommendation 6 We recommend that the Corporation work with the Foundation to promptly establish a written agreement for the management and distribution of endowment proceeds. Campus Response The Corporation and the Foundation have established an overall agreement regarding endowment spending accounts and clarifying the responsibilities of each party. Page 19
OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES SEGREGATION OF DUTIES FRANCISCAN SHOPS, INC. Certain duties and responsibilities related to payroll and personnel processing were not appropriately segregated at the Franciscan Shops, Inc. (Shops). We found that one employee: Added, deleted, and changed personnel records. Approved hours worked in the timekeeping system. Executive Order (EO) 698, Board of Trustees Policy for The California State University Auxiliary Organizations, dated March 3, 1999, states that the review of auxiliary organizations will be used to determine appropriate separation of duties, safeguarding of assets, and reliability and integrity of information. The Compilation of Policies and Procedures for California State University Auxiliary Organizations sets sound business practice guidelines for auxiliary organizations operating within the CSU system. Section 8.9.6, Payroll, states that the auxiliary should establish a written controls system that ensures payroll preparation is segregated from the general ledger function and other payroll functions such as hiring authorization, timekeeping, and distribution of checks. The Shops controller stated that, due to limited resources, the employee served as a backup for the customer service supervisor and therefore had access to approve hours in the timekeeping system. Inadequate segregation of duties increases the risk that errors and irregularities will not be detected in a timely manner. Recommendation 7 We recommend that the Shops appropriately segregate certain payroll and personnel processing functions or institute mitigating procedures approved by the campus CFO. Campus Response As of July 1, 2012, the university has outsourced operations of the campus bookstore to Follett, a third party. Franciscan Shops has no remaining employees. PERSONNEL AND PAYROLL The Shops did not always complete separation documentation for employees. Page 20
OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES We reviewed ten recent employee separations and found that separation documentation was not on file in six instances. The Shops, Payroll Procedures, states that all personnel actions, including new hires, re-hires, terminations, recommendations for raises, or department transfers, are supported by forms prepared by an immediate supervisor or managers, and approved by the general manager, human resources manager, or acting general manager as appropriate. Title 5 42401 and 42402 indicate that the campus president shall require that auxiliary organizations operate in conformity with policy of the Board of Trustees and the campus. One of the objectives of the auxiliary organizations is to provide fiscal procedures and management systems that allow effective coordination of the auxiliary activities with the campus in accordance with sound business practices. Sound business practice mandates sufficient administration of employee separations. The Shops controller stated that temporary employees were hired twice a year at the beginning of each semester to handle the increase in traffic/sales volume in the bookstore. He further stated that due to the very short nature of their employment, separation forms were not always completed and maintained for them. Failure to sufficiently document employee separations increases the risk of loss of auxiliary funds and inappropriate use of auxiliary resources. Recommendation 8 We recommend that the Shops complete separation documentation for all employees. Campus Response As of July 1, 2012, the university has outsourced operations of the campus bookstore to Follett, a third party. Franciscan Shops has no remaining employees. PROPERTY AND EQUIPMENT The Shops did not always document proper approval prior to disposal of fixed assets. The Shops, Fixed Assets Policy, states that when a fixed asset is broken or its use has expired through the advent of newer equipment, it is to be removed from the fixed asset inventory. The fixed asset tag is to be turned into the associate general manager for notification of the disposal, and the Fixed Asset Removal form is filled out and turned into the accounting clerk responsible for the fixed assets. Title 5 42401 and 42402 indicate that the campus president shall require that auxiliary organizations operate in conformity with policy of the Board of Trustees and the campus. One of the Page 21
OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES objectives of the auxiliary organizations is to provide fiscal procedures and management systems that allow effective coordination of the auxiliary activities with the campus in accordance with sound business practices. Sound business practice mandates sufficient administration of property and equipment. The Shops controller stated that due to the infrequent occurrence of asset disposals, proper approval was not documented before the disposal. Insufficient administration of property and equipment increases the risk that property may be lost or stolen or misrepresented in the financial statements. Recommendation 9 We recommend that the Shops document proper approval before disposing of fixed assets. Campus Response As of July 1, 2012, the university has outsourced operations of the campus bookstore to Follett, a third party. Fixed assets were sold to Follett or have become the property of the Corporation. INFORMATION TECHNOLOGY PAYMENT CARD INDUSTRY DATA SECURITY STANDARD The Shops did not fully address the Payment Card Industry (PCI) Data Security Standard (DSS) requirements. We found that: A risk assessment had not been completed and documented to determine comprehensive compliance obligations for credit card data maintained on auxiliary servers, transmitted throughout the campus network, and stored manually in local files. An annual PCI DSS Self Assessment Questionnaire (SAQ) was not completed, as is required by PCI DSS of all level one, two, and three vendors, and recommended for all level four vendors. ICSUAM 8045.100, Information Technology Security, dated April 19, 2010, states that campuses must develop and implement appropriate technical controls to minimize risks to their information technology infrastructure. Each campus must take reasonable steps to protect the confidentiality, integrity, and availability of its critical assets and protected data from threats. EO 698, Board of Trustees Policy for The California State University Auxiliary Organizations, dated March 3, 1999, states that the review of auxiliary organizations will be used to determine appropriate separation of duties, safeguarding of assets, and reliability and integrity of information. Page 22