STATE OF ILLIOIS UIVERSIT OF ILLIOIS Compliance Examination (In Accordance With the Single Audit Act and OMB Circular A-133) June 30, 2011 Performed as Special Assistant Auditors for the Auditor General, State of Illinois
STATE OF ILLIOIS UIVERSIT OF ILLIOIS Compliance Examination ear ended June 30, 2011 Table of Contents University Officials 1 Management Assertion Letter 2 Compliance Examination: Compliance Report Summary 4 Auditor s Reports: Independent Accountant s Report on State Compliance and on Internal Control over Compliance for State Compliance Purposes 10 Independent Auditors Report on Internal Control over Financial Reporting and on Compliance and Other Matters Based on an Audit of Financial Statements Performed in Accordance with Government Auditing Standards 13 Independent Auditors Report on Compliance with Requirements Applicable to Each Major Program, on Internal Control over Compliance, and on the Schedule of Expenditures of Federal Awards in Accordance With OMB Circular A-133 15 Schedule of Findings and Questioned Costs: Summary of Auditor s Results 18 Current Findings: Government Auditing Standards 20 Federal Compliance 27 State Compliance 103 Prior Findings ot Repeated 112 Financial Related Information: Financial Related Information Summary 115 Financial Related Schedules: Schedule of Expenditures of Federal Awards 116 Attachments to Schedule of Expenditures of Federal Awards: Federal Loans Disbursed and Capital Contributions 188 Schedule of Loans Issued and Outstanding Balances for University Administered Loan Programs 189 Detail of Pass-Through Federal Funding 190 otes to Schedule of Expenditures of Federal Awards 318 Related Reports Published Under Separate Cover: Annual Financial Report of the University of Illinois for the ear ended June 30, 2011, which is incorporated herein by reference Supplemental Financial Information Report for the ear ended June 30, 2011, which is incorporated herein by reference Annual Financial Report of the University of Illinois Auxiliary Facilities System for the ear ended June 30, 2011, which is incorporated herein by reference Annual Financial Report of the University of Illinois Health Services Facilities System for the ear ended June 30, 2011, which is incorporated herein by reference Report Required Under Government Auditing Standards for the ear ended June 30, 2011, which is incorporated herein by reference Page
STATE OF ILLIOIS UIVERSIT OF ILLIOIS University Officials ear ended June 30, 2011 Michael J. Hogan Walter K. Knorr Douglas E. Beckmann Michael B. Bass Patrick M. Patterson Julie A. Zemaitis Robert A. Easter Phyllis Wise Maxine E. Sandretto Paula Allen-Meares Heather J. Haberaecker Harry J. Berman Susan J. Koch Michael E. Bloechle President Vice President and Chief Financial Officer and Comptroller Senior Associate Vice President for Business and Finance (through October 31, 2011) Senior Associate Vice President for Business and Finance (effective ovember 1, 2011) Controller and Senior Assistant Vice President for Business and Finance Executive Director of University Audits Interim Vice President and Chancellor, University of Illinois at Urbana-Champaign (through September 30, 2011) Vice President and Chancellor, University of Illinois at Urbana-Champaign (effective October 1, 2011) Assistant Vice President for Business and Finance, Urbana-Champaign campus Vice President and Chancellor, University of Illinois at Chicago Executive Assistant Vice President for Business and Finance, Chicago campus Interim Vice President and Chancellor, University of Illinois at Springfield (through June 30, 2011) Vice President and Chancellor, University of Illinois at Springfield (effective July 1, 2011) Director of Business Services, Springfield campus Administrative offices are located at: Central Administration 238 Henry Administration Building 506 South Wright Street Urbana, Illinois 61801 Chicago Campus 809 South Marshfield Room 608 Chicago, Illinois 60612 Springfield Campus Business Services Building Room 59 Springfield, Illinois 62794-9243 Urbana-Champaign Campus 104 Coble Hall 801 South Wright Street Champaign, Illinois 61820 1
STATE OF ILLIOIS UIVERSIT OF ILLIOIS Compliance Report Summary ear ended June 30, 2011 The compliance testing performed during this examination was conducted in accordance with Government Auditing Standards and in accordance with the Illinois State Auditing Act. Accountant s Report The Independent Accountant s Report on State Compliance and on Internal Control over Compliance for State Compliance Purposes does not contain scope limitations, disclaimers, or other significant nonstandard language. Summary of Findings Current Prior umber of report report Findings 37 43 Repeated findings 30 29 Prior recommendations implemented or not repeated 13 18 Details of findings are presented in the separately tabbed report section of this report. Schedule of Findings and Questioned Costs Findings (Government Auditing Standards) Item o. Page Description Finding Type 11-01 20 Inadequate ear End Receivable and Payable Accruals Process 11-02 22 Inadequate Controls over User Access to Information Systems 11-03 25 Inadequate Controls over University Procurement Card Transactions Material weakness Significant deficiency Significant deficiency 4 (Continued)
STATE OF ILLIOIS UIVERSIT OF ILLIOIS Compliance Report Summary ear ended June 30, 2011 Findings (Federal Compliance) Item o. Page Description Finding Type 11-04 27 Inadequate Documentation for Payroll and Fringe Benefit Expenditures 11-05 30 Inadequate Documentation for Payroll and Fringe Benefit Expenditures 11-06 33 Incomplete Documentation in Client Eligibility Files 11-07 35 Inadequate Procedures for Closing Federal Projects 11-08 40 Inadequate Supporting Documentation for Cost Transfers 11-09 45 Inadequate Process for Monitoring Cost Share Requirement 11-10 47 Inadequate Process for Monitoring SAP Cost Share 11-11 49 Improper Reporting of Amounts in Financial Status Reports Material noncompliance and material weakness Material noncompliance and material weakness oncompliance and material weakness oncompliance and material weakness oncompliance and material weakness oncompliance and material weakness oncompliance and material weakness oncompliance and material weakness 11-12 52 Inaccurate ARRA 1512 Reports oncompliance and significant deficiency 11-13 54 Inaccurate Fringe Benefit Charges oncompliance and material weakness 11-14 56 Expenditures Reported in the Incorrect Accounting Period 11-15 59 Inadequate Process for Limiting Indirect Costs on DoD Awards 11-16 61 Inadequate Documentation to Support Key Personnel 11-17 64 Failure to Obtain Suspension and Debarment Certifications from Vendors oncompliance and material weakness oncompliance and material weakness oncompliance and material weakness oncompliance and material weakness 5 (Continued)
STATE OF ILLIOIS UIVERSIT OF ILLIOIS Compliance Report Summary ear ended June 30, 2011 Findings (Federal Compliance, continued) Item o. Page Description Finding Type 11-18 68 Failure to Properly Perform Interest Calculations on Federal Advances 11-19 71 Failure to otify Subrecipients of Federal Funding and Communicate ARRA Information 11-20 74 Inadequate Monitoring of Subrecipient OMB Circular A-133 Audit Reports 11-21 78 Inaccurate Quarterly Expenditure Reports Prepared for the SAP Program 11-22 80 Failure to Follow Property Management Regulations 11-23 83 Failure to Properly Determine SFA Awards in Accordance with Program Regulations 11-24 85 Failure to Properly Complete Required Verification Procedures 11-25 87 Inaccurate and Untimely Reporting of Student Status Changes 11-26 89 Failure to Obtain Written Agreements with Third Party Institutions oncompliance and material weakness oncompliance and material weakness oncompliance and material weakness oncompliance and significant deficiency oncompliance and significant deficiency oncompliance and significant deficiency oncompliance and significant deficiency oncompliance and significant deficiency oncompliance and significant deficiency 11-27 91 Untimely Submission of Financial Reports oncompliance and significant deficiency 11-28 93 Inadequate Support for Cash Draws Significant deficiency 11-29 95 Inadequate Cash Draw and Reimbursement Request Controls Significant deficiency 6 (Continued)
STATE OF ILLIOIS UIVERSIT OF ILLIOIS Compliance Report Summary ear ended June 30, 2011 Findings (Federal Compliance, continued) Item o. Page Description Finding Type 11-30 98 Inadequate Approval Controls Over Financial Reporting Significant deficiency 11-31 101 Inaccurate Award Records Significant deficiency Findings (State Compliance) Item o. Page Description Finding Type 11-32 103 Contracts and Real Estate Leases ot Properly Executed 11-33 105 Failure to Follow Time Reporting Requirements oncompliance and significant deficiency oncompliance and significant deficiency 11-34 106 Inaccurate Inventory Records oncompliance and significant deficiency 11-35 108 Failure to Maintain Supporting Documentation for Agency Workforce Report oncompliance 11-36 110 Use of University Vehicles oncompliance 11-37 111 Failure to Comply with Higher Education Veterans Act (Act) oncompliance In addition, the following findings which are reported as current findings relating to Government Auditing Standards also meet the reporting requirements for State Compliance. Item o. Page Description Finding Type 11-01 20 Inadequate ear End Receivable and Payable Accruals Process 11-02 22 Inadequate Controls over User Access to Information Systems 11-03 25 Inadequate Controls over University Procurement Card Transactions oncompliance and material weakness oncompliance and significant deficiency oncompliance and significant deficiency 7 (Continued)
STATE OF ILLIOIS UIVERSIT OF ILLIOIS Compliance Report Summary ear ended June 30, 2011 Prior ear Findings ot Repeated (Federal Compliance) Item o. Page Description Finding Type A 112 Incompatible Allocation Methodologies for Payroll Costs Material noncompliance and material weakness B 112 Inadequate Procedures to Determine the Allowability of Cost Share Expenditures C 112 Unsupported Volunteer Rated Used for Cost Share Requirement D 112 Inadequate Documentation for Institutional Letter of Credit Cash Draws E 112 Incomplete and Inaccurate Annual Effort Certifications F 112 Incomplete Semi-Annual Expenditure Confirmations G 113 Inaccurate Amounts Reported in Quarterly Federal Financial Reports Material noncompliance and material weakness Material noncompliance and material weakness Scope Limitation and material weakness oncompliance and material weakness oncompliance and material weakness oncompliance and material weakness H 113 Unallowable Costs Charged to Federal Program oncompliance and material weakness I 113 Inadequate Controls Over Federal Expenditures Paid with Procurement Card oncompliance and significant deficiency Prior ear Findings ot Repeated (State Compliance) Item o. Page Description Finding Type J 114 Inadequate Controls over Patient Billings System K 114 Untimely Bank Account Reconciliation Supervisory Reviews L 114 Failure to Follow State Regulations for Recording Equipment oncompliance significant deficiency oncompliance and significant deficiency oncompliance M 114 Failure to Report Payroll Warrant Information oncompliance 8 (Continued)
STATE OF ILLIOIS UIVERSIT OF ILLIOIS Compliance Report Summary ear ended June 30, 2011 Exit Conference The federal and state compliance findings and recommendations appearing in this report were discussed with University personnel at an exit conference on March 14, 2012. Attending were Walter Knorr, Michael Bass, Maxine Sandretto, Heather Haberaecker, Ginger Velazquez, Sandra Moulton, Vanessa Peoples, Ruth Boardman, Patrick Patterson, Janet Ford, and Julie Zemaitis from the University of Illinois; Thomas Kizziah from the Office of the Auditor General; and Catherine Baumann, Jacqueline Dippel, Kristopher Allen, and Aanuoluwapo Jolaoso from KPMG LLP. Responses to the recommendations were provided by Maxine Sandretto in correspondence dated March 15, 2012. 9
KPMG LLP 303 East Wacker Drive Chicago, IL 60601-5212 Independent Accountants Report on State Compliance and on Internal Control over Compliance for State Compliance Purposes The Honorable William G. Holland Auditor General of the State of Illinois and The Board of Trustees University of Illinois: Compliance As Special Assistant Auditors for the Auditor General, we have examined the University of Illinois compliance with the requirements listed below, as more fully described in the Audit Guide for Financial Audits and Compliance Attestation Engagements of Illinois State Agencies (Audit Guide) as adopted by the Auditor General, during the year ended June 30, 2011. The management of the University of Illinois (the University) is responsible for compliance with these requirements. Our responsibility is to express an opinion on the University s compliance based on our examination. A. The University has obligated, expended, received, and used public funds of the State in accordance with the purpose for which such funds have been appropriated or otherwise authorized by law. B. The University has obligated, expended, received, and used public funds of the State in accordance with any limitations, restrictions, conditions or mandatory directions imposed by law upon such obligation, expenditure, receipt or use. C. The University has complied, in all material respects, with applicable laws and regulations, including the State uniform accounting system, in its financial and fiscal operations. D. State revenues and receipts collected by the University are in accordance with applicable laws and regulations and the accounting and recordkeeping of such revenues and receipts is fair, accurate and in accordance with law. E. Money or negotiable securities or similar assets handled by the University on behalf of the State or held in trust by the University have been properly and legally administered and the accounting and recordkeeping relating thereto is proper, accurate, and in accordance with law. 10 KPMG LLP is a Delaware limited liability partnership, the U.S. member firm of KPMG International Cooperative ( KPMG International ), a Swiss entity.
We conducted our examination in accordance with attestation standards established by the American Institute of Certified Public Accountants; the standards applicable to attestation engagements contained in Government Auditing Standards issued by the Comptroller General of the United States; the Illinois State Auditing Act (Act); and the Audit Guide as adopted by the Auditor General pursuant to the Act; and, accordingly, included examining, on a test basis, evidence about the University s compliance with those requirements listed in the first paragraph of this report and performing such other procedures as we considered necessary in the circumstances. We believe that our examination provides a reasonable basis for our opinion. Our examination does not provide a legal determination on the University s compliance with specified requirements. In our opinion, the University of Illinois complied, in all material respects, with the requirements listed in the first paragraph of this report during the year ended June 30, 2011. However, the results of our procedures disclosed instances of noncompliance, which are required to be reported in accordance with criteria established by the Audit Guide, issued by the Illinois Office of the Auditor General and which are described in the accompanying schedule of findings and questioned costs as findings 11-01 through 11-03 and findings 11-32 through 11-37. As required by the Audit Guide, immaterial findings relating to instances of noncompliance excluded from this report have been reported in a separate letter to your office. Internal Control The management of the University is responsible for establishing and maintaining effective internal control over compliance with the requirements listed in the first paragraph of this report. In planning and performing our examination, we considered the University s internal control over compliance with the requirements listed in the first paragraph of this report as a basis for designing our examination procedures for the purpose of expressing our opinion on compliance and to test and report on internal control over compliance in accordance with the Audit Guide issued by the Illinois Office of the Auditor General, but not for the purpose of expressing an opinion on the effectiveness of the University s internal control over compliance. Accordingly, we do not express an opinion on the effectiveness of the University s internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the preceding paragraph and was not designed to identify all deficiencies in internal control over compliance that might be significant deficiencies or material weaknesses and therefore, there can be no assurance that all deficiencies, significant deficiencies, or material weaknesses have been identified. However, as described in the accompanying schedule of findings and questioned costs we identified a certain deficiency in internal control over compliance that we consider to be a material weakness and other deficiencies that we consider to be significant deficiencies. A deficiency in an entity s internal control over compliance exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct noncompliance with the requirements listed in the first paragraph of this report on a timely basis. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control such that there is a reasonable possibility that a material noncompliance with a requirement listed in the first paragraph of this report will not be prevented, or detected and corrected on a timely basis. We consider the deficiency in internal control over compliance described in the accompanying schedule of findings and questioned costs as finding 11-01 to be a material weakness. A significant deficiency in internal control over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. We 11
consider the deficiencies in internal control over compliance described in the accompanying schedule of findings and questioned costs as items findings 11-02 through 11-03 and 11-32 through 11-34 to be significant deficiencies. Additionally, the results of our procedures disclosed other matters involving internal control over compliance, which are required to be reported in accordance with criteria established by the Audit Guide issued by the Illinois Office of the Auditor General and which are described in the accompanying schedule of findings and questioned costs as items 11-35 through 11-37. As required by the Audit Guide, immaterial findings relating to internal control deficiencies excluded from this report have been reported in a separate letter to your office. The University s responses to the findings identified in our examination are described in the accompanying schedule of findings and questioned costs. We did not examine the University s responses and, accordingly, we express no opinion on them. This report is intended solely for the information and use of the Illinois Auditor General, the Illinois General Assembly, the Illinois Legislative Audit Commission, the Governor of the State of Illinois, University management, the Board of Trustees of the University, others within the University, and federal awarding agencies and pass-through entities and is not intended to be and should not be used by anyone other than these specified parties. Chicago, Illinois March 16, 2012 12
KPMG LLP 303 East Wacker Drive Chicago, IL 60601-5212 Independent Auditors Report on Internal Control over Financial Reporting and on Compliance and Other Matters Based on an Audit of Financial Statements Performed in Accordance with Government Auditing Standards The Honorable William G. Holland Auditor General of the State of Illinois and The Board of Trustees University of Illinois: As Special Assistant Auditors for the Auditor General, we have audited the financial statements of the business-type activities and the aggregate discretely presented component units of the University of Illinois (the University), a component unit of the State of Illinois, as of and for the year ended June 30, 2011, which collectively comprise the University of Illinois basic financial statements and have issued our report thereon dated December 16, 2011. Our report was modified to include a reference to other auditors. We conducted our audit in accordance with auditing standards generally accepted in the United States of America and the standards applicable to financial audits contained in Government Auditing Standards, issued by the Comptroller General of the United States. Other auditors audited the financial statements of the University of Illinois Foundation (a discretely presented component unit in accordance with Government Auditing Standards), as described in our report on the University s financial statements. This report does not include the results of the other auditors testing of internal control over financial reporting or compliance and other matters that are reported on separately by those auditors. The financial statements of The University of Illinois Alumni Association, Wolcott, Wood, and Taylor, Inc., Prairieland Energy, Inc., Illinois Ventures, LLC, The University of Illinois Research Park, LLC, and UI Singapore Research, LLC (all discretely presented component units) were not audited in accordance with Government Auditing Standards. Internal Control over Financial Reporting Management of the University is responsible for establishing and maintaining effective internal control over financial reporting. In planning and performing our audit, we considered the University s internal control over financial reporting as a basis for designing our auditing procedures for the purpose of expressing our opinions on the financial statements, but not for the purpose of expressing an opinion on the effectiveness of the University s internal control over financial reporting. Accordingly, we do not express an opinion on the effectiveness of the University s internal control over financial reporting. Our consideration of internal control over financial reporting was for the limited purpose described in the preceding paragraph and was not designed to identify all deficiencies in internal control over financial reporting that might be significant deficiencies or material weaknesses and therefore, there can be no assurance that all deficiencies, significant deficiencies, or material weaknesses have been identified. However, as discussed below, we identified a certain deficiency in internal control over financial reporting that we consider to be a material weakness and other deficiencies that we consider to be significant deficiencies. A deficiency in internal control over financial reporting exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct misstatements on a timely basis. A material weakness is a deficiency, or 13 KPMG LLP is a Delaware limited liability partnership, the U.S. member firm of KPMG International Cooperative ( KPMG International ), a Swiss entity.
combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the entity s financial statements will not be prevented, or detected and corrected on a timely basis. We consider the deficiency in the University s internal control over financial reporting described as finding number 11-01 in the accompanying schedule of findings and responses to be a material weakness. A significant deficiency is a deficiency, or combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those charged with governance. We consider the deficiencies described in the accompanying schedule of findings and responses as finding numbers 11-02 and 11-03 to be significant deficiencies in internal control over financial reporting. Compliance and Other Matters As part of obtaining reasonable assurance about whether the University s financial statements are free of material misstatement, we performed tests of its compliance with certain provisions of laws, regulations, contracts, and grant agreements, noncompliance with which could have a direct and material effect on the determination of financial statement amounts. However, providing an opinion on compliance with those provisions was not an objective of our audit, and accordingly, we do not express such an opinion. The results of our tests disclosed no instances of noncompliance or other matters that are required to be reported under Government Auditing Standards. The University s responses to the findings identified in our audit are described in the accompanying schedule of findings and responses. We did not audit the University s responses and, accordingly, we express no opinion on them. This report is intended solely for the information and use of the Illinois Auditor General, the Illinois General Assembly, the Illinois Legislative Audit Commission, the Illinois Governor, University management, the Board of Trustees of the University of Illinois, others within the University, and federal awarding agencies and pass-through entities and is not intended to be and should not be used by anyone other than these specified parties. Chicago, Illinois December 16, 2011 14
KPMG LLP 303 East Wacker Drive Chicago, IL 60601-5212 Independent Auditors Report on Compliance with Requirements That Could Have a Direct and Material Effect on Each Major Program, on Internal Control over Compliance, and on the Schedule of Expenditures of Federal Awards in Accordance with OMB Circular A-133 The Honorable William G. Holland Auditor General of the State of Illinois and The Board of Trustees University of Illinois: Compliance We have audited the compliance of the University of Illinois (the University) with the types of compliance requirements described in the US Office of Management and Budget (OMB) Circular A-133 Compliance Supplement (the Compliance Supplement) that could have a direct and material effect on each of the University s major federal programs for the year ended June 30, 2011, except the requirements discussed in the third paragraph of this report. The University s major federal programs are identified in the summary of auditors results section of the accompanying schedule of findings and questioned costs. Compliance with the requirements of laws, regulations, contracts, and grants applicable to each of its major federal programs is the responsibility of the University s management. Our responsibility is to express an opinion on the University s compliance based on our audit. The schedule of expenditures of federal awards and our audit described below does not include expenditures of federal awards for those agencies determined to be component units of the University of Illinois for financial statement purposes. We did not audit the University s compliance with the requirements governing the repayments special test and provision compliance requirement in accordance with the requirements of the Student Financial Assistance Cluster: Federal Perkins Loan program as described in the Compliance Supplement. Those requirements govern functions performed by Affiliated Computer Services, Inc. (ACS). Since we did not apply auditing procedures to satisfy ourselves as to compliance with those requirements, the scope of work was not sufficient to enable us to express, and we do not express, an opinion on compliance with those requirements. ACS compliance with the requirements governing the functions that it performs for the University for the year ended June 30, 2011 was examined by the accountants for the servicer in accordance with the U.S. Department of Education s Audit Guide, Audits of Federal Student Financial Assistance Programs at Participating Institutions and Institution Servicers. Our report does not include the results of the accountants examination of ACS compliance with such requirements. We conducted our audit of compliance in accordance with auditing standards generally accepted in the United States of America; the standards applicable to financial audits contained in Government Auditing Standards, issued by the Comptroller General of the United States; and OMB Circular A-133, Audits of 15 KPMG LLP is a Delaware limited liability partnership, the U.S. member firm of KPMG International Cooperative ( KPMG International ), a Swiss entity.
States, Local Governments, and on-profit Organizations. Those standards and OMB Circular A-133 require that we plan and perform the audit to obtain reasonable assurance about whether noncompliance with the types of compliance requirements referred to above that could have a direct and material effect on a major federal program occurred. An audit includes examining, on a test basis, evidence about the University s compliance with those requirements and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion. Our audit does not provide a legal determination on the University s compliance with those requirements. Qualifications (oncompliance) As identified below and described in the accompanying schedule of findings and questioned costs, the University did not comply with certain compliance requirements that are applicable to certain of its major federal programs as listed below. Compliance with such requirements is necessary, in our opinion, for the University to comply with requirements applicable to the identified major federal programs. Federal Program CFDA o. Compliance Requirement(s) Cooperative Extension Services 10.500 Allowable Costs/Cost Principles and Matching Maternal and Child Health Services 93.994 Allowable Costs/Cost Block Grant to the States Principles Finding umber 11-04 11-05 In our opinion, except for the noncompliance described in the preceding paragraph, the University complied, in all material respects, with the requirements referred to above that could have a direct or material effect on each of its major federal programs for the year ended June 30, 2011. The results of our auditing procedures also disclosed other instances of noncompliance with those requirements, which are required to be reported in accordance with OMB Circular A-133 and which are described in the accompanying schedule of findings and questioned costs as findings 11-04 through 11-27. Internal Control over Compliance The management of the University is responsible for establishing and maintaining effective internal control over compliance with requirements of laws, regulations, contracts, and grants applicable to federal programs. In planning and performing our audit, we considered the University s internal control over compliance with requirements that could have a direct and material effect on a major federal program in order to determine the auditing procedures for the purpose of expressing our opinion on compliance and to test and report on internal control over compliance in accordance with OMB Circular A-133, but not for the purpose of expressing an opinion on the effectiveness of internal control over compliance. Accordingly, we do not express an opinion on the effectiveness of the University s internal control over compliance. Requirements governing the repayments special test and provision compliance requirement in the Student Financial Assistance Cluster: Federal Perkins Loan program as described in the Compliance Supplement are performed by ACS. Internal control over compliance related to such functions for the year ended June 30, 2011 was reported on by accountants for the servicer in accordance with the U.S. Department of Education s Audit Guide, Audits of Federal Student Financial Assistance Programs at Participating Institutions and Institution Servicers. Our report does not include the results of the accountants for the servicer testing of ACS internal control over compliance related to such functions. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this section and would not necessarily identify all deficiencies in the entity s internal control over compliance that might be significant deficiencies or material weaknesses and therefore, there can be 16
no assurance that all deficiencies, significant deficiencies, or material weaknesses have been identified. However, as discussed below, we identified certain deficiencies in internal control over compliance that we consider to be material weaknesses and other deficiencies that we consider to be significant deficiencies. A deficiency in internal control over compliance exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a federal program on a timely basis. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, that material noncompliance such that there is a reasonable possibility that material noncompliance with a type of compliance requirement of a federal program will not be prevented, or detected and corrected on a timely basis. We consider the deficiencies in internal control over compliance described in the accompanying schedule of findings and questioned costs as items 11-04 through 11-11 and 11-13 through 11-20 to be material weaknesses. A significant deficiency in internal control over compliance is a deficiency, or combination of deficiencies in internal control over compliance with a type of compliance requirement of a federal program, that is less severe than a material weakness in internal control over compliance yet important enough to merit attention by those charged with governance. We consider the deficiencies in internal control over compliance described in the accompanying schedule of findings and questioned costs as items 11-12 and 11-21 through 11-31 to be significant deficiencies. Schedule of Expenditures of Federal Awards We have audited the financial statements of the business-type activities and the aggregate discretely presented component units of the University of Illinois, a component unit of the State of Illinois, as of and for the year ended June 30, 2011 and have issued our report thereon dated December 16, 2011. Our report was modified to include a reference to other auditors. Our audit was performed for the purpose of forming opinions on the financial statements that collectively comprise the University of Illinois basic financial statements. The accompanying schedule of expenditures of federal awards is presented for purposes of additional analysis as required by OMB Circular A-133 and is not a required part of the basic financial statements. Such information has been subjected to the auditing procedures applied in the audit of the basic financial statements and, in our opinion, is fairly stated, in all material respects, in relation to the basic financial statements taken as a whole. The University s responses to the findings identified in our audit are described in the accompanying schedule of findings and questioned costs. We did not audit the University s responses, and accordingly, we express no opinion on the responses. This report is intended solely for the information and use of the Illinois Auditor General, the Illinois General Assembly, the Illinois Legislative Audit Commission, the Governor of the State of Illinois, University management, the Board of Trustees of the University, others within the University, and federal awarding agencies and pass-through entities and is not intended to be and should not be used by anyone other than these specified parties. Chicago, Illinois March 16, 2012, except for the schedule of expenditures of federal awards as to which the date is December 16, 2011 17
STATE OF ILLIOIS UIVERSIT OF ILLIOIS Schedule of Findings and Questioned Costs ear ended June 30, 2011 Summary of Auditor s Results Financial Statements Type of auditors report issued: unqualified opinions Internal control over financial reporting: Material weakness(es) identified? es o Significant deficiency(ies) identified? es one reported oncompliance material to financial statements noted? es o Federal Awards Internal control over major programs: Material weakness(es) identified? es o Significant deficiency(ies) identified? es one reported Type of auditors report issued on compliance for major programs: See table below. Any audit findings disclosed that are required to be reported in accordance with Section. 510(a) of Circular A-133? es o Identification of major programs: ame of Federal Program or Cluster CFDA umber(s) Type of Auditors Report on Compliance Research and Development Cluster Various Unqualified Cooperative Extension Services 10.500 Qualified Supplemental utrition Assistance Program (SAP) 10.551/10.561 Unqualified Education and Human Resources 47.076 Unqualified Student Financial Aid Cluster Various Unqualified Temporary Assistance for eedy Families Cluster 93.558 Unqualified Child Care Development Funds Cluster 93.575/93.596/93.713 Unqualified Maternal and Child Health Services Block Grant to the States 93.994 Qualified 18 (Continued)
STATE OF ILLIOIS UIVERSIT OF ILLIOIS Schedule of Findings and Questioned Costs ear ended June 30, 2011 Dollar threshold used to distinguish between type A and type B programs: $ 3,937,982 Auditee qualified as low-risk auditee? es o 19 (Continued)
UIVERSIT OF ILLIOIS Schedule of Findings and Questioned Costs ear ended June 30, 2011 Current Findings Governmental Auditing Standards Finding 11-01 Inadequate ear end Receivable and Payable Accruals Process The University has not established adequate internal controls over accurately identifying and recording period end accounts payable and accounts receivable transactions for financial reporting purposes. During our audit, we noted the University s year end accounts payable procedures include specifically reviewing cash disbursements made subsequent to year end through the fourth week in October to determine to which accounting period the related expense transactions pertained. We further noted the University s year end accounts payable procedures also include calculating and recording an estimate of unrecorded liabilities largely based on historical disbursement activity. In addition, the University performs reviews over cash disbursements subsequent to year end to track and monitor the actual level of unrecorded liabilities. The actual level of unrecorded liabilities is then compared to the estimate originally recorded for financial reporting purposes. The University s year end accounts receivable procedures require units to identify and report any accounts receivable. In relation to our testwork on revenue transactions, we reviewed 124 revenue transactions recorded during the fiscal year (totaling $14,545,678) and 27 cash receipt transactions recorded subsequent to year end (totaling $1,274,941). In relation to our testwork on expense transactions, we reviewed 205 expense transactions recorded during the fiscal year (totaling $51,343,490) and 63 cash disbursements subsequent to year end (totaling $39,192,830). During our review of these transactions we noted the following items were not recorded to the proper accounting period: Six educational activities revenue transactions for third party pharmacy billings (totaling $370,897) which pertained to fiscal year 2010 but were recognized as revenue in fiscal year 2011. Three educational activities revenue transactions for drug information services billings (totaling $52,356) which pertained to fiscal year 2011 but was recognized as revenue in fiscal year 2012. Two rental and lease revenue transactions (totaling $813) which pertained to fiscal years 2010 and 2012 but were recognized as revenue in fiscal year 2011. One rental and lease revenue transaction (totaling $1,016) which pertained to fiscal year 2012 but was recognized as revenue in fiscal year 2011. One rental and lease revenue transaction (totaling $401) which pertained to fiscal year 2011 but was recognized as revenue in fiscal year 2010. Two educational activities revenue transactions for an accelerated corporate MBA cohort program (totaling $955,642) which pertained to fiscal years 2009 and 2010 but were recognized as revenue in fiscal year 2011. One employee benefits expense transaction (totaling $92,718) which pertained to fiscal year 2010 but was recognized as expense in fiscal year 2011. One supplies and services expense transaction (totaling $34,553) which pertained to fiscal year 2011 but was recognized as expense in fiscal year 2012. Two travel expense employee reimbursements (totaling $5,120) which pertained to fiscal year 2010 but were recognized as expense in fiscal year 2011. 20 (Continued)
UIVERSIT OF ILLIOIS Schedule of Findings and Questioned Costs ear ended June 30, 2011 Current Findings Governmental Auditing Standards One scholarships and fellowships expense transaction (totaling $1,250) which pertained to fiscal year 2010 but was recognized as expense in fiscal year 2011. Two supplies and services expense transactions (totaling $44,020) which pertained to fiscal year 2010 but were recognized as expense in fiscal year 2011. Generally accepted accounting principles require transactions to be reported in the period they are incurred. Additionally, the Fiscal Control and Internal Auditing Act (Illinois Compiled Statutes Chapter 30 Section 10/3001), requires the University to establish and maintain a system, or systems, of internal fiscal and administrative controls, which shall provide assurance that: (1) resources are utilized efficiently, effectively, and in compliance with applicable law; (2) obligations and costs are in compliance with applicable law; (3) funds, property, and other assets and resources are safeguarded against waste, loss, unauthorized use, and misappropriation; (4) revenues, expenditures, and transfers of assets, resources, or funds applicable to operations are properly recorded and accounted for to permit the preparation of accounts and reliable financial and statistical reports and to maintain accountability over the State s resources; and (5) funds held outside the State Treasury are managed, used, and obtained in strict accordance with the terms of their enabling authorities and that no unauthorized funds exist. The University s system of internal controls should include procedures to accurately assess whether expenditures and revenues are reported in the appropriate period. In discussing these conditions with University personnel, they stated that the units associated with the exceptions did not adequately understand/follow the procedures required to record the transactions in the proper period. Failure to accurately analyze cash disbursements and receipts subsequent to year end may result in the misstatement of the University s financial statements. (Finding Code 11-01, 10-03, 09-03) Recommendation: We recommend the University review its current process to assess the completeness of its revenue and expense accruals at year end and consider changes necessary to ensure all period end accounts payable and accounts receivables are accurately identified and recorded. University Response: Accepted. The University will review existing procedures in these areas and take corrective action to address the recommendation in this finding. 21 (Continued)
UIVERSIT OF ILLIOIS Schedule of Findings and Questioned Costs ear ended June 30, 2011 Current Findings Governmental Auditing Standards Finding 11-02 Inadequate Controls over User Access to Information Systems The University has not established adequate internal controls over access to the information systems used in its financial reporting process. The University operates an Enterprise Resource Planning (ERP) system to manage the activities of the University, in addition to operating and supporting information systems for purchasing and human resource. The University functions in a highly distributed operating environment with several thousand users having varying types of system access. Access is granted to users of the University s information systems based on standardized user access profiles. The standardized user profiles are intended to assist the University in limiting access to the information systems based upon the assigned job functions of the specific users to which the profiles are assigned. The University has implemented a process to review standardized user profiles, train unit security contacts, and perform an annual access review for the Banner ERP system. However, the annual access reviews are not consistently and formally documented to provide evidence supporting the results of each user review. Further, the University has not performed a periodic access review of the human resources supporting information system. In addition to the internal control deficiencies identified above, during our review of user access rights we identified several users with access rights that were inappropriate based on their roles and job functions presenting segregation of duties conflicts and the risk that erroneous or fraudulent transactions may be recorded in the general ledger. We identified the following exceptions regarding improper authorization or inappropriate access rights based upon review of each user s job function: There are 161 terminated users (out of 418 total terminated users) with active accounts that were not removed in a timely manner. There were 43 users (out of 99 total users) with inappropriate access to update accrued leave or sick time in Banner. one of these 43 users appeared to have performed inappropriate transactions. There were 8 users (out of 44 total users) with inappropriate access to release financial holds from a student account in Banner. There were 3 users (out of 84 total users) with inappropriate access to update employee pay rates in Banner. There was one user (out of 21 total users) with inappropriate access to update tuition rates and fees and student rate codes in Banner. There was one user (out of 45 total users) with inappropriate access to apply and unapply payments on student accounts in Banner. There was one user (out of 14 total users) with inappropriate access to update the vendor master file in Banner. There were two users (out of 17 total users) with inappropriate administrative access to the human resources supporting information system. There was one generic user account (out of 4,481 total user accounts) with inappropriate access to the purchasing information system. 22 (Continued)
UIVERSIT OF ILLIOIS Schedule of Findings and Questioned Costs ear ended June 30, 2011 Current Findings Governmental Auditing Standards There were two new user accounts (out of a sample of 30 new user accounts) that were not properly authorized. Further, we noted reviews of terminated employees with access to the information systems are not being performed effectively. Beginning in August 2010, the University s information technology department began implementing procedures to perform terminated employee access reviews on a daily basis. However, this procedure alone was not sufficient to provide timely removal of access of terminated employees. In addition, there are no procedures in place to monitor user access rights for employees who transfer positions and change job functions. The Fiscal Control and Internal Auditing Act (Illinois Compiled Statues Chapter 30 Section 10.3001), requires the University to establish and maintain a system, or systems, of internal fiscal and administrative controls, which shall provide assurance that: (1) resources are utilized efficiently, effectively, and in compliance with applicable law; (2) obligations and costs are in compliance with applicable law; (3) funds, property, and other assets and resources are safeguarded against waste, loss, and unauthorized use; (4) revenues, expenditures, and transfers of assets, resources, or funds applicable to operations are properly recorded and accounted for to permit the preparation of accounts and reliable financial and statistical reports and to maintain accountability over the State s resources; and (5) funds held outside the State Treasury are managed, used, and obtained in strict accordance with the terms of their enabling authorities and that no unauthorized funds exist. The University s system of internal controls should include procedures to ensure access rights granted to University employees are appropriate and to document monitoring procedures of the appropriateness of access levels on a continuing basis. In addition, generally accepted information technology guidance endorses the development of well-designed and well-managed controls to protect computer systems and data. Effective computer security controls provide for safeguarding, securing, and controlling access to systems, properly segregating incompatible duties, and protecting against misappropriation. In discussing these conditions with University personnel, they stated that they agreed with the exceptions noted in this finding. They further noted that work had been underway to address many of the weakness noted. Failure to properly assign and monitor user access rights may result in erroneous or fraudulent transactions being recorded in the general ledger system. Without adequate security over access rights, there is a greater risk that unauthorized changes or additions to the University s financial systems could occur and not be detected in a timely manner. If access rights are not reviewed and updated based on job responsibilities on a regular basis, there is a greater risk that transactions can be recorded by unauthorized individuals. (Finding Code 11-02, 10-01, 09-01, 08-05) Recommendation: We recommend the University implement procedures to formally document the reviews of user access rights, and maintain documentation of the results of those reviews, to ensure that the access rights granted to each user are appropriate based on their job responsibilities and that the planned level of segregation of duties is achieved on a continuing basis. Additionally, we recommend the University implement procedures to monitor user access rights for employees who transfer positions and change job functions and implement procedures to ensure reviews of user access rights for terminated employees are effectively performed. 23 (Continued)