Page
19
Finding 3: KSU Failed to Adequately Support Its Internal Audit Function and Minimal Effort was Made to Ensure Internal Audit Reviews Were Completed and Communicated to Its Board.
KSU’s internal audit function was intermittent in its existence and execution, was inadequately supported when it did exist, and was at times actively delayed. Management’s lack of support of the internal audit function contributed to the weak oversight of the control environment at KSU and prevented issues from being detected and communicated.
During the special examination time period, internal audit services were secured at the request of the Board. These services were not supported by the former EVP for Finance and limited information was communicated to the Board. A preliminary report in July 2019 was not communicated to the President or the Board. The former EVP for Finance was provided the report but did not respond to the firm and the firm's attempts to have the report finalized. Without management's response, the report was not finalized, and the results were not communicated to the Board. In December 2019, KSU hired an Internal Auditor approved by the Board. Though the Board approved an Internal Audit Plan for FY 2021, there was no evidence of any work being completed or communicated. One of the primary reasons reported for the lack of work performed by the Internal Auditor was that the former EVP for Finance would not meet with him and his access to people and records was limited.
As to the contracted internal audit work, KSU retained a CPA firm from September 11, 2018, through June 30, 2019, for a price not to exceed $110,000. On March 4, 2019, this firm was asked to provide recommendations for improving KSU's procedures, efficiency, document flow, and internal control system related to the purchase card (P-card) program. The completed draft report was initially given to KSU financial personnel in July 2019 for response, but the report was never finalized. This report's observations and recommendations included:
Enforce appropriate segregation of duties between credit card usage and transaction approvals
Monitor P-card usage against other forms of payment.
Update the P-card policies and procedures manual.
Implement training for P-cardholders and approvers.
Timely deactivate P-cards held by terminated employees.
Policy for supervisors to review and approve cardholder statements was not enforced during the review period.
Current structure allows cardholders to dictate appropriate usage and potentially make improper or unnecessary charges to University funds without repercussion.
P-cards were used to circumvent the PO process after requests were denied by the Purchasing department.
None of the former KSU Board members interviewed or the former President were aware of this report, though some were aware of the contract's existence. Emails from the CPA firm to the former EVP for Finance dated January 23, 2020, and January 31, 2020, requested a meeting to discuss the report and have it finalized. The January 23, 2020, email stated that an action plan was not needed to have it finalized if that was the University's decision. According to the firm, the