Finding 16: KSU Failed to Maintain Access to Records Due to Unpaid Invoices.....75 CHAPTER 4: Information Technology.....77 Finding 17: KSU Did Not Implement Adequate Access Controls Over Its Accounting and Payroll Systems.....77 Finding 18: KSU Does Not Have User Security Auditing Enabled for The Banner Accounting System.....83 Finding 19: KSU Did Not Establish Proper Controls Over Procurement Approval Levels within the Banner Accounting System.....84 Finding 20: KSU Did Not Implement Adequate Password and Identification Controls.....86 Appendices.....88 Kentucky State University’s Response.....111