78

Figure 17: KSU Modules Reviewed in Fiscal Years 2019, 2020, and 2021.

MODULE DESCRIPTION 2019 2020 2021

F FINANCE - PURCHASING ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓

G GENERAL ✓ ✓ ✓ ✓

H HUMAN RESOURCES ✓ ✓ ✓ ✓ ✓ ✓

N POSITION CONTROL ✓ ✓ ✓

P PAYROLL/PERSONNEL

R FINANCIAL AID ✓ ✓ ✓ ✓ ✓

S STUDENT - ADMISSIONS ✓ ✓ ✓ ✓ ✓ ✓ ✓

T ACCOUNTS RECEIVABLE ✓ ✓ ✓ ✓ ✓

Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4

ADP ✓ ✓ ✓ ✓ ✓

Source: APA, based on information provided by KSU's Chief Information Officer.

KSU stated that prior to FY 2020, the reviews were completed by calendar year. Also, due to the COVID-19 Pandemic, audits for the first three quarters were completed during the fourth quarter of FY 2020. In addition, the documentation provided shows that while audit reports were generated for ADP during FY 2019, these reports were not reviewed.

Banner Configuration

Per KSU’s Chief Information Officer (CIO), configuration of Banner was not handled properly in August 2010 when the system was first being implemented. To grant access to Banner, accounts and users are assigned to a user class. The user class contains forms or jobs that a user may access, and users can either be granted query or modify access to these forms and jobs. There are 27 user classes currently not assigned to Banner users. Necessity of these user classes could not be confirmed.

Also, there are 28 additional user classes that contain 'KSU' in the name. While these user classes are being used by staff, they do not adhere to KSU's standard naming convention. According to KSU staff, these were created by a former employee in August 2010. KSU's IT staff indicated that this has been a known issue over the years and discussed in the past, but no action was taken to address the issue. KSU staff are currently investigating to determine if these user class names can be changed without affecting current staff.

Banner Access

Review of Banner access identified the following issues:

  • Use of four group accounts, with both query and modify access:
  • Three of these accounts existed for use by external auditors during annual audits by state, federal, and external agencies.
  • The fourth group account was established for the Bursar/Registrar offices to remove exclusive holds on student accounts.

Use of group accounts is a security concern since they do not allow organizations to track or identify who is using the account. Access level should be granted based on individual need. Additionally, short-term access needed for reviews or audits, should be limited to