80
user, it was more efficient to add jobs and forms to a user class that was relative to the user role. As such, they believe the initial Banner Access Form is the only support that was needed to grant the additional access. KSU also relied on verbal approval to grant and change access to Banner.
KSU staff stated that IT knows how to set up the security roles and grant query or module access based on the job function and/or the request from a user's supervisor or Banner module manager. KSU's IT staff will contact the user or Banner module manager to find out what is needed if the Banner Access Form does not have selections noted or if they do not know the user's role or job function. This is done either through email or verbally over the phone. The user's Banner Access Request Form is not updated to reflect what action is taken based on the verbal communication.
The former EVP for Finance’s access request forms associated with the Finance, Human Resources, and Accounts Receivable modules requested the same access as the individual who held the EVP of Finance position prior to him. Granting access in this manner is considered access cloning and is not a good business practice. With access cloning, users collect access rights over time that should be revoked when they change roles, or they complete projects. Risks with access cloning primarily come from users who can circumvent controls and self-approve transactions for personal gain.
As KSU’s Information Technology department reported directly to the former EVP for Finance, a transaction history report was requested for the former EVP for Finance to review his activity in Banner between FY 2019 and FY 2021. KSU’s Banner vendor advised KSU on how to retrieve these transactions from Banner using the Transaction History Table and Transaction Detail Tables. KSU indicated that these two tables did not have any
The former EVP for Finance’s activity in Banner could not be reviewed to determine if it was appropriate based on the access granted to him.
transactions for the former EVP for Finance during this time period. Therefore, the former EVP for Finance’s activity in Banner could not be reviewed to determine if it was appropriate based on the access granted to him.
As noted in Finding 18, Banner was not configured to capture access-related security events. Therefore, historical audit reports generated by KSU during quarterly audits were reviewed to compare the former EVP for Finance’s access in Banner between FY 2019 and FY 2021. This review revealed additions and deletions to various jobs and forms. Also, changes to the access level (from query to modify and vice versa) of certain forms was also identified. None of these changes was supported by a properly authorized Banner Access Form or email.
Six ADP users were selected and reviewed to determine whether documentation was maintained by KSU to support the access granted to this payroll system. From review, it was determined that none of the six users selected had documentation on file to support the access granted to ADP. According to KSU staff, documentation for employees is not needed since new employees only get employee or self-service access, which is a read-only access. However, of the six users reviewed, there were at least three different profiles that were assigned to employees. How KSU identified the profiles to assign to each individual could not be determined.