81

In response to the APA’s request for support to substantiate ADP users, KSU’s IT staff provided HR forms for some employees. However, HR documentation was not provided for all six selected users. Review of HR forms identified the following inconsistencies:

• Four users did not have the University Policies & Procedures form on file.
• oFor the two forms received, one user signed as the Supervisor for herself and the other user's supervisor did not sign the form.
• Five users did not have the Departmental Checklist on file.
• Five users did not have the Receipt of Acknowledgements from on file.
• oThe one form received was properly signed.

One of the six users identified above was an ADP consultant. KSU does not have a process or procedure in place to address vendor or consultant access to ADP.

Additionally, review found two out of 173 users assigned a Manager profile had not logged into ADP to register to create an ID. One of these two users was also assigned the Time and Attendance profile. Because these users had been granted access but had not registered to create an account to login, it does not appear their access to ADP is necessary.

Again, in light of the role of the former EVP for Finance over both KSU’s financial operations and Information Technology, the former EVP for Finance’s access to ADP between FY 2019 and FY 2021 was reviewed. Using historical audit reports that were generated by KSU during quarterly audits, it was determined that the former EVP for Finance was a Product User during FY 2019 and was downgraded to a basic Self-Service User beginning FY 2020. A Product User is responsible for administering ADP services such as payroll, human resources, or benefits. They can also access and update their personal account information. A Product User cannot perform security administrative functions such as resetting passwords or issuing administrator access. KSU did not have any documentation on file to support the former EVP for Finance’s access and was unable to explain the change in access.

User Passwords

Finally, KSU’s Password Policy states that a user is locked out of the system after three failed login attempts. However, in practice, KSU’s setting allowed five failed login attempts. While locking a user out of the system after three failed login attempts is more secure than five failed attempts, KSU staff stated they plan to update their policy to reflect the setting of five failed login attempts in order to bring them in line with other state universities.

Recommendations

We recommend:

• KSU update all Banner and ADP policies and procedures to ensure staff can properly perform their job duties. Given the amount of turnover at KSU, it is imperative to have up-to-date policies and procedures that staff can follow to ensure processes are performed as intended by management.