84
KSU did not establish proper controls within the Banner accounting system to ensure that any changes to approvers or approval limits were authorized and tracked. Purchase approvers and approval limits are established within the system’s Approval Queue. This information is used to ensure that purchases are approved by the correct staff person based on the dollar amount of the purchase. Due to the lack of controls, the Purchasing Director was able to establish and alter users and limits without any authorization. In addition, Banner does not track when edits or changes to the Approval Queue occur. Purchasing personnel administer the purchasing procedures and should not be able to establish or alter Banner’s purchasing controls.
KSU provided a report showing the current purchase Approval Queue configuration and access. A report showing the approvals established in Banner between FY 2019 and FY 2021 could not be provided. KSU management stated past Purchasing Directors did not use effective or termination dates when changing the users in the queue. When an approver changed an approval level or a user no longer needed to be in the Approval Queue, instead of using effective or termination dating for the change, both former Purchasing KSU could not provide a report showing approvals established in Banner between FY 2019 and FY 2021.
KSU could not provide a report showing approvals established in Banner between FY 2019 and FY 2021.
Directors would either delete or overlay the old approver's name with the new approver's name.
As previously stated, the KSU Purchasing Director is responsible for all changes to the Approval Queue. This includes making changes to their own approval level. Further noted, Banner does not generate any type of notification when changes are made to the Approval Queue. Also, since creator/approver access is based on the Banner Request form that is submitted to the Purchasing department, the only changes reviewed or approved are for employees the former EVP for Finance supervises.
According to the National Institute of Standards and Technology (NIST) 800-53, control AC-5 Separation of Duties, the organization should:
Further noted by NIST 800-53, separation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion. Separation of duties includes dividing mission or business functions and supporting functions among different individuals or roles, conducting system support functions with different individuals, and ensuring that security personnel who administer access control functions do not also administer audit functions. Because separation of duty violations can span systems and application domains, organizations should consider the entirety of systems and system components when developing their policy on separation of duties.