Ninety-Day_Response_to_APA.pdf — PaddleOCR-VL (Baidu)

Finding 18: KSU Does Not Have User Security Auditing Enabled for The Banner Accounting System.

Recommendations:

KSU work with the vendor to enable security auditing on the Banner Oracle database.

Response: KSU has not implemented this recommendation. A project request has been initiated with Ellucian to enable security auditing (Banner Unified Security) on the Banner Oracle database.

KSU management regularly monitor changes to user access, and reports on this monitoring should be included in the quarterly audits.

Response: KSU has implemented this recommendation. Information Technology has drafted a Banner and ADP guideline which includes language to address the recommendation.

Finding 19: KSU Did Not Establish Proper Controls Over Procurement Approval Levels within the Banner Accounting System

Recommendations:

KSU remove the Purchasing Director's ability to approve or alter their own approvals within Banner. KSU's IT department should be responsible for all changes made to the approval queue within Banner.

Response: KSU has not implemented this recommendation. The Purchasing Director does not approve or alter their own approvals, and the University is working on permanently removing that ability. The University does not wish for the IT department to be the party responsible for all changes made to the approval queue within Banner. The University is considering alternative options.

KSU should implement procedures to monitor the Banner Approval Queue regularly to ensure only properly authorized users and approvals are configured.

Response: KSU has not implemented this recommendation. The University will include the review as part of its quarterly Banner Security Audit review.

KSU begin using effective and termination dates when altering approvals within Banner. This will allow KSU to maintain a historical account of the approval queue and properly monitor changes made to the information within the queue.

KSU has not implemented this recommendation. The Purchasing Director does not approve or alter their own approvals, and the University is working on permanently removing that ability. The University does not wish for the IT department to be the party responsible for all changes made to the approval queue within Banner. The University is considering alternative options.

Response: KSU has implemented this recommendation.