If a third-party database is used, KSU policies and procedures incorporate actions necessary to prevent the temporary or permanent loss of data.
KSU shall ensure any documentation supporting an expenditure from university funds is maintained for review.
KSU has paid outstanding invoices from third party administrator (Concur) and has obtained access to historical records.
In order to have access to historical records, KSU has determined to continue using third-party system until completion of audit procedures for FY21 and FY 22.
KSU will ensure contract terms and conditions include data loss prevention terminology and future access to records maintained by third-party.
Finding 17: KSU Did Not Implement Adequate Access Controls Over Its Accounting and Payroll Systems.
KSU update all Banner and ADP policies and procedures to ensure staff can properly perform their job duties. Given the amount of turnover at KSU, it is imperative to have up-to-date policies and procedures that staff can follow to ensure processes are performed as intended by management.
KSU follow their Password Policy and have a failed login attempt setting of three as opposed to five.
KSU IT staff return Banner Security Forms to supervisors and Banner module managers if the proper selections are not made, and proper signatures are not captured on the form. Actions taken by IT that affect a user's access to Banner should be documented on the form or emails should be retained to support communications. Also, KSU should create a security form to be used when granting access to ADP.
KSU continue performing quarterly audits of Banner and ADP. Adequate documentation should be obtained from each of the Banner module managers to ensure reviews are being performed for each module. The full audit reports should be used by IT staff and Banner module managers to compare and confirm access is appropriate for all users.
KSU is currently reviewing and revising all Banner, ADP and other university's policies and procedures to ensure staff can properly perform their job duties. Each department is working on Standard Operating Procedures. Also, training