and process mapping is being provided through our Banner Optimization project, Banner Advisory Services, and Your Part Time Controller.
Current password policy was updated to only allowed three attempts instead of five. It was originally 3 but changed to 5 during COVID to provide further customer service for employees and students access systems remotely.
The management of Banner Approval queues has been reassigned from the Purchasing Office to the Controller's Office. Additionally, the EVP of Finance will monitor the approval queues quarterly. This reassignment and quarterly review change will be included in the revised Finance and Administration policy as stated below:
The management of Banner approval queues shall be the responsibility of the Controller's Office. The Banner Approval queues shall be monitored quarterly by the AVP of Finance to ensure that only properly authorized users and approvals are configured. This policy is intended to ensure the security and integrity of our financial systems, and to prevent unauthorized access or misuse of these systems.
Finding 18: KSU Does Not Have User Security Auditing Enabled for The Banner Accounting System.
Recommendations:
KSU is working with the vendor to enable security auditing on the Banner Oracle database. Ellucian informed KSU on April 21, 2023 that this feature could be turned on. A project initiation request has been started with Ellucian to enable Banner Unified Auditing.
Regular monitoring is taking place to user access, and monitoring reports for Banner and ADP will be performed during quarterly audits. Adequate documentation will be maintained from all Banner module managers to ensure reviews are being performed for each module. An additional level of review will be conducted by the either the AVP or VP for respective areas.
Although an exception was identified during the examination period, KSU continues to perform quarterly audits of Banner and ADP; adequate documentation will be obtained from each of the Banner module managers as verification of reviews conducted for each module.