Finding 19: KSU Did Not Establish Proper Controls Over Procurement Approval Levels within the Banner Accounting System

Recommendations:

  • KSU remove the Purchasing Director’s ability to approve or alter their own approvals within Banner. KSU’s IT department should be responsible for all changes made to the approval queue within Banner.
  • KSU should implement procedures to monitor the Banner Approval Queue regularly to ensure only properly authorized users and approvals are configured.
  • KSU begin using effective and termination dates when altering approvals within Banner. This will allow KSU to maintain a historical account of the approval queue and properly monitor changes made to the information within the queue.

Management Response: Concur

The management of Banner Approval queues has been reassigned from the Purchasing Director to the Controller's Office. Additionally, the EVP of Finance monitors the approval queues quarterly. The reassignment and quarterly review change will be included in the revised Finance and Administration policy as stated below:

“The management of Banner approval queues shall be the responsibility of the Controller’s Office. The Banner Approval queues shall be monitored quarterly by the AVP of Finance to ensure that only properly authorized users and approvals are configured. This policy is intended to ensure the security and integrity of our financial systems, and to prevent unauthorized access or misuse of these systems”.

KSU shall implement procedures to monitor the Banner Approval Queue regularly, the EVP of Finance will monitor the approval queues quarterly.

KSU will begin using effective and termination dates when altering approval levels within Banner. Also, training on the use of effective and termination dates in approval queues was conducted by an Ellucian Purchasing Consultant on 4/3/2023 with members of Purchasing, Controller's Office, AVP of Finance and IT in attendance.

Finding 20: KSU Did Not Implement Adequate Password and Identification Controls

Recommendations:

  • KSU configure their Network and Banner to require passwords to be changed prior to first use.