===== PAGE 1 ===== # 333KENTUCKY STATE UNIVERSITY APA SPECIAL EXAMINATION MANAGEMENT RESPONSE ## Findings, Recommendations and Management Responses Finding 1: KSU's Weak Internal Control Environment, Coupled with Poor Fiscal Management Practices, Led to a Pervasive Lack of Accountability. ## Recommendations: While each finding of the report provides specific recommendations, we recommend that KSU management work to improve the “tone at the top” of its internal control environment. Internal controls should be enforced at all levels, expenditures should be fully supported by documentation that is properly retained, budget limits should be consistently enforced, and monitoring efforts should be fully implemented and supported. ## Management Response: Concur While each of the specific findings and recommendations has been addressed separately in our responses below, KSU has taken steps to address findings noted. KSU is working to improve the “tone at the top” of our internal control environment. We understand that Internal controls must be fully implemented and monitored to maintain efficiency effectiveness of operations. Also, identifying and strengthening weak internal controls should be a priority to ensure operations are efficient and effective to reduce fraud, waste, or abuse. Establishing and maintaining complete financial records is critical in the reliability of financial data for decision making in the areas of budgeting, procurement and contracting, expenditures, travel, expense reimbursement, and federal grant funding. Preventive controls as it relates to unapproved or over budgeted spending will be address in the revise policy and procedures for Capital Project, Endowment, Payroll and Payroll Related Expense and Travel Disbursements and other functional areas as needed. Finding 2: Examination Procedures Were Limited Due to the Condition of KSU Records, Policies, and Significant Staff Turnover. ## Recommendations: • KSU maintain supporting documentation for all expenditures so that audit procedures can be performed. Complete supporting documentation is required to determine the validity and allowability of expenditures. ===== PAGE 2 ===== • KSU establish an organized system for retaining its financial and operational records. This system should ensure all records documenting financial activity are maintained in a manner by which records are readily identifiable and available for review. • KSU staff receive training on the retention of documents. This training should be repeated periodically. • KSU invest in an updated financial accounting system and provide appropriate level training to financial personnel. Training should be given on a continual basis to build staff to a proficiency level so that they can run the reports necessary to perform their work duties and readily address operational and financial issues as they arise. ## Management Response: Concur KSU shall ensure all supporting documentation is attached for all expenditures. Information relating to expenditures will be retained in Banner accounting system. KSU shall establish an organized system for retaining financial and operational records through a centralized repository. KSU shall maintain supporting documentation for all expenditures so that audit procedures can be performed. Complete supporting documentation is required to determine the validity and allowability of expenditures. KSU shall establish an organized system for retaining its financial and operational records. This system should ensure all records documenting financial activity are maintained in a manner by which records are readily identifiable and available for review. KSU staff shall receive initial and periodic training on the retention of documents. KSU is currently reviewing the Ellucian Spend Management suite. This software further extends Banner functionality in the areas of purchasing, invoicing and travel. Banner training is ongoing and training will continue Summer 2023. Training shall be given on a continual basis to build staff to a proficiency level so that they can run the reports necessary to perform their work duties and readily address operational and financial issues as they arise. ===== PAGE 3 ===== Finding 3: KSU Failed to Adequately Support Its Internal Audit Function and Minimal Effort was Made to Ensure Internal Audit Reviews Were Completed and Communicated to Its Board. ## Recommendations: • The KSU Board or President, as appropriate, demonstrate the importance of the internal audit function by appropriately disciplining any officer, executive, or staff who fails to fully assist the internal audit function. • The KSU Board, or committee of the Board, continue to actively engage with the firm under contract to provide internal audit services. The Board should require that all issues encountered by the external firm in conducting its work, including delays and lack of documentation, be reported directly to the committee or full Board. •KSU, in conjunction with its contracted internal auditor, implement a hotline to receive anonymous concerns and complaints and develop policies related to an externally managed hotline to ensure a consistent process is established that will improve and document the procedures to assign, investigate, monitor, resolve, and report concerns and complaints, including those involving potential fraud and abuse. Once the policy is developed, it should be approved by the Board, and incorporated into its catalog of policies. • KSU update its website to make the hotline more easily accessible to employees and the public. • A summary report of hotline activity be periodically provided to the Board or a designated committee to ensure their awareness of any significant matters impacting the operations of the University. • The Board develop a process by which it can independently keep track of approved contracts and follow up on the status of contracts, including when there should be a deliverable from the contract. • KSU ensure findings and recommendations from the Procurement Card internal audit, performed by its prior internal auditing firm, are reviewed and considered in light of current procedures and activity. ## Management Response: Concur The internal auditor reports directly to the Audit Committee and any infractions respecting the internal audit function are directed by the committee chair to the President for action. As noted on page 21 of the Draft Audit Report dated March 10, 2023, KSU Board approved a new contract for internal audit services to be provided by external firm. On October 10, 2022 the KSU Board approved CBIZ RISK & ADVISORY ===== PAGE 4 ===== SERVICES, LLC to fulfil its Internal Audit function. CBIZ is currently working with the Audit Committee to perform audit procedures as directed. Areas include; operational, financial, information technology, compliance, risk assessments, fraud investigations, advisory and consulting, data analytics and professional training. Also, CPE has been given oversight responsibilities and has conducted a review of key areas. The review commented in a Management Improvement Plan (MIP). Weekly meeting is held with management and the Board. Moreover, the Board selected the accounting firm Blue & Co. as the External Auditor. Quarterly reports are provided to management and the Board on outstanding findings and recommendations. Also, a schedule of audit activities is presented to management and the Board. KSU ethics tip-line hosted by The Security Voice has been fully executed. Testing was completed on May 15th. Security Voice is our external firm hired to be managed hotline to ensure a consistent process is established that will improve and document the procedures to assign, investigate, monitor, resolve, and report concerns and complaints, including those involving potential fraud and abuse. KSU, in conjunction with its contracted internal auditor and third-party firm, has implemented a hotline to receive anonymous concerns and complaints and develop policies related to the hotline. Also, the ethics hotline will be included in the revised HR policy upon Board approval. Contracts will be tracked and monitored to ensure terms and conditions are met. President will review and approve contracts as warranted. KSU shall update the website to make the hotline more easily accessible to staff, students and the public. The ethnic hotline is active and will be posted on the website by June 1, 2023. Periodically summary of hotline activities will be submitted to the Board to ensure their awareness of any significant matters impacting the operations of the University. KSU has developed a process by which it can independently keep track of approved contracts and follow up on the status of contracts. Currently, all contracts are under review by legal and will be maintained in the Lexicon system as well as Banner going forward. KSU has reviewed prior year's findings and recommendations from the Procurement Card internal audit, performed by its prior internal auditing firm. The results of this review lead to a request for our current internal audit firm (CBIZ) to conduct a university wide credit card audit of procedures and activities. ===== PAGE 5 ===== ## Finding 4: Lacks Controls to Prevent Overspending and Failed to Ensure Completeness of its Accounting Records ## Recommendations: • KSU address the deficiency with the Banner system so expenditures that go over the budget are rejected and must be reviewed, and a budget revision be made before the override approval is given by the EVP for Finance. Budget issues should be discussed with the department head responsible for managing the budget and budget amendments should be presented to the Board. • KSU provide continuous efforts to ensure that purchase orders are not circumvented. While emergencies will always occur, this situation should be rare. Documentation should be maintained when the PO process is not followed. • KSU review its reliance on credit cards to meet daily operational needs. Any employee provided a credit card should require supervisory review and written approval of credit card spending. The review must ensure not only that the documentation exists, but also that the purchase was for a university necessity and not personal purpose, and sufficient budgeted funds exist to support the purchase. Additionally, if the expense relates to items purchased as gifts or for meals, documentation should include names of individual recipients or attendees. Additionally, credit card usage by executive level staff, including the president, should be routinely reviewed by internal audit and a report made periodically to the Board or a committee of the Board. • As with all financial activity, KSU should record credit card expenditures in Banner so that the actual vendor transactions are entered in the accounting system for the expense to be attributed to a vendor when a vendor report is needed for tracking purposes. • KSU address the issue within the system that allows voiding of checks in the check writing system without being noted in the Banner system. This is an information system issue deficiency that needs to be addressed by KSU so that the system reconciles with their bank account moving forward. • KSU provide continuous efforts to ensure that purchase orders are not circumvented. While emergencies will always occur, this situation should be rare. Documentation should be maintained when the PO process is not followed. • KSU review its reliance on credit cards to meet daily operational needs. Any employee provided a credit card should require supervisory review and written approval of credit card spending. The review must ensure not only that the documentation exists, but also that the purchase was for a university necessity and not personal purpose, and sufficient budgeted funds exist to support the purchase. Additionally, if the expense relates to items purchased as gifts or for meals, documentation should include names of individual recipients or attendees. Additionally, credit card usage by executive level staff, including the president, should be routinely reviewed by internal audit and a report made periodically to the Board or a committee of the Board. ===== PAGE 6 ===== • As with all financial activity, KSU should record credit card expenditures in Banner so that the actual vendor transactions are entered in the accounting system for the expense to be attributed to a vendor when a vendor report is needed for tracking purposes. • KSU address the issue within the system that allows voiding of checks in the check writing system without being noted in the Banner system. This is an information system issue deficiency that needs to be addressed by KSU so that the system reconciles with their bank account moving forward. ## Management Response: Concur As noted, KSU accounting system (Banner) has general controls currently in place that does not allow requisitions (auto rejects) which are overbudgeted to be processed without; 1. budget transfer and/or 2. budget override. Only authorized approvers can perform overrides (mitigating control) once approved from VP of Finance and Administration/CFO. When the requisition is over budget the original requestor must submit a budget transfer to the budget manager; the requestor is not permitted to make their own transfers. The budget manager obtains prior approval from the VP of Finance and Administration/CFO prior to making the transfer. KSU will implement monitoring controls to ensure purchase orders are not circumvented. Monitoring controls are actions performed at the management level designed to provide assurance that information on the operations is appropriate, appears reasonable, and is consistently prepared. KSU has implemented a monitoring internal control for invoices without PO's. The Controller has established a process in which exception reports are reviewed for any invoices without a PO. We will continue to reenforce adherence to the stated policy of "NO PO, NO PAY". KSU has conducted training on procurement processes and procedures noting exceptions. KSU is in the process of revising the credit card policy to include review and approval of credit card purchases. Upon reviewed of reliance on credit cards to meet daily operational needs, KSU has decreased the usage of credit cards. All credit card purchases are required to be reviewed and approved by supervisors. Also, the Purchasing Director and AVP of Finance and Administration have initiated a second level of review and approval which requires supporting documents for justification of purchase. Additionally, credit card usage by executive level staff, including the president, shall be routinely reviewed by internal audit and a report made periodically to the ===== PAGE 7 ===== Board or a committee of the Board. Mentoring and detective controls of credit card purchases was implemented on May 1, 2023. Credit card policy is currently under review/revision. KSU shall record credit card expenditure in Banner with actual vendor transactions are entered in the accounting system for the expense. Credit card expenditures relating to vendor payments will be recorded and monitored in the Banner for tracking. Since Banner does not have functionality to allow check voiding information from intelacheck back into Banner, internal procedures are being updated to include once the check is voided in Intellicheck it also needs to be voided in Banner. When reestablishing a new check, it identifies voided check. Evasion (Intelacheck) will be mirrored with Banner to prevent unrecorded voided checks. A review of voided checks listed in IntelaCheck will be compared to Banner. KSU shall review system controls to ensure voided checks are recorded in Banner system. The check processor Envision system (Intelacheck) voided checks will be reconciled with Banner system of voided checks to prevent overpayment, duplicate payments and/or unrecorded voided checks. Voided/or missing payments will be reviewed monthly. Checks identified in Intelacheck will be compared and noted in the Banner system. KSU will revise policies and procedures to include comparing financial activity to budgeted activity on a monthly or quarterly basis and investigating any unexpected variances above or below the approved thresholds established. Monitoring financial activity on a more frequent basis will help identify potential financial issues. Finding 5: KSU's Outdated or Rogue Policies and Procedures Result from An Undefined Policy Setting Process. ## Recommendations: • KSU's Board consider employing or designating an individual whose primary responsibility is to serve as Secretary to the Board, independent of the university president position. This position would report to the Board and be responsible for timely collection and distribution of Board materials to each Board member and could bring forward to the Board reminders of past tabled actions or provide status on prior Board actions, such as status of the implementation of Board approved policies. This individual may also be responsible for updating KSU's catalog of policies. Access to add a policy into the repository should be restricted to ensure policies are properly processed before being made available to employees and students. • In establishing and updating policies, KSU consider using language in the policy identifying clearly that this policy replaces existing policies (known or unknown) to avoid ===== PAGE 8 ===== the existence of conflicting policy and actions being taken by KSU employees based on an outdated policy. • KSU provide routine training to KSU personnel impacted directly by new or revised policy changes to ensure their understanding of the policy. • In establishing and updating policies, KSU consider using language in the policy identifying clearly that this policy replaces existing policies (known or unknown) to avoid the existence of conflicting policy and actions being taken by KSU employees based on an outdated policy. • KSU provide routine training to KSU personnel impacted directly by new or revised policy changes to ensure their understanding. ## Management Response: Concur Deputy General Counsel was appointed. KSU's Board appointed Deputy General Counsel to serve as Secretary to the Board, independent of the university president position. This position reports directly to the Board and is responsible for timely collection and distribution of Board materials to each Board member and brings forward to the Board as agenda items of past tabled actions or provide status on prior Board actions, such as status of the implementation of Board approved policies. The Secretary is responsible for updating KSU's catalog of official documents to include policies, procedures and contracts. Access to add an official document (policies) into the repository has been restricted to ensure official documents (policies) are properly processed (vetted) before being made available to stakeholders (employees, staff, vendors and students. Deputy General Counsel will be responsible for maintain and updating the central repository along with newly hired librarian. KSU has implemented a template for clearly identifying policy status which identifies various elements on the policy cover. Upon Board approval, KSU will include in the heading of the document the following; effective, termination or cancellation date. Whether it is a revision or newly created on all policies and procedures. Also, when existing policies are revised, amended or updated, the revision number and supersede information will be listed. KSU will conduct routine training to KSU personnel impacted directly by new or revised policy changes to ensure their understanding of the policy. In accordance with the Management Improvement Plan - all policies will be reviewed and revised as needed with clear, concise language. Training will start following final Board approval. ===== PAGE 9 ===== Finding 6: KSU Failed to Implement an Effective System of Internal Controls Over Federal Grant Expenditures Putting Over $3 Million Dollars in Federal Funds at Risk. ## Recommendations: • The University significantly improve its administration of federal grant funds. KSU should allocate sufficient staff and resources to ensure grant funds are spent in accordance with federal statutes, regulations, and the terms and conditions of the various federal awards. Specifically, the University should implement and maintain an effective system of internal controls over the administration of federal funds to ensure funds are spent appropriately and in accordance with the specific grant requirements. This includes establishing a chain of command that has the skills and knowledge to administer the funds and to ensure internal controls are not circumvented or overridden. • The University must ensure staff working in federal grant expenditures are provided adequate training to understand the specific requirements of each grant and federal spending in general, including the factors affecting allowability of costs, that costs are necessary and reasonable for the performance of the award, and that sufficient documentation is maintained. • The University keep records that show the amount of funds under the grant, how they used the funds, the total cost of the project, any cost-sharing source, and any other documentation necessary to facilitate an effective audit. • The University utilizes software effectively and efficiently to post transactions that are properly supported to the correct grants and other operating accounts. Transactions should include the date they occur instead of the date they are entered into the accounting system. • The Foundation remit $31,815 in interest to the federal grantor as required. ## Management Response: Concur The Manager has implemented new processes to include grant drawdowns and reconciliations of Grant Accounts. Internal controls have been established. All Title III grant expenditures must obtain the signature of the Director of Title III Programs. All approvals in Banner have been established and the Director is in all approval queues. Depending on the item being purchased (i.e., computers), the Chief Information Officer is also in the line of approvals. KSU staff working in federal grant expenditures have been provided adequate training and are scheduled to attend additional training to understand the specific requirements of each grant and federal spending in general, including the factors affecting allowability of costs, that costs are necessary and reasonable for the performance of the award. The training documentation will be maintained in employee's personal and historical records. ===== PAGE 10 ===== KSU Grant personnel maintain the amount of funds under each grant, how the funds will be used, the total cost of the project, any cost-sharing source, and any other documentation necessary to facilitate an effective audit. Weekly reconciliations are completed and forwarded to CFO/VP of Finance and Administration for review. Banner software is used to effectively and efficiently to post transactions that are properly supported to the correct grants and other operating accounts on the date of occurrence A formal letter has been prepared and sent to request remit of interest of $31,815. Finding 7: The University Failed to Implement Sufficient Internal Controls to Ensure an Effective Budgeting Process and Prevent Overspending. ## Recommendations: • The KSU Board of Regents implement a comprehensive internal control system over the budgeting process, including written policies and procedures for all University departments to follow. • The Board should ensure Board members are sufficiently knowledgeable about the budgeting process and the intricacies of college and university budgeting. • There should be sufficient time built into the budget approval process to allow the Board to comprehensively review and analyze the budget before voting for approval. • There should be sufficient time built into the budget approval process to allow the Board to comprehensively review and analyze the budget before voting for approval. • The accounting system should include general controls that ensure the Board receives accurate, reliable information in the budget packet and that prevent overspending of budgeted accounts. • Strong internal controls should be implemented that would discourage and prevent any attempts to subvert the normal procurement process, including appropriate discipline for noncompliance. An effective internal control system cannot exist without a clear tone at the top that sets the organization's commitment to honesty, integrity, and ethical behavior. • The Board of Regents and KSU's Administration develop and communicate a strong ethical tone to all faculty and staff. Management Response: Concur The KSU Board of Regents will implement a comprehensive internal control system over the budgeting process, including written policies and procedures for all University departments. The Budget manager shall revise/create policies and procedure with step-by-step instructions for end users. Once final approval is ===== PAGE 11 ===== granted, the Budget Manager will conduct training sessions for end users in all department's campus wide. Current policy requires all purchases $5k and below are approved by CFO and/or AVP of Finance and Administration. All purchases $5k or more are approved by CFO, AVP Finance and Administration, President and CPE. Greater than 50k require President, Board, and CPE approvals. Purchases must conform to the KSU Purchasing policy and when applicable KY Model Procurement Code and the Government Contract Review Committee. Progressive discipline actions are pursued, end of year of performance appraisal, goals and objectives- meet or exceeds personnel performance plans, formal training- start of fiscal year. Mid-year review- documented and retained in personnel files. The Budget Director will provide an overview of the process to the Board prior to implementation. The Budget Director will provide an overview of the process to the Board during scheduled Board meetings. The revised budget policy dated May 29, 2019 will be submitted to the Board for review and approval. Once approved, department training will be conducted on the new/revised policy. Budget preparations shall commence no later than sixty days prior to Board submission to allow sufficient time for the Board to comprehensively review and analyze the budget before voting for approval. Preliminary drafts budget will be discussed with Finance and Administration Committee. Thirty (30) days after preliminary budgets are submitted at the schedule Board meeting in quarterly Board meeting in April. The preventive control in the Banner system is the ability to turn on Non-Sufficient Funds (NFS) to prevent overspending and generating budget to actual reports 5 days after close, this information is presented to CPE and the Board. Manual reports are being reviewed - Board is being used and Argos being used to validate the results then Interfaced with Banner to produce reports. KSU current policy requires all purchases $5k and below are approved by CFO and/or AVP of Finance and Administration. All purchases $5k or more are approved by CFO, AVP Finance and Administration, President and CPE. Greater than 50k require President, Board, and CPE approvals. Purchases must conform to the KSU Purchasing policy and when applicable KY Model Procurement Code and the Government Contract Review Committee. Progressive discipline actions are pursued, end of year of performance appraisal, goals and objectives- meet or exceeds personnel performance plans, formal training- start of fiscal year. Mid-year review- documented and retained in personnel files. The Budget Director will provide an overview of the process to the Board prior to implementation. ===== PAGE 12 ===== Management Improvement Plan will address policy and procedures that address the ethical climate of the University. Personnel will receive training once approved. Finding 8: KSU Provide Insufficient Oversight of Its Procurement and Expenditure Processes. ## Recommendations: • All appropriations, expenditures, disbursements, or contracts greater than $50,000 be presented to the KSU Board of Regents for approval prior to purchase or execution of contract. • KSU bundle repeat purchases that may in total exceed the threshold for formal or informal bidding to obtain the best price on all items purchased or services provided. • KSU ensure that final, signed copies of all contracts are provided to KSU's official records custodian such as General Counsel, Purchasing Director, or other designated party as deemed appropriate per policy. • KSU work with Banner to create a method to query their data to generate a list of all contracts and contract expenditures. • KSU upload any missing contracts or supporting documentation that are missing from the contract management system but have not met the threshold for destruction. See additional discussion and recommendations pertaining to KSU's record retention at Finding 15. • KSU develop training for credit cardholders to ensure consistent application of policies and procedures. This should include, at a minimum, guidelines on appropriate usage, tracking, receipt requirements, and approvals. • KSU develop and implement training procedures for employee travel. ## Management Response: Concur • Travel expenses be encumbered. In accordance with KSU policy and Management Improvement Plan (CPE) all purchases of $5,000 and below are approved by CFO or designee. All purchases $5k or more are approved by President and CPE. Greater than 50k require President, Board, and CPE. Purchases must conform to the KSU Purchasing policy and when applicable KY Model Procurement Code and the Government Contract Review Committee. KSU submits all appropriations, expenditures, disbursements, or contracts greater than $50,000 to the KSU Board of Regents for approval prior to purchase or execution of contracts. Also, all expenditures greater than $5,000 must be reviewed and approved by VP of Finance and Administration. ===== PAGE 13 ===== KSU will review financial feasibility of bundle purchases to obtain the best price on all items purchased or service provided if they meet quality and performance standards. KSU is developing processes in which all contracts and agreements made on behalf of the University must first be vetted, approved by the President and/or the Board then given to record custodian for cataloging and uploading in central repository. The central repository maintains contracts whereas Banner purchasing module host expenses tied to the contract. However, KSU will be adopting the Ellucian Spend Management suite which will extend Banner functionality in the areas of purchasing, invoicing and travel and contracts in one location. KSU is in the process of identifying and recording all "fully executed" contracts. Contracts and supporting documentation will be uploaded into the central repository by Legal. KSU shall conduct training for new card issuers and periodic training for existing/current card users to ensure consistent applications of policies and procedures are followed. KSU is currently reviewing/updating travel policy and procedures. Once the policy and procedure have been reviewed and approved by the Board, employees will be required to attend travel training to ensure consistent applications of policies and procedures are followed. KSU will explore the use of a general encumbrance fund for travel and determine whether its value added. Finding 9: KSU Failed to Fully Implement Controls Over Its Internal Endowment Funds, Then Withdrew Over $2.7 Million, Supplementing Its Cash Balances. ## Recommendations: • KSU consider updating their Endowment Spending Policy and until such time should follow all aspects of the approved 2018 Endowment Spending Policy. In addition, KSU update their Investment Policy. • KSU consider addressing whether the 2012 policy remains in effect and, if so, harmonizing the 2012 and 2018 policies. • The President appoint an Investment and Endowment Committee. This includes implementing monitoring and reporting controls. • Reporting to CPE and to applicable donors should occur as prescribed and in a transparent manner. ===== PAGE 14 ===== • KSU confirm what percentage their drawdowns may be. • Donor agreements should be obtained with each donation and maintained indefinitely. • KSU review spending from drawn funds and repay the funds to the endowment to ensure donor funds are made whole. ## Management Response: Concur KSU shall continue to adhere to the approved Spending Policy until a revised Spending and Investment Policy has been reviewed and approved by the Board. The responsibility for investments and endowments is the responsibility of the Board, the Board will establish a subcommittee. KSU shall continue to adhere to the approved Spending Policy until revise Spending and Investment Policies have been approved by the Board. KSU Finance and Administration personnel meet weekly with CPE to provide updates. Any and all issues identified are communicated during this meeting. Also, Institutional Advancement is currently establishing policy and procedures to communicate endowment activities to CPE and applicable donors. KSU will confirm allowable percentage for drawdowns. KSU uses a third-party software provider (Blackbaud) to record and track all donor's information and agreements. President is currently working with CPE to resolve this matter. BOR took corrective at April 12, 2023 Finding 10: Former KSU Administration Rewarded Select Members with Unallowable Benefits, Including Bonuses, and Granted the Former President an Excess Housing Allowance and Utilities. ## Recommendations: • KSU provide only those benefits outlined in service contracts and HR documents for applicable employees that are properly approved and supported. • KSU discontinue awarding bonuses to employees in violation of section 3 of the Kentucky Constitution. • Changes made to benefits both in service contracts or in policy include an effective date and specifically state whether or not retroactive payment is necessary. • KSU HR Director and KSU Board of Regents Chair (or the full Board or a member of the Board) meet periodically to review benefits received by and payroll payments issued to all Vice President level and above employees and compare to similar information ===== PAGE 15 ===== from prior periods. Any issues or concerns identified with compensation or benefits awarded should be presented to the full Board. ## Management Response: Concur KSU will ensure that only benefits outlined in service contracts and HR documents for applicable employees are properly approved and supported. Payroll and Payroll Related audited will be scheduled by Internal Audit to confirm Policy and Procedures are being followed. KSU has discontinue awarding bonuses to employees. No current employee is receiving bonuses outside of contractual agreement effective 7/1/2022. KSU will amend HR policy to ensure any changes made to benefits both in service contracts or in policy include an effective date and specifically state retroactive payment is prohibited. KSU Board Chair and HR Director will establish process to periodically review benefits received by, and payroll payments issued to, all Vice President-level and above employees. A comparison to similar information from prior periods will be analyzed and any issue arising from the review will be presented to the full Board. ## Finding 11: Former EVP for Finance and Administration Submitted an Inaccurate
Finding 11: Former EVP for Finance and Administration Submitted an inaccurate
Accounts Payable Amount to Former President and Former Board Chair Amid Questions and Rumors of Unpaid Bills.
Recommendations: • KSU record all accounts payable into their accounting system. Recording should be done timely to properly reflect liabilities and eliminate the practice of maintaining invoices outside of Banner. • KSU develop a standard report template for showing outstanding accounts payable balances.
• KSU document, in writing, the procedure for creating the outstanding accounts payable balance report, including the sources of information involved.
Management Response: Concur
All account payables are into the accounting system, we continue to work on closing out past invoices that were not properly recorded.
Invoices are no longer maintained outside of Banner. The controller along with the accounts payable manager reviews invoices and payments for timely submission into the Banner system. Reconciliation is performed on a weekly
===== PAGE 16 ===== basis and submitted to AVP of Finance and Administration for review and approval. KSU Accounts Payable working with a report writer from Intuitional Research created a template (platform) that integrates with Banner to capture invoice aging. The schedule in Argo's system produces end of the month outstanding accounts payable balances. KSU retains the procedure (report script) for creating the outstanding accounts payable balance report on file (hard copy for reference). Finding 12: KSU Failed to Apply a 5% Salary Reduction to Executive Salaries Despite a Signed Resolution. ## Recommendations: • KSU determine the authority of President's Council/Cabinet. • In addition, the KSU HR Director should provide confirmation of action taken at meetings of the Board of Regents, standing committees, and the President's Council, whenever resolutions or motions are passed that will affect payroll and benefits provided to any or all staff. • The Board of Regents keep track of resolutions passed and request a status update to ensure passed resolutions are implemented. Management Response: Concur President's Council/Cabinet no longer exists. The University has a Leadership Cabinet that is a comprised of Senior Leadership to report on areas of performance, coordinate strategies and emergency issue. President's Council/Cabinet no longer exists. The HR Director shall provide confirmation of action taken at meetings of the Board of Regents, standing committees, and the Leadership Cabinet, whenever resolutions or motions are passed that will affect payroll and benefits provided to any or all staff. The Board of Regents shall keep track of resolutions passed and a status update from Staff notes compiled and details are presented to Board for review and approval. A review of previous resolutions items will be an agenda item going forward. Finding 13: Insufficient Communication and Relationship Between KSU and Its Foundation Has Led to Ineffective Oversight of Public Funds. Recommendations: ===== PAGE 17 ===== • KSU follow its own MOU and establish more consistent and clear communication with the Foundation. This should include not only the President's office, but KSU's Accounting and Institutional Advancement offices, as appropriate, to promote integrity, accountability, and transparency in this process. • KSU establish written policies and procedures to provide guidance for how requests for support from the Foundation are to be made and approved. • KSU establish written policies and procedures to provide guidance for how University funds sent to the Foundation are to be processed and approved. • KSU maintain its own records documenting expenditure requests and amounts the Foundation paid. • KSU require monthly or quarterly reporting of available funds held at the Foundation be submitted to institutional support or accounting so that reports can be reconciled to KSU's documentation to ensure charges and deposits are applied to the appropriate accounts as intended. • MOU should be updated to reflect actual operations/procedures between KSU and its Foundation. ## Management Response: KSU will adhere to the MOU with the Foundation and establish more consistent and clear communication with the Foundation. KSU will establish written policies and procedures to provide guidance for requesting and receiving Foundational financial support with approvals. The Foundation MOU is under review with plans to revise the agreement to include reporting timelines and procedures and processes related to the use and transfer of foundations funds to the University. KSU will establish written policy and procedure for documenting expenditure requests and amounts the Foundation paid. KSU will maintain records in accordance with stated policy. The Foundation MOU is under review with plans to revise the agreement to include reporting timelines and procedures and processes related to the use and transfer of foundations funds to the University. The revised MOU will require reports that can be entered by the University into Blackbaud for monthly reporting. The Foundation MOU is under review with plans to revise the agreement to include actual operating/procedures between the two parties. ===== PAGE 18 ===== ## Finding 14: Former EVP for Finance and Administration Failed to Notify KSU of His Dual Employment Creating a Conflict of Commitment ## Recommendations: • KSU seek legal guidance to determine options that may be available to recoup any payment for services not rendered by the employee. • KSU provide annual training to all staff with a focus on select KSU policies, to include at a minimum Ethics, Conflicts of Interest, and Conflicts of Commitment. • KSU create an explicit dual employment policy that requires KSU employees to obtain approval before acquiring secondary employment, whether through revision of the Conflict of Commitment policy or by adoption of a separate stand-alone policy. ## Management Response: Concur KSU has deferred to Deputy General Counsel and outside Legal Counsel to determine options available to recoupment. Legal and CFO will review Ethics, Conflicts of Interest, and Conflicts of Commitment and other selected policies and prepare recommendations to the President for changes. The President will seek BOR approval. Upon BOR approval, initial/annual training and certification will be required and retained on file. Employees will be required to attend training upon hire and an annually thereafter. Revised employee handbook to require prior approval from appropriate level authority to prevent or approve secondary employment. Current policy requires employees to notify and obtain permission for outside employment. Employees be must sign of on employment form. ## Finding 15: KSU Violated Record Retention Requirements ## Recommendations: • KSU ensure proper retention and destruction of KSU's financial records in accordance with approved state and University policies. • KSU develop and implement training for all “central administrative office” personnel, responsible for ensuring proper retention and destruction of KSU’s financial records and undergo training by Kentucky Department for Libraries and Archives. • KSU ensure systems used for records retention be adequately maintained so that access to the records is not lost. • The KSU Purchasing Director and General Counsel work together to ensure that all contracts and necessary supporting documentation are uploaded to the contract management system. ===== PAGE 19 ===== • KSU appoint an official records custodian and ensure that final, signed copies of all contracts are provided to the University's official records custodian. • KSU upload all contracts and supporting documentation that are not already in the contract management system but have not met the threshold for destruction. ## Management Response: Concur Policy and procedures are being reviewed for current practices and updates will be made to reflect. Training will be conducted upon final policy approval. Verify retention policy and ensure financial records are maintained in accordance with stated policies. A review of policies will be conducted to ensure adherence to policies for retention and disposition. Policy and procedures are being reviewed for current practices and updates will be made to reflect. Training will be conducted upon final policy approval. Verify retention policy and ensure financial records are maintained in accordance with policy. A review of policies will be conducted to ensure adherence to policies for retention and disposition. KSU shall ensure systems used for records retention is adequately maintained to prevent loss of information/data. All records will be submitted to custodian for cataloging and uploading in central repository. KSU shall establish a process to ensure that all contracts and necessary supporting documentation are uploaded to the contract management system. KSU has appointed an official records custodian to ensure that final, signed copies of all contracts are provided to the University's official records custodian. KSU is in the process of upload all contracts and supporting documentation that are not already in the contract management system but have not met the threshold for destruction. Finding 16: KSU Failed to Maintain Access to Records Due to Unpaid Invoices. ## Recommendations: • KSU ensure that any documentation supporting an expenditure from university funds is maintained for review. • KSU make the necessary payments to retrieve the documentation maintained in third-party systems to comply with record retention requirements. • KSU determine whether to continue using a third-party system. ===== PAGE 20 ===== • If a third-party database is used, KSU policies and procedures incorporate actions necessary to prevent the temporary or permanent loss of data. ## Management Response: Concur KSU shall ensure any documentation supporting an expenditure from university funds is maintained for review. KSU has paid outstanding invoices from third party administrator (Concur) and has obtained access to historical records. In order to have access to historical records, KSU has determined to continue using third-party system until completion of audit procedures for FY21 and FY 22. KSU will ensure contract terms and conditions include data loss prevention terminology and future access to records maintained by third-party. Finding 17: KSU Did Not Implement Adequate Access Controls Over Its Accounting and Payroll Systems. ## Recommendations: • KSU update all Banner and ADP policies and procedures to ensure staff can properly perform their job duties. Given the amount of turnover at KSU, it is imperative to have up-to-date policies and procedures that staff can follow to ensure processes are performed as intended by management. • KSU follow their Password Policy and have a failed login attempt setting of three as opposed to five. • KSU IT staff return Banner Security Forms to supervisors and Banner module managers if the proper selections are not made, and proper signatures are not captured on the form. Actions taken by IT that affect a user's access to Banner should be documented on the form or emails should be retained to support communications. Also, KSU should create a security form to be used when granting access to ADP. • KSU continue performing quarterly audits of Banner and ADP. Adequate documentation should be obtained from each of the Banner module managers to ensure reviews are being performed for each module. The full audit reports should be used by IT staff and Banner module managers to compare and confirm access is appropriate for all users. KSU is currently reviewing and revising all Banner, ADP and other university's policies and procedures to ensure staff can properly perform their job duties. Each department is working on Standard Operating Procedures. Also, training ===== PAGE 21 ===== and process mapping is being provided through our Banner Optimization project, Banner Advisory Services, and Your Part Time Controller. Current password policy was updated to only allowed three attempts instead of five. It was originally 3 but changed to 5 during COVID to provide further customer service for employees and students access systems remotely. The management of Banner Approval queues has been reassigned from the Purchasing Office to the Controller's Office. Additionally, the EVP of Finance will monitor the approval queues quarterly. This reassignment and quarterly review change will be included in the revised Finance and Administration policy as stated below: The management of Banner approval queues shall be the responsibility of the Controller's Office. The Banner Approval queues shall be monitored quarterly by the AVP of Finance to ensure that only properly authorized users and approvals are configured. This policy is intended to ensure the security and integrity of our financial systems, and to prevent unauthorized access or misuse of these systems. Finding 18: KSU Does Not Have User Security Auditing Enabled for The Banner Accounting System. Recommendations: • KSU work with the vendor to enable security auditing on the Banner Oracle database. • KSU management regularly monitor changes to user access, and reports on this monitoring should be included in the quarterly audits. ## Management Response: Concur KSU is working with the vendor to enable security auditing on the Banner Oracle database. Ellucian informed KSU on April 21, 2023 that this feature could be turned on. A project initiation request has been started with Ellucian to enable Banner Unified Auditing. Regular monitoring is taking place to user access, and monitoring reports for Banner and ADP will be performed during quarterly audits. Adequate documentation will be maintained from all Banner module managers to ensure reviews are being performed for each module. An additional level of review will be conducted by the either the AVP or VP for respective areas. Although an exception was identified during the examination period, KSU continues to perform quarterly audits of Banner and ADP; adequate documentation will be obtained from each of the Banner module managers as verification of reviews conducted for each module. ===== PAGE 22 ===== ## Finding 19: KSU Did Not Establish Proper Controls Over Procurement Approval Levels within the Banner Accounting System ## Recommendations: • KSU remove the Purchasing Director’s ability to approve or alter their own approvals within Banner. KSU’s IT department should be responsible for all changes made to the approval queue within Banner. • KSU should implement procedures to monitor the Banner Approval Queue regularly to ensure only properly authorized users and approvals are configured. • KSU begin using effective and termination dates when altering approvals within Banner. This will allow KSU to maintain a historical account of the approval queue and properly monitor changes made to the information within the queue. ## Management Response: Concur The management of Banner Approval queues has been reassigned from the Purchasing Director to the Controller's Office. Additionally, the EVP of Finance monitors the approval queues quarterly. The reassignment and quarterly review change will be included in the revised Finance and Administration policy as stated below: “The management of Banner approval queues shall be the responsibility of the Controller’s Office. The Banner Approval queues shall be monitored quarterly by the AVP of Finance to ensure that only properly authorized users and approvals are configured. This policy is intended to ensure the security and integrity of our financial systems, and to prevent unauthorized access or misuse of these systems”. KSU shall implement procedures to monitor the Banner Approval Queue regularly, the EVP of Finance will monitor the approval queues quarterly. KSU will begin using effective and termination dates when altering approval levels within Banner. Also, training on the use of effective and termination dates in approval queues was conducted by an Ellucian Purchasing Consultant on 4/3/2023 with members of Purchasing, Controller's Office, AVP of Finance and IT in attendance. ## Finding 20: KSU Did Not Implement Adequate Password and Identification Controls ## Recommendations: • KSU configure their Network and Banner to require passwords to be changed prior to first use. ===== PAGE 23 ===== • KSU document the naming convention of Banner and ADP user IDs within a written policy. KSU should then regularly monitor user IDs established within Banner and ADP to ensure these adhere to the naming convention established within this policy. ## Management Response: Concur Plans are underway to require new employees to change their current password prior to first use and for current users upon next log-in attempt. KSU will regularly monitor and document Banner and ADP naming convention are established within the written policy. Adequate documentation will be maintained from all Banner module managers to ensure reviews are being performed for each module. An additional level of review will be conducted by the either the AVP for Finance and Administration and/or Supervisor of respective areas. ## Management Response: Non-concur KSU current Network, Banner, and ADP passwords exceeds current industry standards using multi-factor authentication and complex passwords. According to NIST Special Publication 800-63B, password expirations are no longer necessary; KSU has benchmark with other Kentucky Higher Institutions which were found to be similar to KSU standards. • Banner passwords be required to contain both alphanumeric and special characters. The password history for both Banner and ADP should be increased to 24 passwords. ## Management Response- Non-concur KSU current Network, Banner, and ADP password's structure meets current industry standards using alphanumeric and special characters. Reviewing industry standards for passwords length to be increased to 24 characters. According to NIST Special Publication 800-63B, user-created passwords should be at least 8 characters in length; KSU's is currently set to 12 (exceeds requirements) KSU has benchmark with other Kentucky Higher Institutions which were found to be similar to KSU standards.