FISMA CALIFORNIA STATE UNIVERSITY, LONG BEACH Report Number 95-01 December 6, 1995 Members, Committee on Audit Joan Otomo-Corgel, Chair James H. Gray, Vice Chair Roland E. Arnall Ronald L. Cedillos Martha C. Fallgatter Bernard Goldstein William Hauck Ted J. Saenger Frank Y. Wada University Auditor: David E. Sundstrom Senior Director: Larry Mandel Associate Auditor: Ellis Williams Staff BOARD OF TRUSTEES THE CALIFORNIA STATE UNIVERSITY
CONTENTS INTRODUCTION Purpose... 1 Scope and Methodology... 1 Background... 2 Opinion... 2 Executive Summary... 3 OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES Cash Receipts... 5 Accounts Receivable... 6 Revolving Fund... 7 Fixed Assets... 8 APPENDICES Appendix A: Personnel Contacted Appendix B: Statement of Internal Controls Appendix C: Campus Response Appendix D: Chancellor's Acceptance ii
CONTENTS ABBREVIATIONS FISMA BA CSU CSULB EO SCO SAM SUAM IT ITS Financial Integrity State Manager's Accountability Act Business Affairs California State University California State University, Long Beach Executive Order State Controller's Office State Administrative Manual State University Administrative Manual Information Technology Information Technology Services iii
PURPOSE The principal audit objective was to assess the adequacy of controls and systems which assure that: cash receipts are processed in accordance with laws, regulations and management's policy; receivables are promptly recognized and balances are periodically evaluated; purchases are made in accordance with laws regulations and management policy; revolving fund disbursements are authorized and processed in accordance with laws, regulations and management's policy; cash disbursements are properly authorized and are made in accordance with established procedures and adequate segregation of duties exists; payroll/personnel criteria for hiring employees, establishing compensation rates and authorizing disbursements are controlled and personnel and payroll are processing records and processing areas are restricted; purchase and disposition of fixed assets are controlled and recording of assets are made promptly in the subsidiary records; physical computer controls are in place and functioning; investments are adequately controlled and securities are safeguarded; and trust funds are established in accordance with SUAM guidelines. SCOPE AND METHODOLOGY The management review emphasized, but was not limited to, compliance with state and federal laws, Board of Trustee policies, and Office of the Chancellor policies, letters, and directives. For those audit tests which required annualized data, the 1993-94 fiscal year was the primary period reviewed. In certain instances, we were concerned with representations of the most current data in such cases the test period was July 1994 to February 1995. Our primary focus was on internal controls. Specifically, we reviewed and tested: procedures for receipting and storing cash, segregation of duties involving cash receipting and recording of cash receipts; establishment of receivables and adequate segregation of duties over the establishing of billing for and payment of receivables;
approval of purchases, receiving procedures and reconciliation of expenditures to State Controller's balances; limitations on the size and types of revolving fund disbursements; use of petty cash funds, periodic cash counts, and reconciliation of bank accounts; authorization of personnel/payroll transactions, accumulation of leave credits in compliance with state policies and maintenance of minimum leave balances for participants in the direct deposit program; posting of the property ledger, monthly reconciliation of the property to the general ledger, and physical inventories; access restrictions to automated accounting systems and proper documentation of the systems; procedures for initiating, evaluating, and accounting for investments; and establishing of trust funds, separate accounting, adequate agreements, and annual budget. We have not performed any auditing procedures beyond the date of our report. Accordingly, our comments are based on our knowledge as of that date and should be read with that understanding. Since the purpose of our comments is to suggest areas for improvement, comments on favorable matters are not discussed. BACKGROUND In 1983, the California Legislature passed the Financial Integrity and State Manager's Accountability Act of 1983 (FISMA). This act required that state agencies establish and maintain a system of internal accounting and administrative control. To ensure that the requirements are fully complied with, the head of each agency is required to prepare and submit a report on the adequacy of the system of internal accounting and administrative control following the end of each odd-numbered fiscal year. Prior to 1992, the California Department of Finance had conducted these reviews. However, due to staffing reductions they are no longer conducting such audits. The Office of the University Auditor of the CSU is now responsible for conducting the audits of internal accounting and administrative control within the CSU. This report represents our biennial review. OPINION We visited the campus from March 22, through May 15, 1995 and audited the internal control structure in effect at that time. In accordance with the Government Code Section 13402, et seq., state agency heads are responsible for establishing and maintaining systems of internal accounting control. The broad objectives of control systems for state agencies are to provide management with reasonable, but not absolute, assurance that:
assets are safeguarded from unauthorized use or disposition; and transactions are executed in accordance with management's authorization and recorded properly to permit the preparation of financial reports in accordance with the State Administrative Manual. Because of inherent limitations in control systems, errors or irregularities may occur and not be detected. In addition, projection of any evaluation of systems to future periods is subject to risk since procedures may become inadequate as a result of changes in conditions, or the degree of compliance with the procedures may deteriorate. (See Appendix B, Statement of internal Controls.) We found that, except for the items noted in the Executive Summary and in the detail of the report, controls were in place and functioning adequately and compliance with related CSU and campus policies and procedures was satisfactory. EXECUTIVE SUMMARY The purpose of this section is to provide management with an overview of conditions requiring their attention. Areas of review not mentioned in this section were found to be satisfactory. Numbers in brackets [ ] refer to page numbers in the report. CASH RECEIPTS [5] Procedures in the library circulation department were not adequate for the safeguarding of cash receipts and the placing of a restrictive endorsement on checks on the day received. There was no written record indicating who has access to the safekeeping facility and when changes in access have occurred. The library should maintain a written record of those individuals with access to the safe facility and the date when the combination was last changed to assure that university assets are safeguarded. Timely endorsements may also serve to discourage the negotiation of lost or stolen instruments by other than state departments. Security over cash receipts in Student Health Services (SHS) was in need of improvement. Ensuring that cash receipts are maintained under the proper security reduces exposure to the potential loss of revenue. A periodic review of collection procedures at the locations outside of the main cashier's office was not being performed by the campus accounting office. Performing periodic reviews of the cash collection locations outside of the cashier's direct supervision will assure that the required collection procedures are being followed. ACCOUNTS RECEIVABLE [6] The campus had forty-one outstanding payroll receivables in the amount of $7,369 dating back two years. Enforcing procedures leading to more timely follow-up/collection of outstanding payroll receivables will increase the likelihood that all amounts owed will be collected. REVOLVING FUND [7]
Revolving Fund salary advances were not cleared in a timely manner. Clearing salary advances promptly leads to both increased collections and the availability for other revolving fund needs. Strengthening controls to assure that employee separation procedures are properly completed prior to distributing final warrants will ensure that outstanding salary advances are cleared. FIXED ASSETS [8] Campus departments did not send reports of stolen property to the property office on a routine basis. Forwarding reports of lost or stolen property from campus departments to the property office will allow items to be removed from inventory which would otherwise misstate assets. CASH RECEIPTS Our review of a sample of satellite cash collection centers (Library Circulation and Student Health Services) indicated that internal controls at those sites were not adequate. Library Circulation Procedures in the library circulation department did not provide for the safeguarding of cash receipts. There was no written record indicating who had access to the safekeeping facility and when changes in access had occurred. A periodic review of collection procedures was not being performed by the campus accounting office. Checks were not restrictively endorsed in a timely manner. Although an endorsement stamp had been issued, checks were kept in the safe for as long as five days before they were endorsed and transferred to the central cashiering office. Student Health Services Security over cash receipts was not adequate. The cash receipting area was accessible to unauthorized individuals through an open side door. In addition, the main door to the pharmacy was left open during business hours. A periodic review of collection procedures was not being performed by the campus accounting office. SAM Sections 8024 and 8034 address the above areas. In addition, SUAM Section 3821 rests responsibility in the chief business officer to monitor collection operations in cash collection centers and to assure that cash collection centers follow state and Chancellor's Office requirements for internal control. There was no physical oversight of satellite cash collection centers by accounting management that would have detected and corrected the above conditions. Campus management indicated that the loss of staff was the main reason for not performing the reviews.
By providing less than an optimal level of oversight, internal control has been reduced and the campus cannot assure that all cash collections are appropriately accounted for and safeguarded. Recommendation 1 We recommend that the campus assure that all necessary internal controls are appropriately applied to satellite cash collection centers. Campus Response We concur. Cash collection centers at the library and student health centers have implemented procedures to ensure that necessary internal controls are appropriately applied. Internal controls which currently apply to central cashiering are applicable as well to satellite cashiering at university College of Extension Services, student housing offices and enrollment services. The university internal auditor will be charged with the responsibility of testing compliance with this recommendation. ACCOUNTS RECEIVABLE The campus had a number of outstanding payroll related accounts receivable which were established by the State Controller's Office. The accounts receivable aging report as of March 31, 1995 indicated there were forty-one outstanding items in the amount of $7,369 over two years old. A sample selection of these items also indicated that campus collection efforts did not include the use of offset claim procedures nor the local adjustment and discharge from accountability methods for accounts declared uncollectible or more than two years old. Four of the eleven employees in our sample selection were also cleared for separation from the campus although they still had outstanding accounts receivable. SAM Section 3822 requires that procedures be established which provide for prompt follow-up of accounts receivable, including follow-up letters and/or calls, utilization of offset claim procedures for accounts greater than $10 and the withholding of services such as library loans, transcripts, grade reports, future enrollments, etc. Executive Order 616, dated April 19, 1994, delegated authority to the campuses for local adjustment to $1,000 while also emphasizing that campuses were still obligated to comply with the collection requirements outlined in SAM Section 8776.6 which provides for state departments to seek relief from accountability for uncollectible amounts in excess of $1,000. SAM Section 8580.4 also requires that salary warrants not be distributed to terminating employees until all outstanding salary advances have been paid and if, after check out, a terminating employee leaves owing the agency money an offset claim will be filed with the Franchise Tax Board. Payroll management indicated that a change in procedures by the State Controller's Office requiring the campuses to establish their own payroll receivables has had a significant impact on the workload in the payroll office. This workload increase along with a loss in staff resources has resulted in assigning a low priority to the monitoring and follow-up on payroll receivables.
Since these accounts have been long outstanding, there is a very low probability of collecting the amounts due; and, the cost of collection along with the increased workload, especially for the smaller ones, would exceed the amount owed. Recommendation 2 We recommend that the campus: a. adjust accounts under $1,000 pursuant to Executive Order 616; b. seek relief from accountability from the State Board of Control for accounts greater than $1,000 and declared uncollectible or more than two years old; and c. improve separation procedures to ensure that terminating employees who have outstanding accounts receivable do not receive salary warrants. Campus Response We concur. The following action plan is currently in progress: 1. To automate the process of administering the payroll receivables through development of a data base file capable of: Maintaining detailed information about debtors. Issuing past due notices in accordance with State Administrative Manual requirements. Generating a tape for submission to the California Franchise Tax Board (FTB), when necessary. Preparing a report of outstanding receivables for which collection efforts have been exhausted for the purpose of seeking a discharge of accountability. 2. Employee separation procedures have been reviewed and revised as needed to minimize the risk of payroll receivables. REVOLVING FUND Revolving Fund salary advances were not cleared in a timely manner. The aging report as of February 28, 1995 indicated there were thirty-nine advances outstanding in the amount of $21,188.54 of which eleven were more than a year old with the oldest dating back to 1992. In addition, a sample review of ten separated employees indicated that four of them were cleared for separation from the campus although they still had outstanding salary advances.
SAM Sections 8595 and 8776.6 require salary advances be cleared through offset against subsequent payroll warrants SUAM Section 3813 provides that the time period for recovery of salary advances should not exceed sixty days. SAM Section 8580.4 also requires that salary warrants not be distributed to terminating employees until all outstanding salary advances have been paid and if, after check out, a terminating employee leaves owing the agency money an offset claim will be filed with the Franchise Tax Board. The payroll services staff indicated that a significant loss in personnel, including staff assigned to clear advances, placed a low priority on clearing advances because the research and follow-up required could not be implemented in order to provide a timely clearance of outstanding advances. The accounting staff also indicated that on occasion employees who owe the campus money clear separation procedures because departments do not provide the accounting office with the proper documentation in a timely manner. Long outstanding salary advances are more difficult to clear and revolving funds are also not available for other uses when advances are not promptly cleared. Recommendation 3 We recommend that the campus: a. immediately clear long outstanding revolving fund salary advances; and b. improve employee separation procedures to ensure that terminating employees who have outstanding salary advances do not receive salary warrants. Campus Response We concur. As stated earlier, employee separation procedures have been reviewed and revised as needed. Additional efforts will be made to ensure a timely monitoring of outstanding salary advances and to clear those advances when collection efforts are fruitless. FIXED ASSETS Campus departments did not send reports of stolen property to the property office on a routine basis. SAM Section 8643 requires the preparation of a Property Survey Report whenever property is lost, stolen, or destroyed and an adjustment to the property accounting records. Public safety staff indicated that current procedures require the campus departments rather than public safety to submit Missing/Stolen Items Reports to the property office. However, this did not always occur during the 1993-94 year and would not necessarily capture all stolen items.
Property that is lost or stolen will remain on, and inflate, the inventory if the campus department does not submit a property survey request to the property office. Recommendation 4 We recommend that the campus improve procedures to periodically notify the property office of items reported stolen so that they may be removed from the campus inventory. Campus Response We concur. Campus departments have been re-informed of the requirement to report missing or stolen items. The Missing/Stolen Items Report Form has been updated and is now available on computer diskette, as well as the standard hardcopy version.
APPENDIX A: PERSONNEL CONTACTED Name Celia Afan Frank Alarcon Robert Escalante Joanne DePew Dolores Daoud Kathleen DiVito Flora Farzad William Griffith Sandi Gunderson Dale Guerrero Tuey Gjestland Betty Harris Penny Houston Charlie Hughes Barbara Iriarte Roman Kochan Joseph Latter Robyn Mack Marjorie Mashburn Jennyfer Nguyen Rellen Owen Jack Pierson Ray Soliman Linda Sumpter Richard Timboe Juliana Wong Mike Woods Title Supervisor, General Accounting Manager, Shipping and Receiving Property Manager Administrative Operations Analyst, Student Health Services Supervisor, Student Accounts Receivable Financial Assistant Assistant University Controller Vice President, Administration and Finance Director, Payroll Services Supervisor, Circulation, University Library Administrative Services Officer, Financial Management Supervisor, Self-Supporting Operations Supervisor, Support Staff Director, Procurement&Support Services Technician, General Accounting Director, University Library and Learning Services Associate Vice President, Financial Management Director of Budget and Human Resources Management Supervising Cashier Supervisor, Accounts Payable Administrative Services Manager, Extension Services Director, Public Safety University Controller Manager, Administrative Services, University Library Assistant Vice President, Information Technology Services Accountant, Federal Trusts Detective, Public Safety
STATEMENT OF INTERNAL CONTROLS A. INTRODUCTION Internal accounting and related operational controls established by the State of California, the CSU Board of Trustees, and the Office of the Chancellor are evaluated by the University Auditor, in compliance with professional standards for the conduct of internal audits, to determine if an adequate system of internal control exists and is effective for the purposes intended. Any deficiencies observed are brought to the attention of appropriate management for corrective action. B. INTERNAL CONTROL DEFINITION Internal control, in the broad sense, includes controls which may be characterized as either accounting or operational as follows: 1. Internal Accounting Controls Internal accounting controls comprise the plan of organization and all methods and procedures that are concerned mainly with, and relate directly to, the safeguarding of assets and the reliability of financial records. They generally include such controls as the systems of authorization and approval, separation of duties concerned with record keeping and accounting reports from those concerned with operations or asset custody, physical controls over assets, and personnel of a quality commensurate with responsibilities. 2. Operational Controls Operational controls comprise the plan of organization and all methods and procedures that are concerned mainly with operational efficiency and adherence to managerial policies and usually relate only indirectly to the financial records. C. INTERNAL CONTROL OBJECTIVES The objective of internal accounting and related operational control is to provide reasonable, but not absolute, assurance as to the safeguarding of assets against loss from unauthorized use or disposition, and the reliability of financial records for preparing financial statements and maintaining accountability for assets. The concept of reasonable assurance recognizes that the cost of a system of internal accounting and operational control should not exceed the benefits derived and also recognizes that the evaluation of these factors necessarily requires estimates and judgment by management.
APPENDIX B Page 2 of 2 D. INTERNAL CONTROL SYSTEMS LIMITATIONS There are inherent limitations that should be recognized in considering the potential effectiveness of any system of internal accounting and related operational control. In the performance of most control procedures, errors can result from misunderstanding of instruction, mistakes of judgment, carelessness, or other personal factors. Control procedures whose effectiveness depends upon segregation of duties can be circumvented by collusion. Similarly, control procedures can be circumvented intentionally by management with respect to the executing and recording of transactions. Moreover, projection of any evaluation of internal accounting and operational control to future periods is subject to the risk that the procedures may become inadequate because of changes in conditions and that the degree of compliance with the procedures may deteriorate. It is with these understandings that internal audit reports are presented to management for review and use.