Single Audit Report Fiscal Year Ended June 30, 2012 - State ...

State of GeorgiaFinancial Statement Findings and Questioned CostsFor the Fiscal Year Ended June 30, 2012Criteria:Information:Management of the University is responsible for designing and maintaining internal controls thatprovide reasonable assurance that transactions are properly processed and reported. Separation ofduties involving key accounting functions and the monitoring of user access to financial systems arethe basis for achieving an adequate system of internal control.The following deficiencies were noted:1. An employee responsible for the receipt and custody of cash also prepared and approved deposits;posted receipts into the student information system (BANNER); had the ability to maintain andupdate detail codes in the BANNER system; reconciled deposits posted to the general ledger in thefinancial accounting system (PeopleSoft); and performed the reconciliation of the feed of financialinformation from BANNER to PeopleSoft (TGRRCON).2. Two employees were found to have a security role in the PeopleSoft System outside of their jobresponsibilities.3. Employees who had the ability to add new hires also had the ability to make pay changes.4. One user had inappropriate access to the privileged IT menus within the PeopleSoft financialsystem.5. Three employees had continued access to the PeopleSoft and BANNER systems after the date ofseparation from employment.Cause:Effect:Recommendation:The University did not adequately separate the functions of initiating, authorizing, and recordingtransactions, reconciliations, and maintaining the custody of assets. Additionally, the University didnot adequately establish a process to monitor appropriate access to financial systems. Compensatingcontrols were either not adequately designed or not formally documented.Without satisfactory accounting policies and procedures requiring proper separation of duties andgoverning financial system access, the University could place itself in a position where potentialmisappropriation of assets, fraud, errors and/or irregularities could occur. In addition, the lack ofcontrols could impact reporting of the University's financial position and results of operations.Management should review the established internal control structure and revise or implement controlsto ensure that proper separation of duties exists. Application access controls in the accountinginformation systems should complement the system of internal control by limiting an employee'saccess to only the accounting functions necessary for the performance of the employee's duties. In thecase when management determines separation of duties is not cost beneficial, management shouldimplement compensating controls that assist in assuring that financial transactions are properlyprocessed and reported. A periodic review of financial system access should be implemented bymanagement to determine that access continues to be appropriate based on job responsibility.Evidence of the review process should be maintained for a period of 18 months.Finding Control Number: FS-533-12-02CASH AND CASH EQUIVALENTSInadequate Accounting ControlsCondition:Criteria:Information:The accounting procedures of the University were insufficient to provide adequate controls over Cashand Cash Equivalents.An adequate system of internal controls dictates that bank reconciliations be performed on a monthlybasis, and include the following: 1) adequate supporting documentation, 2) reconciling items correctlyidentified by description, 3) adjustments identified and made in a timely manner, and 4) evidence of aneffective supervisory review and approval function.A review of the bank reconciliations for the operating and payroll accounts revealed the following:68