University of Illinois Annual. Financial Report for the Year Ended June 30, 2011

              Office of the Auditor General, Iles Park Plaza, 740 E. Ash St., Springfield, IL 62703 • Tel: 217-782-6046 or TTY 888-261-2887
This Report Digest and a Full Report are also available on the internet at www.auditor.illinois.gov
UNIVERSITY OF ILLINOIS
FINANCIAL AUDIT
For the Year Ended: June 30, 2011
Summary of Findings:
Total this audit:
Total last audit:
Repeated from last audit:
3
3
3
Release Date: January 5, 2012
INTRODUCTION
The University’s financial audit report consists of three sets of financial statements as follows – The financial statements of the University, and the revenue bond financial statements of the Auxiliary Facilities System and the Health Services Facilities System.
This report contains only findings pertaining to the Financial Statement Audit.
The State Compliance Examination and Federal Single Audit Reports will be issued at a later date.
SYNOPSIS
• The University has not established adequate internal controls over accurately identifying and recording year end accounts payable and accounts receivable transactions for financial reporting purposes.
• The University has not established adequate internal controls over access to the information systems used in its financial reporting process.
{Expenditures and Activity Measures are summarized on the reverse page.}2
FINANCIAL OPERATIONS
Operating Revenues
Tutition and fees, net..............................................
905,693,000$
823,488,000$
Federal grants, contracts and appropriations..........
703,311,000
657,896,000
State and private gifts, grants and contracts...........
230,764,000
233,043,000
Hospital and medical activities..............................
770,822,000
761,913,000
Auxiliary enterprises, net.......................................
374,644,000
368,515,000
Educational activities.............................................
267,609,000
251,770,000
Other......................................................................
16,710,000
14,544,000
Total Operating Revenues.................................
3,269,553,000$
3,111,169,000$
Operating Expenses
Instruction..............................................................
1,006,190,000$
970,339,000$
Research.................................................................
680,651,000
652,229,000
Public service.........................................................
387,461,000
395,343,000
Academic support..................................................
349,095,000
354,238,000
Hospital and medical activities..............................
633,795,000
597,426,000
Auxiliary enterprises..............................................
316,442,000
310,794,000
Operation and maintenance of plant......................
287,825,000
269,739,000
Institutional support...............................................
209,752,000
228,610,000
Depreciation...........................................................
209,745,000
208,885,000
Scholarships and fellowships.................................
238,722,000
215,270,000
Other......................................................................
145,693,000
138,702,000
Total Operating Expenses.................................
4,465,371,000$
4,341,575,000$
Operating Income (Loss).............................................
(1,195,818,000)$
(1,230,406,000)$
NONOPERATING REVENUES (EXPENSES)
State appropriations................................................
671,794,000$
672,300,000$
Capital appropriations, gifts and grants..................
26,019,000
82,508,000
Private gifts and endowments.................................
134,422,000
144,197,000
On behalf payments for fringe benefits..................
683,201,000
634,745,000
Other, net................................................................
84,296,000
126,758,000
INCREASE IN NET ASSETS..................................
403,914,000$
430,102,000$
Net assets, beginning of year.......................................
2,785,546,000$
2,357,758,000$
Change in Accounting.................................................
-
(2,314,000)
Net assets, beginning of year, as adjusted...................
2,785,546,000
2,355,444,000
Net assets, end of year.................................................
3,189,460,000$
2,785,546,000$
SUMMARY - BALANCE SHEET
2011
2010
Current Assets.............................................................
1,824,242,000$
1,560,998,000$
Noncurrent Assets and Deferred outflows..................
4,118,390,000
3,980,224,000
Total Assets............................................................
5,942,632,000$
5,541,222,000$
Current Liabilities.......................................................
811,272,000
913,063,000
Noncurrent Liabilities.................................................
1,941,900,000
1,842,613,000
Total Liabilities......................................................
2,753,172,000$
2,755,676,000$
Total Net Assets.....................................................
3,189,460,000$
2,785,546,000$
During Audit Period and Current: Michael Hogan
UNIVERSITY OF ILLINOIS
FINANCIAL AUDIT
For The Year Ended June 30, 2011
PRESIDENT
2010
20113
Improvements needed to identify and record period end transactions
$370,897 in revenue should have been recorded in 2010, not 2011
$52,356 in revenue should have been recorded in 2011
University agrees with auditors
FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS
INADEQUATE YEAR END RECEIVABLE AND PAYABLE ACCRUALS PROCESS
The University has not established adequate internal controls over accurately identifying and recording period end accounts payable and accounts receivable transactions for financial reporting purposes.
During the current year audit we reviewed 124 revenue transactions recorded during the fiscal year totaling $14,545,678 and 27 cash receipt transactions subsequent to year end totaling $1,274,941. In relation to our testwork on expense transactions, we reviewed 205 expense transactions recorded during the fiscal year totaling $51,343,490 and 63 cash disbursements subsequent to year end totaling $39,192,830. Some of the transactions that were not recorded in the proper accounting period follow:
• Six educational activities revenue transactions for third party pharmacy billings totaling $370,897 which pertained to fiscal year 2010 were recognized as revenue in fiscal year 2011.
• Three educational activities revenue transactions for drug information services billings totaling $52,356 which pertained to fiscal year 2011 were recognized as revenue in fiscal year 2012.
• Two educational activities revenue transactions for accelerated corporate MBA cohort program totaling $955,642 which pertained to fiscal years 2009 and 2010 were recognized as revenue in fiscal year 2011.
• One employee benefits transaction totaling $92,718 which pertained to fiscal year 2010 was recognized as expense in 2011.
• Two supplies and services expense transactions totaling $44,020 which pertained to fiscal year 2010 were recognized as expense in fiscal year 2011. (Finding 1, Pages 5-6)
We recommended that the University review its current process to assess the completeness of its revenue and expense at year end and consider changes necessary to ensure all period end accounts payable and accounts receivable are accurately identified and recorded.
University officials accepted the recommendation and stated that they will take the necessary corrective action.4
Access reviews are not formally documented
Inappropriate access rights
No procedures in place to monitor user access rights for employees who transfer positions
INADEQUATE CONTROLS OVER USER ACCESS TO INFORMATION SYSTEMS
The University has not established adequate internal controls over access to the information systems used in its financial reporting process.
The University operates an Enterprise Resource Planning (ERP) system to manage the activities of the University. The University functions in a highly distributed operating environment with several thousand users having varying types of system access. Access is granted to users of the University’s information system based on standardized user access profiles.
The standardized user profiles are intended to assist the University in limiting access to the information systems based upon the assigned job functions of the specific users to which the profiles are assigned. The University has implemented a process to review standardized user profiles, train unit security contacts and perform an annual access review for the ERP. However, the annual access reviews are not consistently and formally documented to provide evidence supporting the results of each user review. Further the University has not performed a periodic access review of the human resources supporting information system.
In addition to the internal control deficiencies identified above, during our review of user access rights we identified several users with access rights that were inappropriate based upon their roles and job functions presenting segregation of duties conflicts and the risk that erroneous or fraudulent transactions may be recorded in the general ledger.
Further, we noted periodic reviews of terminated employees with access to the information systems are not performed effectively. Beginning in August 2010, the University’s information technology department began implementing procedures to perform terminated employee access reviews on a daily basis. However, this procedure alone was not sufficient to provide timely removal of access of terminated employees. In addition, there are no procedures in place to monitor user access rights for employees who transfer positions and change job functions. (Finding 2, pages 7-9) This finding was first reported in 2008.
We recommended that the University implement procedures to formally document reviews of user’s access rights and maintain documentation of the results of those reviews to ensure that the access rights granted to each user are appropriate based on their job responsibilities and that the planned level of segregation of duties is achieved on a continuing basis. 5
University agrees with auditors
University officials accepted the recommendation and stated that they have been working steadily to improve information system access controls over the past year and will take the necessary corrective action going forward to address the recommendations in the finding. (For the previous University response, see Digest footnote #1)
OTHER FINDINGS
The remaining finding is reportedly being given attention by the University. We will review the University’s progress towards the implementation of our recommendations in our next engagement.
AUDITORS’ OPINION
Our auditors state the June 30, 2011 financial statements are fairly presented in all material respects.
___________________________________
WILLIAM G. HOLLAND
Auditor General
WGH:TLK:pp
SPECIAL ASSISTANT AUDITORS
KPMG were our special assistant auditors.
DIGEST FOOTNOTES
#1 –Inadequate Controls Over User Access to Information Systems – Previous University Response
Accepted. The University’s highly decentralized operating environment involves several thousand system users, in hundreds of departments across three campuses. These users are engaged in a variety of business and administrative functions necessary to perform the mission of the University. The University does have certain processes in place to limit the ability of users to perform many types of transactions. The University believes that many of these controls have been effective, but does agree that improvement to the user access control environment is needed and will be beneficial.
New policies and related procedures were developed, which became effective February 2010, to require documented annual reviews of standard user profiles and individual user access rights. The implementation of these new policies and procedures began in fiscal year 2010 and continues with full implementation expected to be performed in fiscal year 2011. The University will complete the necessary corrective action to address the recommendation in this finding.