↓ Download PDF ← Back to Library
October25, 2006
. Boardof Trustees
AntiochUniversity
YellowSprings,Ohio
In plllIlningand perfonning oUr audit of AntiochUniversity(the University) for the year endedJune
3D, 2006, we consideredthe UniversitY’sinternal control structure to determine our auditing proceduresfor
the purposeof expressingan opinion on the financialstatementsand not to prOvideBSSUIllIlCC on the intmJal
controlstructure.
, .However, during our audit we. became aware of certain situations that ate opportunities Ioi:
strengt)J.eninginternal controls and operating efficiency. The memorandum that accompanies this letter
summarizesour comments and suggestionsregarding these matters. This letter does not affect our .report’
datedOctober26, 2006 on the financial.statementaofAntiochUniversity.
We will review the status of these commentsduring our next.audit engagement We have already
discussedthesecommentsand suggestionswith the University’spersonnel, and we will be pleasedto diacuss
them in furtherdetailat your convenience,to perform any additional8ludyof these matters, or to assistyou
.inimplementingthe recommendations. .. .. . ..
AI; descn’bedin our engagementletter, auditingstandardsgenerally accepted in the United Stalesof
Americarequire that we communicatecertainmatters to you. These matters and our responses thereto.are
summarizedon the followingpages of ibis.report .
Thisreportis intended solely for the informationlinduse of the Board of Trustees and Management
of AntiochUniversityand shouldnot be usedfor any otherpurpose.
vcrytruly yours,
HAUSSER +TAYLOR LLC
PRELIMINARY DRAFT – FOR DISCUSSION PURPOSES ONLY.
TO BE RETURNED TO HAUSSER + TAYLOR LlC, AND
NOT TO BE REPRODUCED IN ANY FORM WITHOUT THEIR PERMISSION.
CURRENT YEAR COMMENTS
UNIVERSITY POLICIES
Employee Handbook
Situation: Antioch University does not have an Employee Handbook that summarizes the University’s
variouspolicies,procedures,and employeebenefits. Additionally,we were unable to locate a written code
of ethicsfor employees. Finally,we learnedthatthe manualthatshouldgovernthe EmployeeHandbook,the
UniversityHumanResourcePolicy andProceduresmanual,has notbeen revisedsince 1997.
Recommendation:To addressthese itemsAntiochUniversityshould:
a) Update its 1997 Human Resource Policy and Procedures manual to ensure that it properly’
reflectsthe practicesand directionof the University;
b)’ Developan EmployeeHandbookand Code of Ethics; .
c) Carefullyreview these documentsin order to ensure consistencyas well as the informational
(andnot contractual)use of the EmployeeHandbook;and,
d) Require the aclmowledgementof the Employee Handbook and its Code of Ethics by all
employees. We also suggest that employeessign the Code of Ethics annually as part of their.
evaluationto reinforcethe establishmentof the University’spolicy.
ManagementResponse: A rough draft of the handbookis in processand will be presented to the University
LeadershipCouncil(ULC) at its Februarymeeting. The handbookwill be finalized and ratified by the ULC
at the June,2007meeting. .
Whistleblower Protection Policies
.Situation: During our audit, we determinedthat Universityofficerswere not aware of any fraud and were
uniformlyin agreementabout the viabilityof the University’s valuesand standardsto address any incidents.
However,they did acknowledgethat Antiochdid not have a f~l policy regarding whistle-blowersshould
suchan event occur.
. Recommendation:AntiochUniversityshouldadopt a whistle-blowerpolicy such as outlined in Section301
of Sarbanes-OxleyAct. This section requires1:he”audit committee establish procedureS for the receipt,
retention.and treatment of complaints received by the issuer regarding.accounting, internal accounting
controls or auditing matters. The system must be capable of receipt of complaints both from company
personneland thirdpartiessuch as competitors,vendors,and consumeras well as maintainthe anonymityof
complaintsmadeby employees.” Note: The administration’ofsucha programcanbe delegatedby the Audit
Committeewithcertainrequirements.
Management Response: Draft policies have been provided to the University Leadership Council for
discussionand adoptionat the·February,2007.Boardof TrusteesMeeting. .
Fiscal Policies and Procedures Manual
Situation: The Universitydoes not have a fiscalpolicyand proceduremanual.
.Re’Commendation: A well-devised fiscal policy and procedure manual provides written procedures,
instructions,and assignmentof duties which will prevent misunderstanding,errors, inefficient or’ wasted
effort,.duplicated or omitted procedures and other situations that can result in inaccurate or untimely
accountingrecords. In addition,tlle manual can also help to ensurethat all similar transactions are treated
consistently,.thCP~1.MJ1i~~1Jtl-aroFPmS’@tJ081~Nl$~~cOJ9Jt!’t.orm desiredby
managementof the U~BEYRETURNED TO HAUSSER + TAYLOR LLC. AND
NOTTO BE REPRODUCEDIN ANY FORM WITHOUTTHEIR PERMISSION.
UNIVERSITY POLICIES (CONTINUED)
Fiscal Policies and Procedures Manual (Continued)
Management Response: Management has begun the process of documenting existing policies and
procedures as well as gathering existing policies and procedures for various business cycles. During the next
year, these will be reviewed and updated to be finalized b~ the end of fiscal year 2008;
Risk Assessment Processes
Situation: The University does not have a fraud assessment and monitoring program appropriate for its size
and structure. Examples ofpotential risk areas have been described in detail elsewhere in this document:
a) Use of signature stamps on checks;
b) Expense reports are approved by individuals who are supervised by the person submitting the
expense report;
c) Random, manual verification ofpayroll changes are mad~ as the current system
d) Job S.wap . .
Recommendation: The University should develop a fraUd assessment and monitoring program that
identifies/monitors potential risk and vulnerabilities that may OCCtlI’ from fraudulent activities and/or material
misstatements. We further recommend that the University consider identifying and adopting ”best practices”
in this area from comparable structured Universities. Should these existing practices not be sufficient,
Antioch should then develop the appropriate risk program for a University of its size and structure.
Management Response: Management is continuing to assess risk in the fiscal operations area of the
University. A committee will be established to develop processes and procedures to minimize risk
Credit Card Policy
Situation: Antioch University has issued a large number of credit cards through the approval of each campus
President. In addition, key employees also have a University credit card. Expense reportS are required of all
credit card holders along with supporting’ documentation. After approval of the expense report, the
University makes payments directly the bank that maintains the credit cards. If payment on a credit card is
not made on time by the card holder, the bank automatically withdraws the minimum payment from the .
University’s bank account. Additionally, employee credit cards are sometimes used for purchases that
should fall into the “expense/cash disbursement cycle.” Finally, it was noted that .no for:mal credit card
policy is in place at the University.
Recommendation:
Address credit card issues by:
a) Assessing the practice of the employees paying their credit bills rather than the University. In
making this assessment the University should. weigh the financial implications against the
University’s operating philosophy; .
b) Developing a formal policy that identifies who mayhave a credit card and how the cards are to be
used. This policy should also require the acknowledgement of these limi~tions upon issuance of
the card;
ManagementResponse: Management is in the process of reviewing the credit card policies that employees
will sign prior to receipt of the card. Secondly, the University is beginning a pilot program for corporate
purchasing cards which will replace the current credit card system. The new system will allow management
to place greater restrictions on the use of the card, as well as enhanced reporting and monitoring capabilities.
PRELIMINARY DRAFT – FOR DISCUSSION PURPOSES ONLY.
TO BE RETURNED TO HAUSSER + TAYLOR LLC. AND
NOT TO BE REPRODUCED IN ANY FORM WITHOUT THEIR PERMISSION.
UNIVERSITY POLICIES (CONTINUED)
Document Retention and Destruction
Situation: The Universitydoesnot have a formal documentretention and destructionpolicy.
Recommendation:The Universityshould developa writtendocumentretention and destructionpolicy. This
policyshouldnot only coverpaper files but also includeguidelinesfor electronicfiles, e-mail and voicemail.
It shouldalso include a systemfor logging destroyeddocuments.
ManagementResponse: The HR. department has the regulatorystandards on file in the office and plans to
make updatesto these shortly. Other departments,such as IT and Finance will be reviewing the regulatory
requirementsas well. In addition, the Vice Chancellor’s office will begin working on a policy for non
regulatoryitems and will disseminatethat to all campuses.
OTHER FISCAL OBSERVA’I’IONSIRECOMMENDATIONS
Vendor Credit Write Off Policies
, Situation: As. a result of our audit we determined thatthe currentpayables listing contains debits totaling
approximately$120,000. In addition,we learned thatno actionshave been taken to apply these debits or to
requesta refund.
Recommendation:AntiochUniversityshouldtake thenecessaryactions to clearthese debits.
ManagementResponse: The outstandingcredit memoswere aged as follows:
Fiscal years prior to 05~06 $16,684.90
July 05 – Mar 06 $26,580.82
Apr 06 – May 06 $26,467.75
, June 06′ , $51,148.82
Duringthe :firsth8lfof the currentfiscal year the Universityhas utilized $97,470.93 of $120,000 outstanding
at June 30. The remaining credit memos that were open at .June 30 and are still open at December31 total
$23,409.86. ‘
The campuseswill be inl;tructedas part of the University’sfiscal policy to review outstandingcredit memos
quarterly. The campus will contactthe vendor and request cash refunds if no further purchases are planned
duringthe next quarter.
Property, Plant and Equipment
Situation: Currently,the Directorof Finance aridBudgetPlanningperforms a year end update of assets.
Recommendation:Antioch shouldperform a monthlyupdatesof its assetsrather than the currentpractice at
yearend. In addition, we believethat the processshouldbe performedby an accounting clerk.
Management’Response: Management,will be implementinga policy of updating the fixed assets on a
monthly basis. In ‘addition, this process will be perform~d by support staff within the Vice Chancellor’s
office. .’
PRELIMINARYDRAFT- FOR DISCUSSIONPURPOSESONLY.
TO BE RETURNEDTO HAUSSER+ TAYLORLLC. AND,
NOTTO BE REPRODUCEDIN ANY FORM WITHOUTTHEIR PERMISSION.
OTHER FISCALOBSERVATIONSIRECOMMENDATIONS(CONTINUED)
Mandatory Vacations for Fiscal Staff
Sil1iation: One of the most effectivedeterrentsto fraud is to have members of the fiscal staff periodically
performthe function of anotherfiscal staff. DuriI].gour audit, we did not find evidence of any such anti
fraud actions.
Recommendation: We recommendthat fiscal staff be requiredto take at least one full week of vacation.
Duringthat week, anotherfiscalstaffshouldperformthejob functionsof the other employee.
ManagementResponse: The HR director will be arranging a meeting with the Chancellor and other
Universityleadershipto discussthe implementationof sucha requirement. Drafting of a policy’and approval
willbe donepriorto the fiscalyear-end. .
Expense ReportApproval Procedures
Situation: Our auditrevealedthat some expensereports are approvedby individuals who are supervisedby
the p·erson submittingthe expensereport. As generalrule, expensereports should only be approvedby a
supervisoror individualsin the supervisorychainabovethe filer.
Recommendation: Antioch should modify its expense approval process to require approval of expense
reportsby supervisorsor individualsin the supervisorychain above the filer. As this procedure extendsto
the Chancellor/Board,membersof the Auditcommitteeshouldbe assignedthe responsibility of approval.
ManagementResponse: Universitymanagementis in the process of putting a policy in place which will
ensure expensereportsare approvedby the appropriatelevel. The Finance Committee of the Boardwill be
askedto reviewthe Chancellor’sexpensereportSat the closestboardmeeting following the expenditures,as
w~. .
Payroll ChangeReport
Situation: Duringourreview,we notedthatchangesto an employee’spay rate are not automaticallyflagged
for verificationof proper documentation. For example, we learned that changes to payroll modules of
Datatelare processedand manuallyreviewedat each campus(betweenthe Time VerificationReportand the
EmployeePersonnelForm). Once approved at that campus, checks are generated to the Yellow Springs
payrollprinter. In addition,annualchangesto pay rates are recordedin essentiallythe same fashionafterthe
receipt of the employee’sContractLetter. The qualitycontrolproceduresused to ensure that thesepayroll
changeswereproperlyapprovedandrecordedis the madethrougha manualrandom selection of employee’s
personnelfiles and areviewof the supportdocumentationin theirpersonnel:file.
Recommendation: Antioch should develop an exceptionreport to automatically identify or flag changes
made to an employee’spay rate. The informationprovidedin the form of a. “Payroll ChangeReport”would
dramaticallyincreasethe likelihoodof catchingany errorsas well as substantiallyreduce the possibilityof
.fraud.
ManagementResponse: This functionhas been activatedin the HR. moduleof Datatel. The HR. directorwill
be workingon providingthe informationneededto eachcampusin orderto retrieve and archivethereport.
PRELIMINARY DRAFT – FOR DISCUSSION PURPOSES ONLY.
TO BE RETURNED TO HAUSSER + TAYLOR LLC, AND
NOT TO BE REPRODUCED IN ANY FORM WITHOUT THEIR PERMISSION.
OTHER FISCAL OBSERVATIONSfRECOMMENDATIONS (CONTINUED)
Cash Receipts
Sit7,lation: At the Los Angeles/SantaBarbara Campus, cash receipts are enteredinto the Datatel Accounts
Receivablemoduleand a documentationattachedto the AR’s CR SessionReconciliationReport. A deposit
slip is preparedand checks are stamped”ForDeposit Only.” No copiesof the checks or the depositslipsare
made or maintained. The informationis reviewed and approvedby Director of Accounting Serviceswho
also prepares the bank reconciliationsfor the EFT and Deposit Accounts. These reconciliationsare not
reviewedby the CFO on a monthlybasis;
Recommendation:Antiochshouldconsiderrevisingthe mannerin which cashreceipts are processedfor the
Los Angeles/SantaBarbaraCampus. Specifically,Antiochshouldrequire the use of a Cash ReceiptPrelist
at all campuses where copies of checks and deposit slips are made upon the opening of the mail. These
prelists should then be compar~d to the actual deposits. In addition, at the Los Angeles campus, bank
reconciliationsshouldbe reviewedand signedoffby the CFO of that location.
Management.Response: The process at the Los Angelesand Santa Barbara campuseswill be addressedin
orderto have moresegregationof dutiesas possible,as well as documentingthe checksreceived. Thesenew
procedureswillbe draftedimmediatelyandreviewedandimplementedprior to fiscalyear end.
Cash Disbursements
Situation: Duringour review, we noted that the process’of signing cash disbursement checksincludesthe
use of a signaturestamp. In addition,we learnedthatthereis no dual signingof checksnor have dollarlimits
been established. .
Recommendation: AntiochUniversityshoul.d eliminatethe use of the signaturestamp in favor of a more
secureand auditablemethod(example,electronicsignature,with appropriatesystem controls). In addition,
thresholdsshould~e establishedso that dual signaturesare required.
ManagementResponse: The Universitywill be draftinga policyregardingdual signatures at certaindollar
thresholds. It is not fiscallyprudentfor the Universityto adopt electronic signingcapability as it requires
equipmentthat is cost prohibitiveat this time. A more secure,yet efficientand cost effective,methodof
signingcheckswillb.e researchedin the comingmonths..
MULTIPLE CAMPUS OBSERVATIONS/RECOMMENDATIONS
Financial Operating Procedures across the University Network
Situation: During our audit, we noted that the financialoperatingproceduresacross the various campuses
were sufficientlydifferentto createboth internaland externalreview difficulties. For example(and as noted’
later in these comments)inconsistencieswere fmmd in PurchaseOrders, Credit Cards, and Expense/Cash
Disbursementcycle.”
Recommendation: In reviewing its financial operating procedures as part of the Fiscal Policies and
ProceduresManual,Antiochshouldconsideridentifyingand adopting”best financialoperatingprocedures”
from its campuses. Should existingpractices for a particulararea not be sufficientAntioch should either
reengineeran existingprocess to make it compliantor note in the Fiscal Polic.iesand ProceduresManual
where the processvariation(s)are allowed.
PRELIMINARYDRAFT- FOR DISCUSSIONPURPOSESONLY.
TO BE RETURNEDTO HAUSSER+ TAYLOR LLC, AND
NOTTO BE REPRODUCEDIN ANY FORM WITHOUTTHEIR PE;RMISSION.
MULTIPLE CAMPUS OBSERVATIONSIRECOMMENDATIONS (CONTINUED)
Financial Operating Procedures across the University Network (Continued)
ManagementResponse: AP. part of the documentation of fiscal policies, University Management will be
reviewing the best practices of each campus and working with them to create base campus-wide policies and
documentation.
Student Financial Aid Records
Situatio~: During our audit we noticed that’each campus had a different approach to record keeping.
Recommendation: We realize that the physical location and the makeup of the student body at each of the
canlpuses would make the standardization of Student Financial Aid difficult; however, we believe record
keeping is one aspect of the process that could be standardized. Therefore, we recommend that Antioch
develop a University-wide policy for maintaining Student Financial Aid records. As part of that policy,
Antioch should standardize forms used for each campus to the greatest extent possible, including a file
checklist that details any form that is to be retained in the file.
ManagementResponse:AP. part of the review .of fiscal policies, the Financial Aid policies will be reviewed
as well. A file checklist will be·including in the improvements to those offices. .
Purchase Order and InvoicePolicies
Situation: Aspects of Purchase Order and Invoice procedures across Antioch University are inconsistent.
For example, purchases can be made by departments with or with out the use of Purchase Order form. In
addition, at some campuses (i.e., LA/Santa Barbara) Purchase Orders are not used. In terms of Invoice·
procedure, lnvoices are not routed directly to Accounting where they can be matched with the Purchase
Order as an additional check
Recommendation:Antioch University should:
a) Require the use ofPurchase Orders by all departments;
i) . Should an exclusive Purchase Order policy be determined as too restrictive, the University
. should consider establishing a minimum dollar threshold at which the use of Purchase Orders
is required, and .
ii) Define the procedure for purchases that fall·below the required dollar threshold (e.g., use of
credit card is/is not allowed); . .
b) Require invoices to be routed to Accounting for matching with PUrchase Orders;
Management Response: University management has already’ begun discussions regarding the system.
capabilities of Datatel in regards to the purchase cycle. AP. the capabilities are determined, policies will be
,created and standardized across all campuses. The Director of Purchasing has already begun gathering the
best practices of each campus to begin an outline of the process. It is the goal of the University to adopt a
standard purchase order and require it to be used over a yet to be determined dollar tbreshold~
OTHER OBSERVATIONSIRECOMMENDATIONS
Bond Arbitrage
OTHER OBSERVATIONSIRECOMMENDATIONS (CONTINUED)
Bond Arbitrage (Continued)
Recommendation:AntiochUniversityshouldestablishan annual evaluation of its bonds to determineif any
liabilitiesmayexistdue to arbitragepriorto the five yearreportingdate.
ManagementResponse:The Universitywill engage a legal firm to perfonn the bond arbitragefor fiscalyear
2007.Theprocessfor futureyears willbe reviewedat thattiniebased on guidancefromthe legal:finn.
. FASB Interpretation No. 47 (As Amended)
Situation: This Interpretation clarifies the tenn “conditionalasset retirement obligation”. Under this
Interpretation.the cost of asbestos removal from the University’sbuildings is required to be estimatedand
recordedas a liabilityon the University’s statemeptof financial.position. Managementhas not performed
the appropriateproceduresin orderto be ableto reasonablyestimatethe liability.
I •
Recomm.endation:Managementneeds to take stepsimmediatelyin order to be able to provide a reasonable
estimatefor the cost ofasbestos. This shouldbe completedby the end of fiscalyear 2007.
ManagementResponse:Managementis revieWingseveral differentoptions regarding the valuationof the
asbestosremovalliability.There are severaldifferentstepswhichmust be performed,such as identifyingthe
locationof the asbestosas well as the estimatingthe actualcostto remove it. The costs of suchan evaluation
by an outsidecontractormay be prohibitiveat this time for the University. .AP. such, in’:’housealternativesare
beingdiscussedwiththe auditorsto ensurethe resultswouldmeettheir auditrequirements.
SAS 94 – INFORMATION SYSTEMS DOCUMENTATION
Situation: During our review we noted that the policies governingthe operations and maintenanceof
University’sInfOrIn8.tionTechnologyare inconsistentlyappliedor not in place. For example:
a) Eachcampusis responsiblefor determiningwhatdata andhow frequentlydatais.baCkedup;
b) Eachcampusis responsiblefor determiningits networkand securitypolicies;
.c) Eachcampusis responsiblefor the grantingand controllingofremote access;
d) Backuptapes for Yellow Springsare storedat the DatabaseAdministrator’s home. However,they
. are notmaintainedin a securedlockingsafe; .
e) Us~ passwordsare not periodicallyrequiredto be changed;
f) Securityeventlogging (logons,accessviolations)is not enabled;
g) Workstationsare not automaticallyenabledto lockwhenleft unattended;
h) Thereis no documentedDisasterRecoverylBusinessContinuationplan in place.
Recommendations:
a) A minimumback up policyshouldbe establishedandput into place across all campuses.
b) A singlecampuswidenetworkand securitypolicyshouldbe documented;
c) A singlecampuswide policyshouldbe developedto guidethe individualcampusesin grantingand
controllingremoteaccess;
d) Given the sensitive informationon the tapes, a policy should be developed that specifiesthe
maintainingof backups in securelocations;
e) A single campus wide policy should be developed to require the periodic changing of user
pass~fijELIMINARY DRAFT- FOR DISCUSSIONPURPOSES ONLY.
f) As part of1l(g Beme~Nmemtm~!9lS~FfUPwAA