Legislative Joint Auditing-Educational Institutions

I will technical live recall 2 years. Sorry about that of. Okay chair seats a quorum. A. N.. Follow made order item be adoption of minutes for of November the 2021 meeting. Motion made in the second motion made in second all those in favor say aye. OPPO's motion carried. Of the item for the review of reports. And Mr Lee you. Would you go through the first item please. University of Arkansas. Thank you Mr chair. Good afternoon today we have 19 educational reports for review 18 of these reports are from fiscal year 2021 and we have 1 report from fiscal year 2020 of the 19 reports there were 9 reports with findings also 5 of the reports to be review today were classified as school districts on fiscal distress status in fiscal year 2021. We will begin with the one report that was certified to the bond board. The University of Arkansas System had 6 findings. The first finding for the UA system was related to the timeliness of financial statements that were submitted to ALS staff for inclusion in the annual comprehensive financial report a timeline is established by DF in a in the U. a system office so that the financial statements of each individual campus can be submitted to the system office for consolidation. 5 campuses did not meet the deadlines established by system administration as a result system office was unable to provide the consolidated report to a LA staffed by the originally scheduled date which the way the audit process. The remaining 5 findings for the UA system were the result of internal audit findings that were referred to the bond board and the applicable prosecuting attorney. Due to the volume of detail within each of these findings I will summarize. These 5 findings were related to unauthorized disbursements allegations of misappropriation of funds and property improper transactions fraudulent use of a credit card an unauthorized changes to a vendor master file. Improper transactions discovered by the internal audit department at various campuses ranged from approximately $1300 to approximately $336000. One individual at the university of Arkansas Fayetteville and one individual at the University of Arkansas pine bluff we're charged with theft of property and various other charges as a result of fraudulent transactions and this concludes the summary of findings for the UA system I'll note university representatives are present for any questions. Gilmore. Yes appreciate that Mr so simply Biel long list laundry list of things here. And I know we have someone here from the can we get them to the table yes yeah if. Whoever's OR will all be representing the university thank you sated down the table. And please identify yourself. And shelter Gilmour has a question for you. Janitorial that that vice president for finance for the University of Arkansas System and we also have additional representatives from each of our campuses that are identified in the findings if you have a question. I'm don bonnet president you have a system. Okay thank you Reese senator Senator you're recognized thank you Mr thank you for being here yeah I guess my question is of a very broad question since of there's a lot of different things here that just. I don't know I had and hesitant to use the word negligence but it just seems like there's a lot of things is look to the cracks would that be all's thought as well. You know we prepare and have control systems at each campus and yes there are things that happened some of them are due to bad actors hopefully we have put in more controls the actually look for this in particular so if you need any specifics I you know I think that we'd be happy to go into the detail if you want it well and and I'm glad to know that the people who are responsible are being obviously address street address but I mean just things like missing deadlines and and things of that nature I'm sure you probably did fire someone over missing a deadline or timely filing of paperwork or something like that I would assume so what are we doing R. their checks and balances being put into place to keep that from happening in the future. And and I'll talk about that specifically we are have been going through and are continuing to go through and implementation of workday which is that you know cloud based system for all of our general ledger or a human resources all of that and we made that decision about 4 years ago and we have. Used a lot of resources there were a lot of changes that occurred with that there were some difficulties right about the time we were doing the audit in the year in preparation and that cost most of those delays we do not expect that to recover we think that'll be just this year and we do not expect the same problems to occur in the future. Can I add to that. The reason why the reason we went to work today he said if you look at the system it's a huge endeavor spread out over 21 different entities 14 of 15000 different points there is no loss is acceptable 0 however I think we all understand we look at if you have a bad actor intent on hiding their activities one of the reasons we went to work today is that these checks and balances that you mentioned will prevent this sort and cover it and in fact in this particular circumstance the 300 and some odd $0 lost the individual had a scheme going and because of the checks and balances in workday came to realize that this was not going to be able to be continued in fact and what it wouldn't you and so the individual resigned which triggered the audit and obviously as you read the report we turned it over to the to the law enforcement an individual was arrested you know and and let let the courts take their. Her actions. I do a follow up if I need to go to someone else I want to do that sure go ahead go ahead last follow up I have and I again I don't want to belabor the issue but as it relates to transactions on the courts I'm assuming there's now things in place to stop that as well. Or maybe there were and it just didn't get caught I mean again that maybe walk for that force there were there were procedures in place we have Titan does that we've also looked at each person's ability to approve and there is a a larger at at larger number of people in the approval chain at this point. Thank you thank you Mr. Senator we have. Thank you Mr so my first question I think I'd be pretty easy the delay in getting the reports in was that up COVID related issue or was there something else going on with that net that had more to do with our implementation of more and workday being cloud based we've that wasn't the real you know have it did not really play a part in okay my second question kind of following up on the center going back to the the credit card transactions it looks like there was. Then on the 1 there was almost 100 transactions and and on another 160 and 40. How often is that looked at because I I agree and you base a huge system and all it takes is one bad actor actor to spoil the bunch here but 99 transactions that seems like that would be a large span of time so how often. You know is that checked as it once a year or is it done soon try to catch these things now we we we we verify credit card charges on a monthly basis actually there downloaded at least every 2 weeks and I have I just asked the CFO for the U. I. campus and sent she's more familiar with the specifics of that let's ask her to on. 8 if you would identify yourself to the before the committee and and then per se thank you Mr chairman and borderline I'm of the vice chancellor for finance and administration the CFO of the university of Arkansas Fayetteville been with the university for about 18 months. And I would say. Jean is correct we do review of credit card transactions every month. In the situation is doctor Bob it said that in our previous system prior to work day employee certain employees were given the opportunity to review their own transactions and that's what led to this particular situation within our working environment that cannot happen. Supervisor must so the approval chain to strengthen to in the as it relates to all 3 fatal findings I would say workday has contributed to an increase in the controlled environment. Making it stronger and the less likely for these things to occur in the future still at least 2 people looking at each transaction that is at least Arkansas okay my my last question is on finding for work talks about the missing assets 21 tax assets totaling 62 and others can you kind of give us an update on that and what we're going to try to assure that is this a finding predates predates me so I'm not S. as the personally familiar with it but as I understand the the employee at the center of this. It's procuring assets the outside of the policy and procedures that were designated by the university we we did not identify any specific instance of fraud other than the fact that we believe that there what they were getting some personal benefit either through gifts or other equipment from vendors but the the the situation was turned over to the state police they've investigated it did not find any situation that was a prosecutable in the in the case has been closed by them all right thank you thank you for your efforts to try to take this up. Senator Bledsoe. Thank you Mr chair Dr Bob. I've been here a long time I don't ever remember a report this long with so many. Infractions do you agree all right. I agree as as I said senator no losses acceptable one of the. I thank strong motivations for us going through the pain of workday implementation it is that we had 6 or 7 different systems across the U. of a system from accounting for H. R. and that we did not feel we had controls in place to be able to control such a large endeavor and and really do a credible job of managing the state's resources we now have a single system the other thing I will tell you is since I've been here we have added very few staff but we have added auditors. And I think that has been very helpful in us I'm covering these types of circumstances and when we do we immediately seek restitution we also turn it over to law enforcement of course what happens once we turn our information over his house. All right well speaking of law enforcement. Sometimes in the past when we turn. Reports over to the prosecuting attorney it is not always. A prosecuted and that bothers me and I haven't found an answer. A but may be if you're. Staff that are looking at all of this might contact the different prosecutors and save or what have you done. And I think that when we are serious about prosecuting those that commit a crime especially a it's you know as you know we look for education dollars every player and the something like this is the. You know it increases because of that and so it putting pressure on the prosecuting attorney might help. We have so it's a good point our legal counsel stays up when the attorneys for a period of time our board also has been very concerned about this and in fact now keeps a loss report each each board meeting the chief audit executive and or Gina a report to the board on a restitution new cases that have been filed and whether we can publicly disclose the information obviously if it's involved in a. Security in the finance to keep the information quickly 2 weeks we do exactly what he's he's you mentioned that is. Keep one and ask questions of the prosecutor I would just say not walking in their shoes there's a lot of serious crime out there I think sometimes perhaps particularly the smaller losses not 300000 but 1000 or to get give all through the fall through the cracks. Thank you very much also I wanted to mention that once this report is filed it goes back through that system again if they didn't pursue it at the local prosecutor lateral level because legislative audit actually brings it back to their attention again thank you I would add that with respect to the first finding the largest one that we that that person is expected to go on trial in April in April okay. Unless it's continued for some reason I think it I mean I don't know if you could do this but it might be good to have a report some point to say what exactly happened because it it's. You know for us to get a report like this and to you know know that in the years past we've had some and not know that they're really being prosecuted our if you know no restitution has been made it's very discouraging and I know it is to to you and all the others as well thank you. Are there any further questions from the committee miss McKinsey. Thank you Mr chairman apologize for being tardy perhaps I missed this so I wanted to go back on what you just said a few moments ago with regard to the P. cards to understand you correctly that that we had a certain group of people that didn't have any oversight. So within our previous environment system environment an employee could of approve their own transaction there was a secondary control there was a report that was made available that listed all of transactions that were self approved and that that was distributed to the Department in this particular situation that control failed the the review was not occurring as designed. Which allowed these transactions to continue to be put through the the old system sorry saying that a an entire group of people could self approve or was it a certain I'm trying to understand the process there how long that's been going on or we allow people to self approve. Selected individuals I understand that and how to determine who would be the selected individuals that could self approve. You might want to identify. Identify yourself please for the committee okay Fessler on the social vice chancellor of budget financial planning and business services of the University of Arkansas in terms of the individuals who are allowed to self approval believe that had to do with the Department all make up and staffing levels with some of the colleges in individual departments. But I don't have the specifics on the exact determination as to why someone in a particular unit would be allowed to self approved that is of course something that in our new system is no longer able to be done. Thank you because that certainly is concerning and obviously we saw that and that certainly was a good idea as you're saying now we have how long that been going on or self improvement was allowed just curious. I don't have an exact time frame. Our prior ERP system was in place for a little over 20 years so some some period of that time self approval of transactions was available. Are there any other questions from the committee. If not we appreciate you being here and answering the questions but I'm very helpful it. And you may be excused. If there is no other questions entertain a motion to file this report. Motion made and second all those in favor say aye. Oppose motion carried. Mr Ellie. The next 3 reports were referred to the applicable prosecuting attorney. The Arkansas state university system had 5 findings the first finding was due to errors noted at Henderson state university on the statement of cash flows and notes to the financial statements these errors were corrected by university personnel during the audit. The second finding was related to the timeliness of financial statements that were submitted to a LA staff for inclusion in the annual comprehensive financial report a timeline as established by the FNA as well as the AS you system office so that the financial statements from the individual campuses can be submitted to the system office for consolidation one campus did not meet the deadlines established by system administration as a result the system office was unable to provide the consolidated report to a a staff by the originally scheduled date which delayed the audit process. The third and fourth findings listed were referred to the applicable prosecuting attorney and we're due to salary overpayments of approximately $4200 at a issue Jonesborough and $4800 at a issue mid south. The over payments at a issue Jonesborough were recovered and the overpayment at ASU mid south has been formally requested by the university after an investigation was performed by the A. issue internal audit department. And the final finding for a issue system was due to salary overpayment at Henderson state university the university discover that the former acting president was paid 30 $2000 in excess of her contracted salary from August twenty twenty two June 22021 when she took on her current position of general counsel chief compliance officer. And the university failed to adjust her salary accordingly she did reimburse the university on August eleventh twenty twenty one and this concludes the summary of findings FOR the issue system I don't know university representatives are present for any questions. Representative may okay. If you would identify yourself for the committee in. Mr minx thank as a question. Chuck Welch presently Arkansas state university system. To the right. Julie Bates executive vice president and CFO thank you for both being I think I know the answer to my question but I just wanna verify the finding one about the mass that was going on Anderson State University that. Looks like there's a lot of negligence going on there in order for. Millions of dollars to be misclassified the weather I'm assuming all that was under the old mass before we all took over or is that an ongoing issue or or or we had on the time line with us sure representative makes so those are just for clarification those are just reporting error so when they book where something should be and the voting statements in the wrong place in and if you'll remember we were here in September talk about Henderson's 20 audit this was an odd you so this is the first year there ever part of our consolidated all right they were actually what would they have to have the this year's consolidated audit done before the 20 had even been review because when they were independent those run much farther behind on the timeline will you typically use that you're before to to speak to your 21 so you have a combination of. Crazy timing really trying to do those 2 at once moving in the consolidated for the first time and also transitioning to a new ERP system so a lot of things in that in terms of miss classifications and errors and I I told you guys back in September when they get fully into our system on the R. P. and part of the consolidated we do have different control measures that help identify errors such as that it's not uncommon for there to be errors but obviously there's a little harsher spotlight here but we're certainly have got you know the personnel the protocols it's just the timing of this in the way that it all hit but no concerns no concerns about fraud anything of that nature literally just repeat booking errors are so this is more of a training issue that is absolutely not absolutely thank you thank you Mr. Any other questions from the committee. Well believe you got all fly what if I might just have one second I just like to introduce to the committee The New chancellor Henderson state university Dr Chuck Ambrose who just joined us he is a national renown figure rockstar really excited I appreciate you allow me that opportunity to introduce him sure thank you welcome. With no other. Questions before the committee you have a question does motion. Motion to file the report I have a second second all those in favor the motion say aye. Oppose motion carried or a. Mr. Arkansas tech university had one finding which is referred to the prosecuting attorney. Eligible employees payroll direct deposits were fraudulently diverted to another bank account resulting in a loss of $128000 of which $19000 was recovered university officials have filed an insurance claim to seek reimbursement for the fraudulent transactions and this concludes the finding for Arkansas tech university. Do we have any questions represent out. Thank you Mr. I guess this question is. How can they be fraudulently directed or diverted to another bank account was it going from. Somebody's bank account that was an employee of the university. If you would recognize yourself to the Committee Suzanne McCall controller. Jamie Fisher assistant VP of finance administration. The man to the questions and so what occurred was we were our system was of the cybersecurity issue it wasn't like one of our employees committed this fraudulent activity so we immediately contacted the police and our insurance company to investigate since it was outside of the university our system was actually internally hacked hacked by someone outside externally from the university and so they were just diverting small amounts from a bunch of different accounts I'm it occurred when our payroll was supposed to be direct deposited into our employees account and so what they have done is they had entered in our system and change the account and routing number to go to at a different account and routing number that they had control over. We were the whole deposit one into their account versus all the employees that employee we had a list of employees it didn't happen to all of our employees it was just a select few and so we. What they did was they just if change their account and routing number to have their entire paycheck for that month put into their bank account and so as a 1 time instance and cry immediately we caught it immediately caught at 630 this morning when an employee noticed they called me directly I immediately called the bank once they were open and we were able to pull back the 19000 quickly we we thought we had secure the entire amount but at that point there they had already and move the money from where they had initially directed it to and outside yes okay thank you. The representative makes. Thank you I'm so chair of the technology committee obviously the cybersecurity aspect of this catches my attention so the the 2 questions I have are first have you did you report the cybersecurity incident to legislative audit as is now required and how quickly did that go about and then my second question is what have you done since then to further secure your system we reported to legislative audit that morning it was and we had kept them up to date as far as when we were able to gain access to the 19000 we will let them know every step of the way excellent and secondly we have put an additional firewalls and protective as well but we were able to in our system every time an account or routing number or personal information of a faculty or staff member has been altered that faculty or staff member now receives an email along with myself the payroll director or a P. supervisor so that everybody knows something has been changed if the employee or staff faculty member and did not make those changes then they are medially to report to us if anybody on that list did not make those changes we are to freeze that person's account that minute thanks in my final follow up is have you consulted with any outside cybersecurity experts for R. D. I. S. on countermeasures to that or is that something you all did internally how G. all. We did handle it internally I don't know if R. O. I. S. department consulted with anybody outside that would I would have to contact them and ask them directly but I do know that we worked closely with the investigators who were looking into this for insurance purposes and we were taking any suggestions that they had in trying to implement them also and we definitely appreciate you pouncing on this quickly and not letting it to fester correct to make the world differences you know thank you ladies. Are there any further questions. If not to the we appreciate you being here to answer questions and we're dismissed. And. No further questions I have a motion and a second to file this report all those in favor say aye. Oppose motion carried. Mr. Our next report is Marvell school district who was on fiscal distress status during fiscal year 2021 in the report contains 3 findings the first finding which was referred to the applicable prosecuting attorney was due to the district treasurer who was also the payroll prepare being paid time point 5 totaling approximately $1100 without supporting documentation the second finding was related to unauthorized withdrawals totaling approximately 30 $6000 district personnel discovered the unauthorized withdrawals and all funds were recovered from the bank. And the last finding the district had one repeat finding related to bank reconciliation issues and this concludes the summary findings from Marvell school district. Of did we have someone here from Marvel or the Department of it both but we have someone from Marvell and okay we also have. Department of it. Please identify yourself to the committee and thank you for being here. Tracy read department of education fiscal services. One. Good afternoon my name is the natural Williams and I'm the interim superintendent Marty Lang school district. Okay actually Granbury finance manager for the marvelous school district. Why we improve them all the lands cruisers will. Thank you for being here Mister Bates. Thank you all for being here for making the trip over. So I I guess I have 2 questions and I might start with the Department of ad censor and fiscal distress. Is the state running this or are they still under the control of the local school board and if the state's running it what's the state's responsibility and watching the fiscal situation so Marvell lane is not under state takeover there simply fiscal distress so we provide support from our office and handling all the finances okay and then my question for the for the district it's according to this it says that there were on authorized withdrawals totaling $36000 made from the district's fund can you of going to that a little bit more once on authorized funds what were these issues for or the funds for cover so I believe there from an outside source outside entity making same thing with the with Arkansas tech made those withdrawals fraudulent fraudulently and when they discovered it was reported to the bank and the money was recovered so as a cybersecurity incident then if. It actually happened with that may not necessarily with our system the bank was kind of it I want to thank all of you are accounts and everything okay in the the bank of Millie close that account and we open up another one okay so someone hacked the bank account and that's where it happened so it wasn't anything that there wasn't any criminal mischief among anybody at the school that sounds like sign Watson okay and there was a cyber security incident reported to legislative audit you know if if indeed that was a. No Sir at that time it was not it was only a one I do came on board with me even though I didn't notice that with the post and if that happens so going forward into that that's a new low actually just pass the session to try to help get a better handle on arrival cybersecurity across the state so I appreciate it thank you all for being here. Senator you're recognized. I just want to ask a question you had some repeat findings and I wondered what what's happening with those. So I'm new in this role as well I started in may and so we are currently working on making sure that bank reconciliation is completed monthly we work with the district to make sure we can explain any of that to make the corrections that are needed so that we can get that down to 0 that has been an ongoing peace that we're having to go back historically defined where that occurred and so we're close to getting that completely resolved and so in the future we hope that they will have a 0 are we work at having a 0 variants the future every month okay I'm looking forward to the hearing that everything's all clear so thank you very much. Represent because. Thank you Mr chair so your fiscal year for 21 is it what is your fiscal years at. June to July like this state June okay so you came on in may you said in a. So. You realized nothing there but no record bank reconciliations and so. Are you know check it monthly how do we get because I office checks that monthly David they report that to us they send us the Bacharach and the bank statement so we're looking at that report monthly and before a you came on it was at the beginning for fit me of their fiscal distress or somebody else in charge of that and they were not seeing why we weren't doing the bank reconciliations are catching them I do not know that I just know that now that process the place that we they're required to send it to us by the fifteenth of every month so that we can make sure that they don't have a variance or we can help them find where the variances and be able to explain that I'm not really sure what they did in the past and they are no longer on fiscal distress. They were released in. September. Follows but since they're not but you're you're on now you said there no long run fiscal distress but are you said to me providing that over signer how can we we do we have assurances that we continue to monitor for 3 years after the release okay thank. You for the question. If not the you're dismissed thank you for being here. Motion been made and seconded to file this report all those in favor say aye. Oppose motion carried. And public school district miss Tilly. The next report will be for pine bluff school district to which was considered on fiscal distress status during fiscal year 2021. The report contained only one repeat finding related to bank reconciliation issues one finding was related to not maintaining supporting documentation in accordance with an image memorandum of understanding agreement with the business manager of dollar way school district and the final issue was for posting errors noted in the district's general ledger and this concludes the summary of findings for the pine bluff school district. Okay committee we have any questions. Okay. With no questions then they're trying motion to file this report. Motion made then. A probably need a second. All right thank you motion made in second all those in favor say aye. OPPO's motion cared thank you. Distilling. The next 4 reports are starting on page 9 of the synopsis contain findings that were not referred to a prosecuting attorney and we're not repeat findings staff recommends that the critics Committee take a moment to read over these reports and follow these 4 reports in mass as reviewed. Okay. Tried a motion that the property come. Mr makes thank you Sir the Lee County where it says the district had uninsured and non collateralized blank composites can you further explain what that is. Yes during February twenty twenty one the the district's bank account was actually purchased by another financial institution and it was during that transition the collateral for the bank I'm sorry the district's collateral actually lapsed in during the audit I know the super and I believe the superintendent contacted the new bank to ensure that the accounts were fully collateralized but it's just a transition period okay all right thank you. Okay. Senator. Motion. The emotion of maiden second to file this report all those in favor say aye. Opposed motion carried. Okay are we. At the bottom. The remaining 10 reports that are listed on page 11 of the synopsis consist of audits with no findings staff recommends that these reports be filed in mass. Okay we have a motion to file these. Alesha for any questions we may have some. Need a second. Most been made in second all those in favor of the motion say aye. Opposed motion carried. And I think that concludes our business and committee members thank you very much for attending to the. Appreciated thank you. We are Jr.