JUNE 7, 2002 02-37

Financial Audit Division The Office of the Legislative Auditor (OLA) is a professional, nonpartisan office in the legislative branch of Minnesota State government. Its principal responsibility is to audit and evaluate the agencies and programs of state government (the State Auditor audits local governments). OLA's Financial Audit Division annually audits the state's financial statements and, on a rotating schedule, audits agencies in the executive and judicial branches of state government, three metropolitan agencies, and several "semi-state" organizations. The division also investigates allegations that state resources have been used inappropriately. The division has a staff of approximately fifty auditors, most of whom are CPAs. The division conducts audits in accordance with standards established by the American Institute of Certified Public Accountants and the Comptroller General of the United States.

Consistent with OLA's mission, the Financial Audit Division works to: · Promote Accountability, · Strengthen Legislative Oversight, and · Support Good Financial Management. Through its Program Evaluation Division, OLA conducts several evaluations each year and one best practices review.

OLA is under the direction of the Legislative Auditor, who is appointed for a six-year term by the Legislative Audit Commission (LAC). The LAC is a bipartisan commission of Representatives and Senators. It annually selects topics for the Program Evaluation Division, but is generally not involved in scheduling financial audits.

All findings, conclusions, and recommendations in reports issued by the Office of the Legislative Auditor are solely the responsibility of the office and may not reflect the views of the LAC, its individual members, or other members of the Minnesota Legislature.

This document can be made available in alternative formats, such as large print, Braille, or audio tape, by calling 651-296-1727 (voice), or the Minnesota Relay Service at 651-297-5353 or 1-800-627-3529. All OLA reports are available at our Web Site: https://www.auditor.leg.state.mn.us

If you have comments about our work, or you want to suggest an audit, investigation, evaluation, or best practices review, please contact us at 651-296-4708 or by e-mail legislative.auditor@state.mn.us

OFFICE OF THE LEGISLATIVE AUDITOR State of Minnesota ° James Nobles, Legislative Auditor Senator Ann H. Rest, Chair Legislative Audit Commission Members of the Legislative Audit Commission James H. McCormick, Chancellor Minnesota State Colleges and Universities

Members of the Minnesota State Colleges and Universities Board of Trustees Dr. Joseph Sertich, President Northeast Higher Education District

Dr. J. D. Droddy, Provost Vermilion Community College

We have audited Vermilion Community College for the period July 1, 1998, through June 30, 2001. Our audit scope included: financial management, tuition and fees, payroll, administrative expenditures, and bookstore operations. Our scope did not include federal financial aid, which was audited as part of the Minnesota State Colleges and Universities'annual financial statement audit. We highlight the audit objectives and conclusions in the individual chapters of this report. We conducted our audit in accordance with Government Auditing Standards, as issued by the Comptroller General of the United States. Those standards require that we obtain an understanding of management controls relevant to the audit. The standards require that we design the audit to provide reasonable assurance that Vermilion Community College complied with provisions of laws, regulations, contracts, and grants that are significant to the audit. The management of the college is responsible for establishing and maintaining the internal control structure and complying with applicable laws, regulations, contracts, and grants. This report is intended for the information of the Legislative Audit Commission, the management of Vermilion Community College, and members of the Minnesota State Colleges and Universities Board of Trustees. This restriction is not intended to limit the distribution of this report, which was released as a public document on June 7, 2002.

/s/ James R. Nobles /s/ Claudia J. Gudvangen James R. Nobles Claudia J. Gudvangen, CPA Legislative Auditor Deputy Legislative Auditor

End of Fieldwork: March 22, 2002 Report Signed On: June 4, 2002

Room 140, 658 Cedar Street, St. Paul, Minnesota 55155-1603 ° Tel: 651/ 296-4708 ° Fax: 651/ 296-4712 E-mail:legislative.auditor@state.mn.us ° TDD Relay: 651/ 297-5353 ° Website: www.auditor.leg.state.mn.us

Table of Contents
Report Summary
Chapter 1. Introduction
Chapter 2. Financial Management
Chapter 3. Tuition and Fees
Chapter 4. Payroll Expenditures
Chapter 5. Administrative Expenditures
Chapter 6. Bookstore and Food Service Operations
Status of Prior Audit Issues
Vermilion Community College's Response

Audit Participation The following members of the Office of the Legislative Auditor prepared the report: Claudia Gudvangen, CPA Deputy Legislative Auditor Cecile Ferkul, CPA, CISA Audit Manager Scott Tjomsland, CPA Auditor-In-Charge Gena Hoffman Auditor Theresa Hahn Auditor

Exit Conference We discussed the findings and recommendations with the following representatives of Vermilion Community College and the Office of the Chancellor at an exit conference held on May 8, 2002: Office of the Chancellor: Laura King Vice Chancellor/ Chief Financial Officer Margaret Jenniges Director, Financial Reporting John Asmussen Executive Director, Internal Auditing Kim McLaughlin Regional Audit Coordinator Jim Schneider Director, Campus Accounting Vermilion Community College: Joe Sertich President, Northeast Higher Education District Carla Newman Chief Financial Officer

Report Summary Vermilion Community College, with financial assistance from the Office of the Chancellor, operated within its available resources and generally complied with applicable legal provisions and management's authorization. However, the college had several internal control weaknesses that impacted the safeguarding of assets and the recording of financial activities in the accounting records.

Key Findings and Recommendations: The college and the Office of the Chancellor did not establish appropriate reports and management procedures to allow the college to adequately manage an environment where it shared its automated database and financial management duties with another college. We recommended that the college work with the Office of the Chancellor to create ad hoc reports and design control procedures to assure financial operating integrity. Also, the college should formally document their responsibilities in shared service arrangements with other colleges. (Finding 1, page 7) The college did not timely reconcile its main operating bank account and did not ensure that it had sufficient collateral to safeguard bank balances during peak enrollment periods. We recommended that the college timely complete the bank reconciliation, determine the reason for any differences, and make any adjustments needed to properly record its financial activity. We also recommended that the college ensure that its bank pledges sufficient collateral for the college's bank balance. (Finding 2, page 9) The college did not sufficiently limit access to its computerized business systems. We recommended that the college limit employees' access to the minimal level necessary to complete their job responsibilities. The college should also eliminate computer system access to incompatible functions, or develop effective detective controls, such as periodic, independent reviews of the employees' work. (Finding 3, page 10) The college had poor control of tuition waiver transactions. The college did not adequately separate duties related to waiver transactions and did not establish mitigating controls to effectively monitor the use of waiver transactions. Furthermore, the college inappropriately used waiver transactions to accommodate work-study students who wanted to apply a portion of their paycheck to their outstanding balances. We recommended that the college separate the incompatible duties of collecting tuition and processing waivers, or establish mitigating controls to effectively monitor the use of waivers. We also recommended that employees authorize and document waiver transactions and only use waivers when appropriate. (Finding 4, page 15) The college did not enter the correct occurrence dates on the MnSCU accounting system for various types of expenditures. The occurrence date should be the date the college received the goods or services, which is when the college had a financial liability according to accounting principles. Incorrect occurrence dates may cause data on the MnSCU accounting system to misstate the financial statement amounts for year-end accrued liabilities. (Finding 9, page 21)

Vermilion Community College is part of the Minnesota State Colleges and Universities (MnSCU) system. This financial-related audit report focused on financial management, tuition and fees, payroll, administrative expenditures, and bookstore operations for the period from July 1, 1998, through June 30, 2001. The college's response is included in the report.

Chapter 1. Introduction Vermilion Community College, located in Ely, is one of 34 colleges and universities included in the Minnesota State Colleges and Universities (MnSCU) system. Vermilion Community College is a residential college that offers liberal arts, business, and environmental and natural resources programs. In fiscal year 2001, the college had 675 full year equivalent students enrolled. The college also provides non-credit continuing education and customized training programs. In fiscal year 2001, the college provided continuing education to 3,507 students and customized training to 1,203 students. The college finances its operations from three main sources: state appropriation allocations, tuition and fees, and federal grants.

The college was formerly combined with Mesabi Range Community and Technical College, with campuses in Virginia and Eveleth, in a single institution called the Laurentian Community and Technical College District. In 1999, the combined institution became part of a strategic alignment of MnSCU colleges in northern Minnesota called the Northeast Higher Education District. In fiscal year 2001, Vermilion Community College and Mesabi Range Community and Technical College operated as separate institutions within the Northeast Higher Education District. In addition to Vermilion Community College and Mesabi Range Community and Technical College, the Northeast Higher Education District currently includes Itasca Community College (in Grand Rapids) and Rainy River Community College (in International Falls). The Northeast Higher Education District's mission is to provide quality higher education by developing a regional structure that will preserve college autonomy but will also align programs and services to better prepare residents for learning, employment, citizenship, and life. The MnSCU Board of Trustees appointed Dr. Joseph Sertich as president of the District effective November 1999. As president, Dr. Sertich coordinates the efforts of each college. Each college has its own provost to oversee daily operations. Dr. J. D. Droddy has served as the Vermilion Community College provost since July 2000, but resigned from the position effective June 1, 2002. The Northeast Higher Education District is currently searching for a new provost for the college. The college is affiliated with the Vermilion Community College Foundation, a separate, non-profit organization. The foundation has its own directors, articles of incorporation, and bylaws.

The foundation maintains its own financial records and accounts and obtains an external audit every three years. The college maintains a formal agreement with the foundation to provide space and other administrative support in exchange for student scholarships. During fiscal year 2001, the foundation provided $14,600 in student scholarships.

Chapter 2. Financial Management Chapter Conclusion Vermilion Community College, with financial assistance from the Office of the Chancellor, operated within available resources and generally complied with applicable legal provisions and management's authorization. In addition, the college maintained an appropriate relationship with its foundation. However, the college had the following weaknesses that affected the safeguarding of assets, the recording of financial activities, and compliance with material legal provisions: The college and the Office of the Chancellor did not establish appropriate reports and management procedures to allow the college to adequately manage an environment where it shared its automated database and financial management duties with another college. The college did not timely reconcile its main bank account and did not ensure it had sufficient collateral to safeguard bank balances during peak enrollment periods. The college did not sufficiently limit access to its computerized business systems.

Vermilion Community College used the MnSCU accounting system to record its financial activity and to initiate transactions. MnSCU accounting interfaces with the state's accounting system, the Minnesota Accounting and Procurement System, to generate warrants from the state treasury. Vermilion Community College and the Mesabi Range Community and Technical College shared a single database on MnSCU's Integrated Statewide Records System. This database identified the colleges as the Laurentian Community and Technical College District with a single institution ID, three campus ID's (for the Ely, Eveleth, and Virginia campuses), and a shared ID, which the colleges mainly used for financial aid. In addition, the MnSCU accounting interface with the state's accounting system and the state's payroll/ personnel system identified the colleges as the Laurentian Community and Technical College District on those systems. Sharing an institution ID prevented the college from effectively using many standard Integrated Statewide Records System reports designed to provide financial, personnel, and student information, as further explained in Finding 1. The college also continued some shared services with Mesabi Range Community and Technical College. For example, Vermilion staff monitored bank reconciliations for the account the colleges shared, while Mesabi Range processed payroll for both institutions.

The college also used MnSCU accounting to account for money maintained in local bank accounts for enterprise and special revenue activities, such as the bookstore and student financial aid. During the audit period, the college administered its funds in several local bank accounts, but by the end of fiscal year 2001, the college actively used only two local accounts. Vermilion Community College shared the main checking account with Mesabi Range Community and Technical College. The colleges used that account as the state depository for transfer of funds into the state treasury, for managing the federal and state cash requests of the financial aid programs, and for managing their enterprise activity funds. Vermilion used a second account for activity related to federal Perkins Loan collections.

Audit Objectives and Methodology Our review of Vermilion Community College's financial management focused on the following objectives:

Did the college's internal controls provide reasonable assurance that it had properly recorded financial activities on the MnSCU and the state's accounting systems? Did the college comply with applicable legal provisions regarding local bank accounts? Did the college's internal controls provide reasonable assurance that it operated within available financial resources in compliance with applicable legal provisions and management's authorization? Did the college's internal controls provide reasonable assurance that it had an appropriate operating relationship with related organizations?

To answer these questions, we interviewed college staff to gain an understanding of the college's use of MnSCU accounting for activities in our audit scope. We also gained an understanding of the management controls, including budget monitoring and reconciliations of local bank accounts. We reviewed local bank activity to determine compliance with legal provisions governing collateral. We also reviewed security privileges to determine whether the college had adequately restricted access to computerized business systems. Finally, we reviewed the college's relationship with its foundation.

Budgetary Controls MnSCU receives the majority of its funding for operations from General Fund appropriations. The Office of the Chancellor allocated appropriated funds to the Northeast Higher Education District, and all colleges and universities, based on an allocation formula. The Northeast Higher Education District further allocated the appropriation to its member colleges, including Vermilion Community College. In addition, the college, like other campuses, retains the tuition and other receipts it collects to arrive at its total authorized spending level.

Once Vermilion Community College determines its authorized spending level, it allocates spending budgets to the various administrative areas and academic departments. The college established individual cost centers for each department or office to monitor its budget status. College management also monitored projected versus actual student enrollment to ensure that sufficient tuition will be received to support the spending budget. When Vermilion administrators projected a budget deficit for fiscal year 2001, they took immediate action by securing a $70,000 loan from the Office of the Chancellor to balance its fiscal year 2001 budget. The college must repay the loan by fiscal year 2004. The college also received a $270,000 grant from the Office of the Chancellor to establish a restricted reserve of five percent, as required by MnSCU policy. The Office of the Chancellor also required the college to balance its fiscal year 2002 and 2003 budgets and to begin to add to its reserves in fiscal year 2004. To accomplish that, the college developed a financial stabilization plan. The plan achieved balanced budgets for fiscal years 2002 and 2003 primarily by vacating several positions, reassigning certain staff, and establishing a spending freeze. The balanced fiscal year 2002 and 2003 budgets also provide for full repayment of the funds it borrowed from the Office of the Chancellor.

General Financial Management The college uses the MnSCU Integrated Statewide Record System for its financial and student registration processes. The system contains various financial, student data and registration modules that share common data through various interfaces. The college does not use modules designed to track consumable inventory or for cost allocations.

Conclusion Vermilion Community College, with financial assistance from the Office of the Chancellor, operated within available resources and generally complied with applicable legal provisions and management's authorization. In addition, the college maintained an appropriate relationship with its foundation. However, the college had the following weaknesses that affected the safeguarding of assets, the recording of financial activities, and compliance with material legal provisions. As discussed in Finding 1, the college and the Office of the Chancellor did not establish appropriate reports and management procedures to allow the college to adequately manage an environment where it shared its automated database and financial management duties with another college. As explained in Finding 2, the college did not timely reconcile its main bank account and did not ensure it had sufficient collateral to safeguard bank balances during peak enrollment periods. Finally, as noted in Finding 3, the college did not sufficiently limit access to its computerized business systems.

1. The college and the Office of the Chancellor did not establish appropriate reports and management procedures to allow the college to adequately manage an environment where it shared its automated database and financial management duties with another college.

Vermilion Community College cannot effectively use many of the standard reports available on the Integrated Statewide Records System because the reports combine data for Vermilion with Mesabi Range Community and Technical College. The Office of the Chancellor created over 400 standard Integrated Statewide Records System reports to provide colleges with important financial, personnel and student information. These reports are key to a college's ability to oversee financial management functions. Many of these reports summarize financial data at the institution ID level and, consequently, show combined data for Vermilion and Mesabi Range as the "Laurentian Colleges".

For example, Vermilion can only produce a trial balance report at the institution ID level. This report should be an important report for Vermilion's administrators to assess the integrity of its recorded financial transactions. It was not an effective report for Vermilion because it summarized financial information for the Laurentian Colleges, including Mesabi Range. The report's query options did not allow Vermilion to create the report at a campus ID level. If, for example, they could have reviewed the Vermilion trial balance report for its bookstore operations, the Vermilion business office and bookstore managers may have detected a $370,000 error made by the Office of the Chancellor's staff.

In addition, a standard waiver report designed to allow a supervisor to verify that cashiers have only waived tuition in compliance with MnSCU policy does not distinguish Vermilion waiver transactions from Mesabi Range waiver transactions. In this case, MnSCU's Internal Audit Division helped the college develop an ad hoc waiver report to provide the colleges with meaningful information. The Office of the Chancellor will need to ensure that it updates ad hoc reports whenever it changes the standard Integrated Statewide Record System reports or develops report enhancements. The colleges can only control access to the MnSCU Integrated Statewide Record System at the institution ID level. Therefore, any access granted to staff at one college allows that person the same access at the other college. To lessen the significant risk created by this shared security access, the Vermilion staff works closely with Mesabi Range staff to coordinate and monitor system access rights. The Northeast Higher Education District may need to establish broader oversight to mitigate the system access weaknesses that exist as a result of a shared institution ID. Finally, the colleges continued to share some administrative duties as they did when they were the Laurentian Community and Technical College District. For example, the Vermilion Community College staff continued to be responsible for the reconciliation of the colleges' shared bank account. Mesabi Range Community and Technical College staff continued the reconciliation of MnSCU accounting to the state's accounting system and processed personnel and payroll transactions for both institutions. The colleges have not formalized these responsibilities.

Recommendations Vermilion Community College should work with the Office of the Chancellor to create ad hoc reports and design control procedures to assure financial operating integrity for each college. The colleges should formally document their responsibilities in shared service arrangements with other colleges.

2. The college did not timely reconcile its main bank account and did not ensure it had sufficient collateral to safeguard bank balances during peak enrollment periods. For nine months, from August 2000 through April 2001, the college did not reconcile the cash balance in its main bank account to the MnSCU accounting system's cash balance. The Vermilion employee responsible for the reconciliation when the colleges were in the Laurentian District, and after the subsequent split into the separate colleges, left Vermilion in the fall of 2000. The colleges requested assistance from the Office of the Chancellor, but discovered toward the end of fiscal year 2001 that the Office of the Chancellor's staff had not done the reconciliations. Since then, the colleges worked with the Office of the Chancellor to reconcile the account from that point forward. As of March 2002, the college had reconciled the account from May 2001 through August 2001 and was working with the Office of the Chancellor to get the reconciliations up to date. There was an unreconciled difference of $8,205 from the period of August 2000 through April 2001. Reconciliation of the recorded cash balance to the bank balance is a fundamental control to ensure that the college's accounting records accurately reflect its financial activity. The colleges did not close three of the local bank accounts that they no longer used. As of March 2002, there was a small cash balance remaining in each account. The colleges plan to wait until the bank reconciliations for the main account are current before officially closing the other accounts and moving the cash in them to the main account. Vermilion Community College did not record another local bank account or any activity flowing through the account in MnSCU accounting. The college used the account until the end of fiscal year 2001 as a credit card clearing account for the bookstore. The college periodically deposited bookstore funds into the account to cover timing differences between checks written from the account and receipts from credit card companies and for bank and credit card service charges. Although the college was no longer using the account in March 2002, it had not closed the account, which had a cash balance of about $3,000. In addition, while the college generally maintained sufficient collateral on its main bank account, it did not have sufficient collateral for the account during peak enrollment periods in fiscal year 2002. (The colleges could not provide documentation of the value of pledged collateral before fiscal year 2002.) During September 2001 and January 2002, there were four days each month when the value of the pledged collateral reported by the bank at month end was not sufficient to cover the cash balance in the colleges' main bank account. For those days, the bank's pledged collateral fell short of required amounts by as much as $903,000. Without sufficient collateral, the college's bank balances are subject to loss. Minn. Stat. Section 118A. 03 requires that banks provide collateral for uninsured public funds of at least ten percent more than the amount on deposit. Since the Federal Deposit Insurance Corporation (FDIC) insures a level of $100,000, the bank must provide collateral for any balance more than that amount. Staff could not substantiate their claim that they had arranged for increased collateral during January 2002.

Effective April 1, 2002, the bank agreed to monitor the cash balance in the colleges' account and make necessary collateral adjustments daily. The college should periodically monitor the account and verify that the bank's pledged collateral is sufficient, particularly during peak periods.

Recommendations The college should timely complete the bank reconciliation, determine the reason for any differences, and make any adjustments needed to properly record its financial activity. The college should close any extraneous bank accounts. The college should ensure that its bank pledges sufficient collateral for the college's bank balance.

3. PRIOR FINDING PARTIALLY RESOLVED: The college did not adequately control the access of certain employees to its computerized business systems. Beyond the overriding security weakness that Vermilion staff can access data and record transactions for the Mesabi Range Community and Technical College, and vice-a-versa, as explained in Finding 1, the college did not sufficiently limit access to some of its computerized business systems. While the college has improved its oversight of system access security, some college staff had unnecessary or incompatible access. For example, four employees had incompatible access to cashiering and accounts receivable functions, which gave them the ability to collect and record receipts, adjust accounts receivable records, and process waivers. Ideally, employees that perform cashiering functions should not have the ability to adjust accounts receivable records or process waivers. In addition, two Hibbing Community College employees had unnecessary access to the college's personnel and payroll functions in the State Colleges and Universities Personnel and Payroll System. Two employees of the Northeast Service Unit had the unnecessary ability to update the college's chart of accounts, enter journal and expense vouchers, and enter budgetary transactions. Also, the college did not promptly update the access for a former business office employee following a position change. More than a year after the position change, the college removed the employee's access to accounts payable and accounting functions, but the employee still had unnecessary access to cashiering, accounts receivable, purchasing, and student housing functions. Finally, a college employee had unnecessary access to cashiering, accounts receivable, and student housing functions.

The college should ensure that employee access is necessary based on job responsibilities. By not limiting access to its computerized business systems, inappropriate or unauthorized transactions could occur and go undetected by the college.

Recommendations The college should limit employees' access to the minimal level necessary to complete their job responsibilities. The college should eliminate computer system access to incompatible functions, or develop effective detective controls, such as periodic independent reviews of the employees' work.

Chapter 3. Tuition and Fees Chapter Conclusion Vermilion Community College's internal controls provided reasonable assurance that revenue collections were accurately reported in the accounting records, and that it complied with applicable legal provisions and management's authorization. For the items tested, the college complied with the significant finance-related legal provisions concerning tuition. However, the college needs to improve controls over waiver transactions. In addition, the college did not adequately safeguard tuition and fee receipts.

Vermilion Community College offered undergraduate credit classes, customized training, and continuing education credit and non-credit classes. The college collected approximately $2.1 million in credit and non-credit tuition and fees during fiscal year 2001. The college collected tuition for undergraduate credit classes at Minnesota resident rates of $65.60, $69.00, and $72.10 per semester credit for fiscal years 1999, 2000, and 2001, respectively. Non-resident rates for those fiscal years were $131.15, $138.00, and $144.20 per semester credit, respectively. The college also collected various fees from students, including application fees, student life fees, technology fees, student government fees, and parking fees. Students paid $9.65 in fees per semester credit in fiscal year 1999, and $13.65 in fees per semester credit in fiscal years 2000 and 2001. The college determined tuition rates for customized training and continuing education classes on an individual class basis. Figure 3-1 shows the breakdown of tuition and fee revenue during fiscal years 1999 to 2001.

The college used the Integrated Statewide Record System to accumulate all student charges from various sources. The system interfaced registrations and collections to calculate and maintain individual student accounts receivable balances.

Audit Objectives and Methodology Our review of tuition and fee revenues focused on the following questions: Did the college's internal controls provide reasonable assurance that it adequately safeguarded and accurately recorded revenue collections in the accounting records, and that it complied with applicable legal provisions and management's authorization? For the items tested, did the college comply, in all material respects, with the significant finance-related legal provisions concerning tuition?

To answer these questions, we interviewed college staff to gain an understanding of the controls over billing, collecting, depositing, and recording tuition, fees, and customized training and continuing education revenue. We reviewed student registrations, accounts receivable records, and MnSCU accounting records to determine if the college charged students appropriate tuition and fee rates, collected the amounts due, and properly recorded revenue transactions on MnSCU accounting. We also analyzed the college's procedures for processing sensitive transactions such as waivers and backdated transactions. Finally, we reviewed bank deposit documentation to determine if the college complied with applicable legal provisions regarding prompt deposits.

Figure 3-1 Tuition and Fee Revenue Fiscal Years 1999 to 2001

Customized Training & Continuing Education 16%

Tuition 65% Fees 19% Source: MnSCU accounting system.

Conclusions The college's internal controls provided reasonable assurance that it adequately safeguarded and accurately recorded revenue collections in the accounting records and that it complied with applicable legal provisions and management's authorization. For the items tested, the college complied with the significant finance-related legal provisions concerning tuition. However, as discussed in Finding 4, the college needs to improve controls over waivers. In addition, the college did not adequately safeguard tuition and fee receipts, as noted in Finding 5.

4. The college had poor control of tuition waiver transactions. The college did not adequately separate duties related to waiver transactions and did not establish mitigating controls to effectively monitor the use of waiver transactions. Business office employees that collected and recorded tuition and fee receipts also processed waiver transactions. The college did not establish procedures to authorize and document the transactions. Instead, business office employees processed waivers at their discretion and did not document reasons for waivers. Ideally, employees with access to receipts should not have the ability to waive charges or alter student account balances. Employees that have that ability could misappropriate receipts by collecting tuition and fees and waiving the charges in student accounts. If the college cannot establish a proper separation of duties, it needs to ensure that employees adequately document the reasons for the waivers and provide for appropriate authorization or review of waiver transactions. The college also inappropriately used waiver transactions to accommodate work-study students who wanted to apply a portion of their paycheck to their outstanding balances. Since the business office would not cash checks for students, business office employees reduced students accounts receivable balances to the amount the student wanted to pay. After posting the entire paycheck as a payment, MnSCU accounting would then generate a payment to the students for the amount the paycheck exceeded the reduced accounts receivable. Business office employees then restored the waived charges. This practice resulted in an excessive number of waiver transactions, which increased the risk that errors or irregularities related to waivers could occur without detection and impeded any effective monitoring process.

Recommendations The college should separate the incompatible duties of collecting tuition and processing waivers, or should establish mitigating controls to effectively monitor the use of waivers. Employees should authorize and document waiver transactions. The college should use waivers only when appropriate.

5. The college did not adequately safeguard tuition and fee receipts. The college did not adequately safeguard tuition and fee receipts in the business office. The two business office employees who regularly collected tuition and fee receipts did not adequately secure the receipts prior to deposit. Leaving tuition and fee receipts unsecured significantly increased the risk of theft.

Recommendation The college should keep tuition and fee receipts locked in a safe or other secure location until deposited.

Chapter 4. Payroll Expenditures Chapter Conclusions The college's internal controls provide reasonable assurance that it properly authorized and accurately recorded payroll expenditures in the accounting records. However, the college did not regularly clear cash and revenue balances in the MnSCU accounting payroll clearing account. The college also did not adequately restrict certain employees' access to the MnSCU personnel/ payroll system, as discussed in Chapter 2, Finding 3. For the items tested, the college complied with material finance-related legal provisions and applicable compensation plans.

Vermilion Community College relied on the Mesabi Range Community and Technical College for its personnel and payroll services. Payroll was the largest expenditure category for the college. The college's payroll costs totaled approximately $4.5 million during fiscal year 2001. College employees belonged to the following compensation plans:

American Federation of State, County, and Municipal Employees Middle Management Association Minnesota Association of Professional Employees Excluded Administrators' Plan Commissioner's Plan Minnesota Community College Faculty Association

The college used the state's personnel/ payroll system to process payroll information. The college monitored employee appointment information, personnel files, and pay rates in the State Colleges and Universities Personnel and Payroll System.

Audit Objectives and Methodology Our review of personnel functions and payroll expenditures focused on the following questions: Did the college's internal controls provide reasonable assurance that it accurately recorded payroll expenditures in the accounting records and that it complied with applicable legal provisions and management's authorization? For the items tested, did the college comply, in all material respects, with material finance-related legal provisions concerning payroll?

To answer these questions, we made inquiries of college staff to gain an understanding of the internal control structure over the payroll and personnel process. We analyzed payroll expenditures to determine proper recording of payroll transactions, reviewed source documents to determine proper authorization, and tested salaries to ensure proper payment in compliance with contract provisions. Finally, we reviewed computer system security clearances for staff who had the ability to update payroll and human resources transactions.

Conclusions The college's internal controls provided reasonable assurance that it accurately recorded payroll expenditures in the accounting records and that it complied with applicable legal provisions and management's authorization. However, as discussed in Finding 6, the college did not regularly clear cash and revenue balances in the MnSCU accounting payroll clearing account. The college also did not adequately restrict employee access to its human resource and payroll systems, as explained in Chapter 2, Finding 3. For the items tested, the institution complied, in all material respects, with the significant finance-related legal provisions concerning payroll.

6. The college did not clear cash and revenue balances in the MnSCU accounting payroll clearing account. The college did not routinely enter the transactions necessary to eliminate the cash balance and offset the revenue transactions that result from the payroll clearing process. In July 2001, the college adjusted the payroll clearing account (which it shares with Mesabi Range Community and Technical College) by approximately $1.2 million for cash and revenue overstatements that had accumulated since fiscal years 1997. The college had not made any additional adjustments since then. At the end of January 2002, MnSCU accounting overstated cash and revenue in the MnSCU payroll clearing account by approximately $138,000. The college used the MnSCU payroll clearing account because it pays some employees, such as bookstore staff, with local funds. Since these employees receive their paychecks through the state's personnel/ payroll system using state treasury funds, the college used the MnSCU payroll clearing account to move local funds to the state treasury. By moving cash and recording revenue in the payroll clearing account, the college initiated a sweep from the local bank account to the state treasury. While this achieved the desired result of reimbursing the state treasury for local payroll expenses, it resulted in overstated cash and revenue balances in the MnSCU payroll clearing account. The college needs to reverse this entry on a regular basis.

Recommendation The college should regularly eliminate the cash balance and offset the revenue balance in the MnSCU payroll clearing account

Chapter 5. Administrative Expenditures Chapter Conclusion Vermilion Community College's internal controls provided reasonable assurance that it accurately recorded administrative expenditures in the accounting records. However, the college needs to improve controls over the purchasing and disbursing functions. In addition, the college did not document price quotes for purchased items in compliance with college or MnSCU policy and did not consistently use the correct occurrence date for expenditures. For the items tested, the college complied with significant finance-related legal provisions for administrative expenditures.

Vermilion Community College spent approximately $900,000 during fiscal year 2001 on purchased services, consultant and contract services, and supplies. The college also used approximately $2 million for capital improvements during fiscal years 1999 through 2001. The college's administrative and academic departments solicited price quotes and submitted purchase requisitions to the business office. Business office staff used the MnSCU Purchase Control System to generate purchase orders and encumber the funds. After the college received the goods or services, the business office received and paid the invoices.

Audit Objectives and Methodology Our review of purchased services, consultant and contract services, and supplies expenditures focused on the following questions:

Did the college's internal controls provide reasonable assurance that it adequately safeguarded and accurately reported administrative expenditures in the accounting records, and that it complied with applicable legal provisions and management's authorization?

Did the college comply, in all material respects, with the significant finance-related legal provisions concerning administrative expenditures? To answer these questions, we interviewed college staff to gain an understanding of internal controls over the procurement and disbursement processes. We reviewed a sample of expenditure transactions in each area to determine if they were properly authorized, processed, and recorded. We also reviewed expenditures to determine if the college complied with MnSCU purchasing policies and other material finance-related legal provisions.

Conclusions The college's internal controls provided reasonable assurance that it accurately recorded administrative expenditures in the accounting records. However, the college needs to improve controls over the purchasing and disbursing functions, as discussed in Finding 7. In addition, as explained in Finding 8, the college did not document price quotes for purchased items in compliance with college or MnSCU policy. Also, as explained in Finding 9, the college did not record transactions on MnSCU accounting with appropriate occurrence dates. For the items tested, the college complied with significant finance-related legal provisions for administrative expenditures.

7. The college needs to improve controls over the purchasing and disbursing functions. The college did not adequately separate purchasing and disbursing duties. For the college's nonbookstore purchases, a single employee in the business office generated purchase orders, verified the receipt of purchased items, and disbursed payments to vendors. For bookstore purchases, the bookstore manager purchased and received the items and disbursed payments to vendors. The college had not established mitigating controls to monitor the purchasing and disbursing activity of those employees. Without adequate separation of duties or established mitigating controls, errors or irregularities, such as using college funds to purchase items for personal use, could occur without detection.

Recommendation The college should separate purchasing and disbursing duties, or establish mitigating controls to monitor purchasing and disbursing activity.

8. The college did not comply with MnSCU or college policy requiring price quotes for purchased items. The college did not document price quotes for purchased items as required by MnSCU and college policy. According to college policy, staff making purchase requisitions must solicit price quotes from vendors and attach documentation of those quotes to the requisitions. One price quote is required for items up to $500 and two quotes for items over $500 and under $10,000. MnSCU policy requires the college to keep price quotes on file until audited.

Recommendation The college should document price quotes for purchased items in compliance with college and MnSCU policy.

9. The college did not record transactions on MnSCU accounting with appropriate occurrence dates. The college did not record the proper occurrence dates for expenditure transactions on MnSCU accounting. For the majority of transactions, the college recorded the payment date as the occurrence date. The occurrence date should identify the date that the college received the goods or services. Recording accurate occurrence dates is important because those dates determine the college's liabilities at year-end for financial reporting purposes. Incorrect occurrence dates may result in the misstatement of liabilities. In fiscal year 2002, MnSCU's Internal Audit Division provided assistance to the college to improve occurrence date accuracy.

Recommendation The college should record proper occurrence dates for expenditure transactions.

Chapter 6. Bookstore and Food Service Operations Chapter Conclusion The college's internal controls provided reasonable assurance that it accurately recorded bookstore and food service revenue collections and disbursement transactions in the accounting records and that it complied with applicable legal provisions and management's authorization. However, the college did not reasonably allocate indirect costs to the bookstore and food service operations and did not analyze the reasonableness of inventory usage. In addition, as discussed in Chapter 5, Finding 7, the college did not adequately separate purchasing and disbursing duties for the bookstore operation. Finally, as discussed in Chapter 5, Finding 9, the college did not consistently use the correct occurrence date for bookstore expenses.

For the items tested, the college complied, in all material respects, with the significant finance-related legal provisions concerning bookstore and food service operations.

Vermilion Community College operated both a bookstore and a food service on its campus. The bookstore sold textbooks, school supplies, and clothing. The bookstore recorded sales in a cash register, and customers had the option to pay by cash, check, or credit card. In fiscal year 2001, the bookstore revenues totaled $281,572 and expenses totaled $280,809.

The food service offered three meals a day to students, employees, and visitors from Mondays through Fridays. Most of the food service revenue came from student meal plans. Students had three meal plan options to choose from. The first option provided students with one meal per day, the second option provided two meals per day, and the third option provided three meals each day. For each semester in fiscal year 2001, students paid $355, $725, or $805 for the options, respectively. The food service recorded sales in a computerized cash register system, which also contained student meal plan accounts. Students with meal plans charged meals to their accounts, while customers buying meals could pay by cash or check. The food service had $480,478 in revenue and $480,843 in expenses in fiscal year 2001.

Audit Objectives and Methodology Our review of the bookstore and food service operations focused on the following questions: Did the college's internal controls provide reasonable assurance that it accurately recorded bookstore and food service revenue and disbursement transactions in the accounting records and that it complied with applicable legal provisions and management's authorization? For the items tested, did the college comply, in all material respects, with the significant finance-related legal provisions concerning bookstore and food service operations? To answer these questions, we interviewed college staff to gain an understanding of the bookstore and food service operations. We reviewed controls over bookstore and food service revenues and expenses. We also tested samples of bookstore and food service transactions to determine if the college had accurately recorded the transactions on the MnSCU accounting system. Finally, we reviewed available reports showing the financial results of the bookstore and food service operations.

Conclusions The college's internal controls provided reasonable assurance that it accurately recorded bookstore and food service revenue collections and disbursement transactions in the accounting records and that it complied with applicable legal provisions and management's authorization. However, as discussed in Finding 10, the college did not determine the indirect costs allocable to its bookstore operations and did not analyze the reasonableness of its inventory usage. As discussed in Chapter 5, Finding 7, the college did not adequately separate purchasing and disbursing duties for the bookstore operation. Finally, as discussed in Chapter 5, Finding 9, the college did not consistently use the correct occurrence date for bookstore expenses.

For the items tested, the college complied, in all material respects, with the significant finance-related legal provisions concerning bookstore and food service operations.

10. The college did not determine the indirect costs allocable to its bookstore and food services operations and did not analyze the reasonableness of its inventory usage. The college charged indirect costs to its bookstore and food service operations based on estimated revenues over expenses for each operation, without determining the allocable costs. In fiscal year 2001, the college charged $23,000 in indirect costs to the bookstore and $15,000 to the food service, even though the food service used much more space and was open for twice as many hours as the bookstore. While the college can determine what share of allocable indirect costs it will charge to the bookstore and food service operations, it needs to determine the allocable costs using some reasonable basis. The college did not use its bookstore and food service inventory counts, along with purchases and sales data, to perform an inventory analysis. This analysis would help to determine if inventory items were lost or stolen, or if it collected appropriate amounts of revenue for items sold.

Recommendations The college should determine the amount of indirect costs allocable to the bookstore and food service operations. The college should use its bookstore and food service inventory counts to identify any significant loss or theft and to assess the reasonableness of bookstore revenue.

Status of Prior Audit Issues As of March 22, 2002 Most Recent Audits College Audit Legislative Audit Report 99-39, issued in July 1999, covered the former Laurentian Community and Technical College District for the three fiscal years ending June 30, 1998. The report reviewed material activities and programs including tuition, fees and customized training receipts, employee payroll, administrative expenditures, student financial aid, and bookstore and food service operations. The report contained six findings. Vermilion Community College substantially resolved five of those findings. The college still did not adequately control the access of certain employees to its computerized business systems, which we repeat as Finding 3 in our current audit report.

Statewide Audits Legislative Audit Report 01-15, issued in March 2001, and Legislative Audit Report 00-11, issued in March 2000, examined MnSCU's activities and programs material to the State of

Minnesota's general purpose financial statements or the Single Audit for the years ended June 30, 2000 and 1999, respectively. These reports did not include any findings related specifically to Laurentian Community and Technical College or Vermilion Community College.

Other Audit Coverage The MnSCU Office of the Chancellor contracted with Deloitte and Touche, LLP, an independent CPA firm, to audit the MnSCU's general purpose financial statements and to report on its internal controls and compliance for its major federal programs. MnSCU received an unqualified opinion for fiscal year 2001. As a part of the audit, the firm issued a management letter to MnSCU's Board of Trustees. The letter contained 13 comments on accounting, administrative, and operating matters. While the comments did not specifically mention Vermilion Community College, several of the matters, including bank reconciliations, collateralization of bank accounts, and segregation of duties, are concerns at Vermilion and are included in our report as Findings 2 and 3. State of Minnesota Audit Follow-Up Process The Department of Finance, on behalf of the Governor, maintains a quarterly process for following up on issues cited in financial audit reports issued by the Legislative Auditor. However, Finance has delegated this responsibility for audits of the Minnesota State Colleges and Universities (MnSCU) to the MnSCU Office of Internal Auditing. MnSCU's Office of Internal Auditing process consists of quarterly activity reports documenting the status of audit findings. The follow-up process continues until the Office of Internal Auditing is satisfied that the issues have been resolved. The process covers all colleges and universities within the MnSCU system.

May 24, 2002
James R. Noble, Legislative Auditor Office of the Legislative Auditor Room 140 Centennial Building 658 Cedar Street St. Paul, MN 55155-1603

Dear Mr. Nobles, Thank you for the opportunity to respond to the audit report of Vermilion Community College for the period of July 1, 1998 through June 30, 2001. The college staff has reviewed the audit findings and recommendations and we respond in the order that the findings are listed in your report. Chapter 2 Financial Management 1. The college and the Office of the Chancellor did not establish appropriate reports and management procedures to allow the college to adequately manage an environment where it shared its automated database and financial management duties with another college. Responsible Person: Carla Newman, CFFO-VCC and Tony Bartovich, CFO-MRCTC Completed By: unknown

The college chief financial officers will work with the Office of the Chancellor to create ad hoc reports and design control procedures to assure financial operating integrity for both colleges. The colleges will formally document their responsibilities in shared service arrangements; this will be completed by June 30, 2002.

2. The college did not timely reconcile its main bank account and did not ensure it had sufficient collateral to safeguard bank balances during peak enrollment periods. Responsible Person: Carla Newman, CFFO-VCC Completion Date: June 30, 2002 -The reconciliation process was complete up to July 2001 at which time there became a vacancy in the CFO position. The campus is working with MnSCU system office personnel to bring the bank reconciliation up to date. Currently, we have a consistent offsetting balance between May 2001 and March 2002. Further training will occur and full responsibility will be transferred to the campus by the end of June 2002.

-The college will close all remaining bank accounts and transfer balances to the main accounts at the completion of the bank reconciliation June 2002. -The college will sign an agreement with the bank to ensure the colateralization of bank balance.

3. PRIOR FINDING PARTIALLY RESOLVED: The college did not adequately control the access of certain employees to its computerized business systems. Responsible Person: Carla Newman, CFFO-VCC Completion Date: June 30, 2002 -By the end of June 2002, we will review and make appropriate adjustments to the ISRS security access of all college employees. Periodic review of all security access will occur by responsible parties. -The college has taken advantage of the retirement of a business office employee and modified the PD's within the business office to eliminate incompatible tasks. Security clearances will be limited to minimal levels to complete the new job duties.

4. The college had poor control of tuition waiver transactions. Responsible Person: Carla Newman, CFFO-VCC Completion Date: June 30, 2002

-Security Clearance to the waiver screen will be limited to supervising staff. -The college will create a waiver request form that must be completed by the student and authorized by appropriate college administrator. Documentation of all waivers will be retained on file in the business office.

5. The college did not adequately safeguard tuition and fee receipts. Responsible Person: Carla Newman, CFFO-VCC Completion Date: June 3, 2002

-The college accounts receivable clerk will be relocated to the current records office. This area is securable by a locking roll down window and locked entrance door and we will make use of a lockable cash drawer. Access to this space will be limited to authorized personnel and this space will also contain our safe.

6. The college did not clear cash and revenue balances in the MnSCU accounting payroll clearing account. Responsible Person: Carla Newman, CFFO-VCC Completion Date: May 1, 2002 -College staff has been informed of process and the clearing account cash will be eliminated properly and timely.

7. The college needs to improve controls over the purchasing and disbursing functions. Responsible Person: Carla Newman, CFFO-VCC Completion Date: June 3, 2002

-The college has taken advantage of the retirement of a business office employee and modified the PD's within the business office to eliminate incompatible tasks. The college did not comply with MnSCU or college policy requiring price quotes for purchased items. Responsible Person: Carla Newman, CFFO-VCC Completion Date: June 3, 2002

-Purchasing guidelines will be reviewed for compliance with MnSCU policy. -The college is hiring a new purchasing clerk and will provide adequate training on State and MnSCU purchasing guidelines. With the assistance of the new purchasing clerk, college staff and faculty will be informed of the importance of following our purchasing guidelines and that there will not be any tolerance of not complying with policy. 9. The college did not record transactions on MnSCU accounting with appropriate occurrence dates. Responsible Person: Carla Newman, CFFO-VCC Completion Date: June 3, 2002

-Adequate training will occur with employee assuming these tasks to ensure occurrence dates are properly recorded. The college will implement the use of a date stamp to be put on all invoices that will require the date goods were received and signature of receiving person authorizing the invoice to be paid. 10. The college did not determine the indirect costs allocable to its bookstore and food services operations and did not analyze the reasonableness of its inventory usage.

Responsible Person: Carla Newman, CFFO-VCC Completion Date: June 30, 2002 -The college will devise a method, using system office guidelines, for allocating direct and indirect costs to auxiliary operations. -The college will periodically inventory bookstore and food service merchandise in an attempt to identify any significant theft or loss and record the information properly in ISRS.

We wish to thank the Legislative Auditing staff for their review and recommendations. If you have any follow-up questions or concerns, please contact Carla Newman at 218-365-7211.

Sincerely, /s/ Joe Sertich, Jr. Dr. Joe Sertich, President Vermilion Community College