s 378.106 L72BSIS 1996 Legislative Audit Division State of Montana Report to the Legislature EDP Audit Report June 1996 &WTE Documents collection MONTANA STATE LIBRARY uHrE.LEpN1?A.,15MEO-N6TtAhNAAVE5.9620 Banner Student Information Systems The University of Montana - Missoula This report provides information regarding application controls related to The University's Banner Student Information Systems. It contains recommendations for improving controls within the University's electronic data processing environment and its student grading procedures. These recommendations address: Improving procedures over Student Accounts Receivable collections. Communicating formal grade procedures to campus instructors and data entry employees. Improving physical security over grade sheets and change forms. Improving electronic access controls. .,*>-< Direct comments/inquiries to: Legislative Audit Division Room 135, State Capitol PO Box 201705 MT Helena 59620-1705 95DP-06 MONTANASTATELIBRARY 3 0864 0010 3901 8 EDP AUDITS ElectronicDataProcessing (EDP)audits conductedbytheLegislativeAuditDivisionaredesigned to assess controls in an EDP environment. EDP controls provide assurance over the accuracy, reliability, and integrity ofthe information processed. From the audit work, a determination is made as to whether controls exist and are operating as designed. In performing the audit work, the audit staffuses audit standards set forth by the United States General Accounting Office. Members of the EDP audit staff hold degrees in disciplines appropriate to the audit process. Areas ofexpertise include business and public administration. EDP audits areperformed as stand-aloneaudits ofEDP controls or in conjunction with financial- compliance and/or performance audits conducted by the office. These audits are done under the oversight of the Legislative Audit Committee which is a bicameral and bipartisan standing committee oftheMontanaLegislature. Thecommittee consists ofsix members ofthe Senate and six members ofthe House of Representatives. MEMBERS OF THE LEGISLATIVE AUDIT COMMITTEE Senator Greg Jergeson, Vice Chairman RepresentativeErnestBergsagel,Chairman Senator Sue Bartlett Representative Beverly Barnhart Senator Reiny Jabs Representative A. R. "Toni" Hagener Senator Tom Keating Representative Bob Keenan Senator Ken Miller Representative Robert Pavlovich Senator Linda Nelson Representative Bruce Simon Montana Legislative Legislative Audit Division otanCn ScottA. Seacat, Legislative Auditor June 1996 The Legislative Audit Committee ofthe Montana State Legislature: This is our EDP audit report of The University of Montana - Missoula's internal controls relating to its computer-based Banner Student Information Systems. We reviewed application controls over the Banner application. This report contains recommendations for improving EDP controls at the University. Our recommendations include improving electronic access security and student grade recording procedures. Written responses to our audit recommendations are included in the back ofthe audit report. We thank The University of Montana - Missoula personnel for their cooperation and assistance throughout the audit. Respectfully submitted, Scott A. Seacat Legislative Auditor Room 136, State CapitolBuilding POBox201706 HelenaMT69620-1706 Phone406-444-3122 FAX406-444-9784 Legislative Audit Division EDP Audit Report Banner Student Information Systems The University of Montana - Missoula Members of the audit staff involved in this audit were Dawn Brewer, Alan Lloyd, and Rich McRae. Table of Contents Administrative and Appointed Officials Report Summary S- Chapter I - Introduction Introduction and Background EDP General Controls Conclusion: General Controls Provide Controlled Application Processing for Banner EDP Application Controls BANNER Conclusion: Application Controls Provide for Reliable Processing 2 Audit Objectives 2 Audit Scope and Methodology 2 Compliance 3 Background 3 Chapter II - Banner Introduction 4 Application Controls Student Admissions 7 Student Registration 7 Student Accounts Receivable 8 Segregation of Cashier Duties 8 Grade Entry Procedures 10 Student Financial Aid 11 Chapter in - Electronic Introduction 13 Access Controls Employee Access Based on Job Duties 14 Generic Logon IDs 15 Electronic Access Authorization Procedures 16 Agency Response The University of Montana - Missoula 21 Page i Appointed and Administrative Officials Board of Regents of Term Higher Education Expires Marc Racicot, Governor* Nancy Keenan, Superintendent of Public Instruction* Jim Kaze, Chairman Havre 1999 Margie Thompson Butte 2003 Kermit R. Schwanke Missoula 1997 Paul Boylan Bozeman 1998 Patrick P. Davison Billings 2000 L. Colleen Conroy Hardin 2001 Mike Green, Student Regent Belgrade 1997 *Ex officio members Commissioner of Higher Jeffrey D. Baker Commissioner of Higher Education Education Richard Crofts Deputy Commissioner for Academic Affairs Rod Sundsted Associate Commissioner for Fiscal Affairs Laurie O. Neils Director of Budget and Accounting The University of George M. Dennison President Montana - Missoula James E. Todd Vice President for Administration and Finance John Cleaveland Executive Director, Office of Information Technology Page ii Report Summary Introduction This report discusses our review of application controls over Banner Student Admissions, Registration, Academic History, Financial Aid and Accounts Receivable modules. A discussion of application controls and the objectives and scope of this audit is included in Chapter I. Further detail for the audit issues summarized below is included in Chapters II and III ofthe report. Overall, wefound Bannerapplication controlsprovidefor reliable processingresults. Student Admissions The Banner Student Admissions module establishes admission records and identifies items an applicant should provide to complete the application for admission. This module verifies students are admitted in accordance with University criteria. Our objective was to ensure students are admitted according to Board of We Regents policy prior to registering for courses. reviewed data entry controls over student information entered into the Admissions module. We concluded input controls were adequate to ensure accuracy and completeness ofstudent admissions data entry. Student Registration The University uses Dial Bear, an interactive voice response software, for student registration. Following authorization to register, students telephone Dial Bear and respond to a voice recording to enter registration selections. Dial Bear accepts only valid course codes, and prevents registration based on course prerequisite and/or vacancy. Once students confirm their selections, Dial Bear automatically posts the selections to the Registration module. Registration data is later used by the Accounts Receivable module to assess student registration fees. We verified Dial Bear properly converts student data entry into Banner machine-readable form and posts registration additions or deletions to the Student Registration module. We concluded input andprocessing controls over Student Registration were adequate to ensure data entry andprocessingis accurate and complete. PageS-1 Report Summary Student Accounts The Accounts Receivable module tracks all assessed fees to the Receivable student account in addition to waivers and credits associated with registration. The Accounts Receivable module displays term specific tuition, housing, meal plan, and fee charges and applies student fees to the student account according to University policy. Thefee assessmentprogram accurately and completelyprocessed studentfeesper credit based on the approvedBoard ofRegents fee schedule. We also reviewed procedures for collecting student fees as processed in the Accounts Receivable module. The following section discusses how the University could improve procedures which ensure University collections are complete and accurate. Segregation of Cashier Cashiers adjust Banner student fees by entering registration fee Duties waivers to the student account. Fee waivers include late registration fees, student health insurance, or parking decal fees. Data entry personnel may also adjust student fees, record student payments into Banner, and print new student receipts. Banner electronic access allows cashiers or data entry employees to adjust fees and record student payments without authorization from campus departments. Management procedures should ensure individual employees are not in a position to conceal transaction errors or irregularities. Existing procedures allow employees to apply fee waivers after receiving a student payment. Employees could pocket the difference and record a "refund" adjustment to the student account. Academic History Employees establish University grading policies and maintain student grade reports within the Academic History module. This module calculates academic standing based on University defined rules regarding probation and dean's list policies. The module also computes and maintains semester and cumulative GPA information. We limited our review to grade data entry and GPA processing Page S-2