UT Health San Antonio

Internal Audit & Consulting Services

Date: August 29, 2018

Internal Audit & Consulting Services 7703 Floyd Curl Dr. MC#7974 San Antonio, Texas 78229-3900 210-567-2370 Fax: 210-567-2373 www.uthscsa.edu

To: Gerard Long, Assistant Vice President for Business Affairs

From: John Lazarine, Chief Audit Executive Internal Audit & Consulting

Subject: Review of Bursar's Office Segregation of Duties and User Access

As part of our FY 2018 Audit Plan, we recently completed a Review of Bursar's Office Segregation of Duties and User Access. Attached is the report detailing the results ofthis review.

We appreciate the cooperation and assistance we received throughout the review.

Respectfully,

. e, IA, CISA, CRISC i cutive

Clit & Consulting Services

Distribution:

cc: Dr. William Henrich, President Michael Black, Sr. EVP & COO Andrea Marks, VP & CFO Y eman Collier, VP & CIO Kathy Jam es, Interim Chief Compliance Officer Jack Park, Chief Legal Officer

External Audit Committee Members: Pat Frost Regina Conklin Ed Garza Brian Kelly

UT Health San Antonio

Internal Audit & Consulting Services

Audit Report Review of Bursar's Office

Segregat ion of Duties and User Access (Project #18-04)

Internal Audit Staff:

August 29, 2018

John Lazarine, CIA, CISA, CRISC Chief Audit Executive

Robert Morgan, IT Audit Director, CISA, C/SSP, GSNA, OCP

Review of Bursar's Office Segregation of Duties

Audit Results

As part of our approved annual Audit Plan, we conducted an audit of the Bursar's Office staff access and segregation of duties within both the PeopleSoft Student Administration and Information - Campus Solutions (Student) and PeopleSoft Financial Supply Chain Management (Finance) systems. The audit objectives, conclusions, and background information follow.

Audit Objectives

The primary objectives of this audit were to review the access roles assigned to Bursar's Office staff and to evaluate whether an appropriate level of segregation of duties is in place and enforced.

Conclusion and Management Actions

Based on our review, we concluded that the roles and permission lists assigned to Bursar's Office staff are adequate to support the enforcement of appropriate segregation of duties within both the PeopleSoft Student and PeopleSoft Finance systems.

In June 2016, the Texas Higher Education Coordinating Board (THECB) conducted a compliance audit on formula funding data of UT Health San Antonio. Following the issuance, the Director of Internal Audit and Compliance for the Texas Higher Education Coordinating Board noted in his closing Management Letter to President Henrich that his team observed employees at lower levels within the Bursar's Office having "Super'' admin level profiles within PeopleSoft Student.

During the audit, we confirmed that this privileged access had been removed from the lower level employees, and that the current "Super" administrative PeopleSoft role assignments within the Bursar's Office staff are appropriate and limited to a small number of senior managers and functional leads. In addition, this access is reviewed annually by the Director of Student Financials and Treasury Services to ensure that they are still appropriate. IMS Business Support Services Application Security staff currently facilitate the completion of annual PeopleSoft role access reviews by role owners that include the PeopleSoft Student and PeopleSoft Finance roles assigned to Bursar's Office staff.

There are no issues within this report requiring management action.

Acknowledgement

We appreciate the courtesy and cooperation we received from the Office of the VP for Business Affairs & Chief Financial Officer and the Office of Student Financials and Treasury Services.

Review of Bursar's Office Segregation of Duties

Background

The UT Health San Antonio Office of the Bursar is organized under Business Affairs Operations within the Office of the VP for Business Affairs & Chief Financial Officer, and is managed by the Director of Student Financials and Treasury Services.

The mission of the Office of the Bursar is to manage: • Student accounting includes collection of student tuition and fees; student tuition

and fee installments program, management, billing and collection of student long and short-term accounts receivable.

• Cashier functions include serving as the depository for institutional funds and administering the institution's petty cash fund.

• Cash management functions include maintenance of adequate liquidity to fund short-term cash needs and management and coordination of Health Science Center banking services.

• Investment functions include managing investable cash assets to optimize return and liquidity in compliance with pertinent federal, state and University of Texas System investment policies.

The Office of the Bursar utilizes both PeopleSoft Financial Supply Chain Management (FCSM) and PeopleSoft Student Administration and Information - Campus Solutions (Student) to support this mission.

The Texas Higher Education Coordinating Board (THECB) conducted a compliance audit on formula funding data of UT Health San Antonio and issued its report June 8, 2016. Following the issuance, the Director of Internal Audit and Compliance - Texas Higher Education Coordinating Board noted in his closing Management Letter to UT Health San Antonio President Henrich that his team observed employees of various levels within the Bursar's Office having "super'' admin level profiles within PeopleSoft Student. The Director further noted that he had discussed this with university representatives on May 25, 2016.

UT Health San Antonio's Assistant Vice President for Business Affairs, in email correspondence to Internal Audit and the CFO on June 21, 2016, stated that Business Affairs had taken action on the THECB auditor's recommendation. Business Affairs removed the Super Administrator role in PeopleSoft Student from the security profiles of three employees within the Bursar's Office.

Following the THECB's report, the CFO agreed with Internal Audit that a follow-up review of segregation of duties within the Bursar's Office would be completed.

Page2

Review of Bursar's Office Segregation of Duties

Audit Scope and Methodology

Our review included, but was not limited to, discussions with UT Health San Antonio Office of the VP for Business Affairs & Chief Financial Officer staff, as well as personnel within the Office of Student Financials and Treasury Services

Additionally, we examined the roles and permission lists assigned to Bursar's Office staff within both PeopleSoft FCSM and PeopleSoft Student, as well as the PeopleSoft role access reviews performed by the role owners and facilitated by IMS Business Support Services Application Security staff.

We conducted this audit in accordance with the standards set forth by the Institute of Internal Auditors' International Professional Practices Framework. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

This audit was conducted by Robert Morgan, IT Audit Director, CISA, CISSP, GSNA, OCP of the UT Health San Antonio Internal Audit Department.

Review of Bursar's Office Segregation of Duties

Appendix A - Audit Issue Ranking Definitions

Audit issues are ranked according to the following University of Texas System Administration issue ranking guidelines:

• Priority - A Priority Finding is defined as an issue identified by internal audit that, if not addressed immediately, has a high probability to directly impact achievement of a strategic or important operational objective of the Health Science Center or the UT System as a whole.

• High - A finding identified by internal audit that is considered to have a medium to high probability of adverse effects to the Health Science Center either as a whole or to a significant college/school/unit level.

• Medium - A finding identified by internal audit that is considered to have a low to medium probability of adverse effects to the Health Science Center either as a whole or to a college/ school/unit level.

• Low - A finding identified by internal audit that is considered to have minimal probability of adverse effects to the Health Science Center either as a whole or to a college/ school/unit level.

Page4