Audit Highlights Deficiencies at CCSU

by Viktoria Sundqvist

HARTFORD, CT — Central Connecticut State University didn’t complete a biweekly payroll review in a timely manner, kept contracts outside of the university’s accounting system and failed to immediately disable system privileges for four staff members who no longer worked there, according to a recent audit.

The audit, conducted for fiscal years 2022 and 2023, found eight deficiencies in total at the New Britain-based state university, with one of them being a repeat finding. 

The delay in disabling employee access can expose the university’s information system to unnecessary or inappropriate access and may increase the risk of data system errors and fraud, auditors noted, recommending strengthened internal controls. 

In its response, university officials said they agreed with the finding, but that most of the delays noted in the audit were minimal and “often attributable to weekends or emeritus policy.”

The separation date and action date input in the systems didn’t always match between IT and HR, sometimes causing what appeared to be a delay in closing a former employee’s account, the officials said. 

Auditors also said that when they requested evidence of the university’s compensating control procedures for employees with conflicting roles – such as staff having access to both payroll and human resource systems – the university did not complete the biweekly payroll review until 61 to 153 days after the pay periods had ended. This can increase the risk for fraudulent transactions, auditors noted. 

“The labor-intensive nature of the biweekly review, staff shortages, and significant turnover affected the university’s ability to promptly complete the reviews after each pay period,” auditors noted in their report.

The university agreed, saying it had already begun the process of revising the procedure to be more efficient and reflective of only the employees with the conflicting roles. It has also reduced

the number of HR and payroll employees with conflicting roles, it said. 

In regards to contracts, auditors found that the university uses a spreadsheet to record and manage contracts for goods and services outside of the current accounting system, then adding notes to items in the actual system, which they noted is not good business practice.

“The university also lacks a formal policy governing the use of contract extensions,” auditors said. This can lead to inconsistent and improperly applied extensions that are not in the state’s best interest, they said. 

University officials noted in their response that the current system does not allow for creating, managing or storing contracts. Auditors recommended that the Board of Regents for Higher Education, which oversees CCSU and other state colleges and universities, develop and

implement an integrated system for this purpose, as well as establish a written contract extension policy. 

The Board of Regents said it would add clarifying details to its current manual and explore how to best integrate contracts into the current accounting system.