Summary

Our operational audit for the fiscal year ended June 30, 2007, disclosed the following:

Record Systems and Reports

Finding No. 1:     The University had not developed, at the department levels, written guidelines documenting procedures to be followed for periodically analyzing and reporting, in a consistent manner, budget positions and operating expenditure projections. 

Finding No. 2:     The University needed to enhance its procedures regarding the annual reporting of information for institutes and centers to the Board of Governors.

Revenues – Institute of Food and Agricultural Sciences

Finding No. 3:     The University needed to improve its collection efforts regarding contracts and grants receivables.

Revenues – Division of Continuing Education

Finding No. 4:     The University had not developed a comprehensive procedures manual documenting procedures for processing collections.

Finding No. 5:     The University had not documented, for fees charged in connection with its Masters of Business Administration programs, that the fees for individual programs were sufficient to cover actual costs to administer the program, that students were not charged more than necessary, and that the fees were not subsidizing the costs of another program.

Finding No. 6:     The University had not provided for an adequate separation of duties regarding sponsor payments received in connection with its Vascular Biology Working Group.

Revenues – International Center Fee

Finding No. 7:     The University had not documented its legal authority to assess a fee for students who were studying abroad in certain programs while enrolled at the University.

Payroll

Finding No. 8:     Our test of five departments disclosed one department for which improvements pertaining to supervisory approval of payroll were needed.

Finding No. 9:     The University needed to enhance its procedures for documenting and monitoring alternate work location arrangements.

Procurement of Goods and Services

Finding No. 10: The University’s competitive procurement threshold exceeded the limit established by the Board of Governors Regulations.

Finding No. 11: The University’s written agreements with a consultant used to develop software and related documentation were not timely executed or did not clearly define the basis for compensation.  Also, payments to the consultant were not supported by adequate documentation.

Finding No. 12: Employees were reimbursed for travel expenses for mileage at rates that exceeded the rate authorized by Section 112.061, Florida Statutes.

Construction Management

Finding No. 13: The University did not, of record, evaluate the reasonableness or propriety of the labor burden rates the construction management entity (CME) applied to construction contracts.

Finding No. 14: The University needed to improve its procedures for monitoring CME pay requests to ensure that it pays only for actual and appropriate CME project related costs.

Risk Management

Finding No. 15: The University needed to improve its procedures for determining insurable values for buildings and other structures and improvements, and the University’s written policies and procedures did not address the level of insurance coverage to be maintained or the method to be used to determine insurable values.

P.K. Yonge Developmental Research School

Finding No. 16: The P.K. Yonge Developmental Research School had not established written policies and procedures for obtaining fingerprints and background screening of School employees after initial employment and of contractors.  Also, the School had not timely provided for background screenings of employees.

Information Technology

Finding No. 17: The University had not adopted written standards for authorized transmission of the myUFL systems data over emerging technologies.

Finding No. 18: User roles were not always timely removed for Finance and Accounting employees who terminated employment.

Finding No. 19: The University’s disaster recovery plan did not document priorities for all administrative units and the University had not entered into a written agreement with an alternate site facility.  Also, the University had not tested the disaster recovery plan.

Finding No. 20: Evidence of background checks and signed confidentiality agreements were not available for some Bridges employees.

Finding No. 21: The University needed to improve controls, and establish written polices and procedures, relating to the application environment and support function. Specific details of the needed improvements are not disclosed in this report to avoid the possibility of compromising University data and information technology resources.

The University's response is included as Appendix B of this report.