RALEIGH – The North Carolina Community College System does not have supporting documentation “to ensure appropriate internal controls” are in place regarding the system’s College Data Accounting System Application, according to an audit released Wednesday by State Auditor Les Merritt.
A similar finding was found in last year’s audit. There were no financial statements in the audit.
According to the audit, community college system personnel told auditors that modifications and implementation of the documentation were performed by different personnel within the system. However, the audit states that no evidence could be found to back up the claim.
“Without adequate supporting documentation of program modifications and implementation procedures, there is an increased risk that programmers could make unauthorized transactions and modifications at any time during the year that could alter the program from its original intent,” the audit states.
The state auditor’s office recommended to the community college system that control procedures should be in place to ensure that programmers do not place programs into production.
According to the system’s response, a copy of the data for a proposed change is moved from a live account to a development and test account. The programmer is to make all changes in that account.
Once the changes are complete, the Associate Director of the College Business Informational System Team moves the changed data to the test account. It is then reviewed by the system accountant. If the change is approved, the data is moved into the live account by the associate director, according to the audit.
The audit also said the community college system “should strengthen internal controls by ensuring adequate supporting documentation.”
According to the system’s response in the audit, when the system’s Division of Business and Finance makes a system change it is to do so in writing. That written file, according to the audit, would be maintained with the Department of Business and Finance.
From there, the change is assigned to a programmer by the associate director of the College Business Informational System Team. The change request then receives a peer review before production. A form is used by the peer to validate the change. The team must then maintain a documentation file as well.
Once that has occurred, it is then “tested” and the Division of Business and Finance must sign off on the test before it is put into production and validated.
“We believe this process will remedy any internal control deficiencies with respect to modifications and implementation of program changes in the [College Reporting System],” the system said in its response.
Shannon Blosser ([email protected]) is a staff writer with the John W. Pope Center for Higher Education Policy in Chapel Hill.