FISMA CALIFORNIA STATE UNIVERSITY, NORTHRIDGE. Report Number June 20, 2002

Transcription

1 FISMA CALIFORNIA STATE UNIVERSITY, NORTHRIDGE Report Number June 20, 2002 Shailesh J. Mehta, Chair Kyriakos Tsakopoulos, Vice Chair William Hauck Dee Dee Myers Erene S. Thomas Anthony M. Vitti Members, Committee on Audit University Auditor: Larry Mandel Senior Director: Janice Mirza IS Audit Manager: Greg Dove Senior Auditor: Laurinda Erickson Staff BOARD OF TRUSTEES THE CALIFORNIA STATE UNIVERSITY

2 CONTENTS INTRODUCTION Purpose... 1 Scope and Methodology... 1 Background... 2 Opinion... 3 Executive Summary... 4 OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES Cash Receipts... 6 Purchasing... 7 Procurement Cards... 7 Delegation of Authority... 8 Revolving Fund... 9 Cash Disbursements... 9 Payroll and Personnel Fiscal Information Technology Reconciliations ii

3 CONTENTS APPENDICES APPENDIX A: APPENDIX B: APPENDIX C: APPENDIX D: Personnel Contacted Statement of Internal Controls Campus Response Chancellor s Acceptance ABBREVIATIONS CMS CSU FISMA SAM Common Management System California State University Financial Integrity and State Manager s Accountability Act State Administrative Manual iii

4 INTRODUCTION PURPOSE The principal audit objective was to assess the adequacy of controls and systems to ensure that: Cash receipts are processed in accordance with laws, regulations and management policies. Receivables are promptly recognized and balances are periodically evaluated. Purchases are made in accordance with laws, regulations, and management policies. Revolving fund disbursements are authorized and processed in accordance with laws, regulations, and management policies. Cash disbursements are properly authorized and made in accordance with established procedures and adequate segregation of duties exists. Payroll/personnel criteria for hiring employees, establishing compensation rates, and authorizing disbursements are controlled and access to personnel and payroll records and processing areas are restricted. Purchase and disposition of fixed assets are controlled and assets are promptly recorded in the subsidiary records. Physical computer controls are in place and functioning. Investments are adequately controlled and securities are safeguarded. Trust funds are established in accordance with State University Administrative Manual guidelines. SCOPE AND METHODOLOGY The management review emphasized, but was not limited to, compliance with state and federal laws, Board of Trustee policies, and Office of the Chancellor policies, letters, and directives. For those audit tests that required annualized data, fiscal year was the primary period reviewed. In certain instances, we were concerned with representations of the most current data in such cases, the test period was July 2001 to March Our primary focus was on internal controls. Specifically, we reviewed and tested: Procedures for receipting and storing cash, segregation of duties involving cash receipting, and recording of cash receipts. Establishment of receivables and adequate segregation of duties regarding billing and payment of receivables. Page 1

5 INTRODUCTION Approval of purchases, receiving procedures, and reconciliation of expenditures to State Controller's balances. Limitations on the size and types of revolving fund disbursements. Use of petty cash funds, periodic cash counts, and reconciliation of bank accounts. Authorization of personnel/payroll transactions and accumulation of leave credits in compliance with state policies. Posting of the property ledger, monthly reconciliation of the property to the general ledger, and physical inventories. Access restrictions to automated accounting systems and proper documentation of the systems. Procedures for initiating, evaluating, and accounting for investments. Establishment of trust funds, separate accounting, adequate agreements, and annual budgets. We have not performed any auditing procedures beyond the date of our report. Accordingly, our comments are based on our knowledge as of that date. Since the purpose of our comments is to suggest areas for improvement, comments on favorable matters are not addressed. BACKGROUND In 1983, the California Legislature passed the Financial Integrity and State Manager's Accountability Act of 1983 (FISMA). This act required state agencies to establish and maintain a system of internal accounting and administrative control. To ensure that the requirements are fully complied with, the head of each agency is required to prepare and submit a report on the adequacy of the system of internal accounting and administrative control following the end of each odd-numbered fiscal year. The Office of the University Auditor of the California State University (CSU) is currently responsible for conducting such audits within the CSU. This report represents our biennial review. Page 2

6 INTRODUCTION OPINION We visited the California State University, Northridge (CSU Northridge) campus from March 12, 2002, through April 26, 2002, and made a study and evaluation of the accounting and administrative control in effect as of April 26, Our study and evaluation were conducted in accordance with the Standards for the Professional Practice of Internal Auditing, issued by the Institute of Internal Auditors, and included the audit tests we considered necessary in determining that accounting and administrative controls are in place and operative. CSU Northridge s management is responsible for establishing and maintaining adequate internal control. This responsibility, in accordance with Government Code, Sections et seq., includes documenting internal control, communicating requirements to employees, and assuring that internal control is functioning as prescribed. In fulfilling this responsibility, estimates and judgments by management are required to assess the expected benefits and related costs of control procedures. The objectives of accounting and administrative control are to provide management with reasonable, but not absolute, assurance that: Assets are safeguarded against loss from unauthorized use or disposition. Transactions are executed in accordance with management s authorization and recorded properly to permit the preparation of reliable financial statements. Financial operations are conducted in accordance with policies and procedures established in the State Administrative Manual, Education Code, Title 5, and Trustee policy. Our study and evaluation did not reveal any significant internal control problems or weaknesses that would be considered pervasive in their effects on the accounting and administrative controls. However, we did identify other reportable weaknesses that are described in the executive summary. In our opinion, the accounting and administrative control at CSU Northridge in effect as of April 26, 2002, taken as a whole, was sufficient to meet the objectives stated above. As a result of changing conditions and the degree of compliance with procedures, the effectiveness of controls change over time. Specific limitations that may hinder the effectiveness of an otherwise adequate system of controls include, but are not limited to: resource constraints, faulty judgments, unintentional errors, circumvention by collusion, and management overrides. Establishing controls that would prevent all these limitations would not be cost-effective; moreover, an audit may not always detect these limitations. Page 3

7 INTRODUCTION EXECUTIVE SUMMARY The purpose of this section is to provide management with an overview of conditions requiring their attention. Areas of review not mentioned in this section were found to be satisfactory. Numbers in brackets [ ] refer to page numbers in the report. CASH RECEIPTS [6] The athletics department did not adequately control, receipt, and secure cash receipts from certain club sporting events. Adequate controls over cash receipts reduce exposure to misappropriation of funds. PURCHASING [7] PROCUREMENT CARDS [7] Individuals other than the cardholder made procurement card purchases. The risk of unauthorized procurement card purchases is reduced when control procedures contained in the procurement card handbook are adhered to. DELEGATION OF AUTHORITY [8] Buyers executed purchase contracts in excess of their delegated authority. Enforcing approved levels of purchasing authority reduces the risk of unauthorized purchases. REVOLVING FUND [9] Independent cash counts of petty cash and change funds did not always occur with the required frequency. Internal control of cash funds is improved when the accountability requirement is performed consistently and timely. CASH DISBURSEMENTS [9] Undelivered warrants and checks outstanding over one year were not remitted timely. Canceling or remitting long-outstanding checks and warrants timely reduces the risk of reversion to the General Fund and reduces additional effort to review outstanding checks and warrants during the reconciliation process. PAYROLL AND PERSONNEL [10] Sick and vacation leave credits were not properly posted. Accurate posting of leave credits reduces the risk that employees may have accrued leave available for use or use leave that is not available. Page 4

8 INTRODUCTION FISCAL INFORMATION TECHNOLOGY [11] Controls over the CashNet system did not provide adequate measures for safeguarding the system. Adequate protection of the CashNet server reduces the risk that the campus could lose vital information, have a disruption of services, and that unathorized activities could occur. RECONCILIATIONS [13] Bank, revolving fund, and State Controller s Office reconciliations were not prepared and reviewed in a timely manner. Timely preparation of reconciliations improves accountablity and reduces the risk of errors and irregularities. Page 5

9 OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES CASH RECEIPTS The athletics department did not adequately control, receipt, and secure cash receipts from certain club sporting events. Monies received in the athletics department consisted of fees paid for guarantees, gate entry fees, and fees paid by individual competitors. We found that: Entry fee tickets and/or receipts were not used for gate and entry fees collected, which prevented accountability over monies collected and deposited. Checks were not restrictively endorsed upon receipt. Deposits were transported to main cashiering by one employee even though receipts were likely to exceed $3,000 during track events. Athletics maintained a log of transfer receipts; however, the log was not always signed by cash services. State Administrative Manual (SAM) 8020 states that agencies will prepare receipts for collections of coin or currency received in person from payers who are not given press-numbered documents of fixed value at the time of payment. State University Administrative Manual 3821 rests responsibility in the chief business officer to monitor collection operations in cash collection centers and to assure that cash collection centers follow state and chancellor s office requirements for internal control, timely collection, and deposit. SAM requires checks and other negotiable instruments to be endorsed on the day they are received. SAM states that a single employee will not transport more than $3,000 in coin and currency at one time. SAM 8021 requires localized accountability for cash and an adequate audit trail for deposit information. The senior associate athletics director stated that the athletics department has not received specific guidance on cash handling procedures from university cash services. The business manager for athletics stated that she endorsed the checks when she prepared the deposit and that she prepared the deposit at the end of the week so the money was not kept in the vault over the weekend. She further stated that it was not feasible for two employees to take the deposit to cash services because there Page 6

10 OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES were only two employees in the office, and not obtaining signatures from cash services on the transfer log was an oversight. The university controller added that this was a new cashiering location. Inadequate controls over cash receipts increase the risk of misappropriation of funds. Recommendation 1 We recommend that the campus establish and implement procedures to adequately control, receipt, and secure cash receipts from athletics department sporting events. Campus Response We concur with the recommendation. Effective, August 1, 2002, associated students (a CSUN auxiliary organization) will sell tickets on-site at club sporting events. By August 1, 2002, the controller s office will prepare and distribute a procedure statement regarding transporting cash funds, endorsing checks and documenting transfers. PURCHASING PROCUREMENT CARDS Individuals other than the cardholder made procurement card purchases. We reviewed ten credit card statements and found that four of the ten statements contained purchase receipts or invoices for individuals other than the cardholder. The campus Procurement Card Program Guide states that the cardholder is responsible for the security of the procurement card, and cardholders are to keep the card secure and not loan it to another employee. The accounts payable manager stated that procurement cardholders felt that this helped them maintain control over their department budget. The risk of unauthorized procurement card purchases is increased when control procedures contained in the procurement card handbook are not adhered to. Recommendation 2 We recommend that the campus strengthen procedures to ensure that only authorized cardholders use procurement cards. Page 7

11 OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES Campus Response We concur with the recommendation. The Procurement Card Program Guide and the Procurement Card Program Agreement were revised in May 2002 to include a statement that cardholders must not allow co-workers to sign the credit card draft with either the cardholder s name or their own. All procurement card cardholders will be required to sign the new agreement by September 1, DELEGATION OF AUTHORITY Buyers executed purchase contracts in excess of their delegated authority. We reviewed 27 purchase contracts and found that buyers signed three of the purchase contracts in excess of their delegated authority. Executive Order No. 775, Acquisition of Personal Property and Services, dated June 6, 2001, states that authority is delegated to each campus president or designee to acquire personal property and services including information technology resources goods and services where applicable provisions of The California State University Policy Manual for Contracting and Procurement, issued and maintained by the Office of Chancellor, have been followed. The campus delegation of signature authority specifies signatory authority for the acquisition of personal property and services to purchasing department buyers. The director of purchasing and logistical services stated that buyers executing purchase contracts in excess of their authority was an oversight and that there was some confusion with the bid threshold and the authority to commit. Failure to enforce approved levels of purchasing authority increases the risk of unauthorized purchases. Recommendation 3 We recommend that the campus reinforce delegated purchasing authority limits with its buying staff to ensure that buyers do not exceed their individual delegations. Campus Response We concur with the recommendation. The interim director of purchasing and logistical services issued a memorandum on July 2, 2002, to all buyers reminding them of the importance of following the delegation. Page 8

12 OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES REVOLVING FUND Independent cash counts of petty cash and change funds did not always occur with the required frequency. We found that: Four of eleven funds requiring an annual count were not counted timely. Five of seven funds requiring a quarterly count were not counted timely. One of four funds requiring a monthly count was not counted timely. SAM states that an employee other than the custodian of the change or petty cash fund will count it in accordance with the prescribed schedule and report the count to the accounting office. The accounts payable manager stated that there were occasions where time did not permit prescribed audits due to the implementation of the common management system (CMS). Internal control over cash funds is compromised when the accountability requirement is performed inconsistently and untimely. Recommendation 4 We recommend that the campus strengthen procedures to count petty cash and change funds in accordance with the prescribed schedule. Campus Response We concur with the recommendation. We will implement a monthly report showing the cycle for cash counts and completion of the ones performed. This will enable the controller to monitor the timely completion of the cash counts. This process will be implemented by August 30, CASH DISBURSEMENTS Undelivered warrants and checks outstanding over one year were not remitted timely. We found that: Ten undelivered warrants from May 2000 totaling $2,911 were remitted on June 19, Two outstanding checks issued in May and June 2000 totaling $11,598 were remitted to the escheat account on July 24, 2001 (checks issued January 1, 1998 and after). Page 9

13 OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES Four outstanding checks issued April through June 1997 totaling $5,310 were remitted to the special deposit fund on July 27, 2001 (check issued before January 1, 1998). SAM 8042 states that office revolving fund and agency checks issued on or after January 1, 1998, have a one-year period of negotiability. Office revolving fund checks outstanding for more than one year or unclaimed, for which the reimbursement to the office revolving fund has not been received, will be canceled and credited back to the office revolving fund. Office revolving fund checks for which the reimbursement has been received and agency checks, whether uncashed for more than one year or unclaimed, will be canceled and the amount of such checks will be remitted to an escheat revenue account in the fund from which they were drawn. Further, office revolving fund and agency checks issued before January 1, 1998, that are outstanding over two years or unclaimed will be canceled, and the amount of the checks will be remitted to the Special Deposit Fund Unclaimed Trust Account. The general accounting manager stated that it is the campus policy to remit checks and uncleared deposits on a monthly basis; however, they are behind due to staffing shortages and the CMS implementation. The university controller added that the campus procedure is to remit checks after receiving a report confirming the checks have not been paid, and thus, the undelivered warrants and the checks issued in May 2000 noted as issues would have been remitted timely. He further stated that the four-year negotiability of the checks issued prior to January 1, 1998, might have added some confusion to the required remittance period. Not canceling or remitting long-outstanding checks and warrants timely could result in reversion to the General Fund and require additional effort to review outstanding checks and warrants during the reconciliation process. Recommendation 5 We recommend that the campus strengthen procedures to promptly process long-outstanding checks and warrants. Campus Response We concur with the recommendation. We will implement a monthly report that specifies when undelivered warrants are remitted and old outstanding checks are stopped and escheated to the State Controller s Office. This will enable the controller to monitor the timely processing of longoutstanding checks. This process will be implemented by August 30, PAYROLL AND PERSONNEL Sick and vacation leave credits were not properly posted. Our review of ten employees disclosed that sick and vacation leave had been accrued at less than the benefits stated in their respective collective bargaining agreements for five of the employees. Page 10

14 OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES SAM 8534 states that agencies will maintain sick leave and vacation records for each employee. The director of human resource services stated that leave credits were not credited in the month of July 2001 and that this was a direct result of the conversion to the PeopleSoft 8.0 Time and Labor module. He further stated that the campus is in the process of reviewing and correcting the postings. Inaccurate posting of leave credit results in the reporting of inaccurate leave balances and increases the risk that employees may not have the ability to use the appropriate accrued leave or may use leave that has not been accrued. Recommendation 6 We recommend that the campus complete its review and correction of the July 2001 postings and implement procedures to ensure that future leave credits are accurately posted. Campus Response We concur with the recommendation. Leave credits for the employees cited in the audit will be corrected by July 31, Payroll services has prepared written procedures for systematically reviewing leave balances for all employees. This process was implemented in June In addition, training for monthly reporting of leave balances will be provided to all departments beginning August FISCAL INFORMATION TECHNOLOGY Controls over the CashNet system did not provide adequate measures for safeguarding the system. Specifically, we noted that: The CashNet server room did not have smoke detectors or fire extinguishers and was located immediately adjacent to storage of paper files. All backup tapes were stored in the computer room except the weekly backup tapes, which were stored at the home of an employee. A contingency plan did not exist for the CashNet server. IDs of terminated employees were disabled but not deleted. The software vendor had unlimited access to all programs and data including credit card information. Page 11

15 OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES SAM states that there should be an established system of authorization and record-keeping procedures adequate to provide effective accounting control over assets, liabilities, revenues, and expenditures. The associate vice president of academic resources and chief information officer stated that the campus was in the middle of conversion to an enterprise environment, and physical renovations resulted in some unintended room occupancies. He further stated that allowing vendor access was a functional issue since it cuts response time to critical system issues. The director of systems and technology stated that given the limited number of information systems personnel and the need for vendors to perform contractual maintenance, total regulation of vendor activities is not possible, and procedures surrounding the CashNet system had not been recently reviewed for compliance with campus standards. The university controller added that the deletion of the disabled IDs was currently taking place. Inadequate protection of the CashNet server could cause the campus to lose vital information, could cause a disruption of service, and increases the risk that unauthorized activities could occur. Since vendors have the capability to make changes directly to production copies of programs and data, management cannot be assured that all changes made are authorized and, consequently, that internal controls are not compromised. In addition, the campus does not have any authority over the hiring practices of the vendor organizations to which they are granting the unlimited access rights. Recommendation 7 We recommend that the campus: a. Provide adequate protection for the CashNet server. b. Send backup tapes to a secured off-site location. c. Develop a contingency plan for the CashNet system. d. Remove unused IDs from the system. e. Restrict vendors from directly updating production copies of programs and data, where possible. Campus Response a. We concur with the recommendation. The CashNet server was moved to CSUN s data center on July 12, b. We concur with the recommendation. Backup tapes are sent to a secured off-site location. This process was implemented on July 12, c. We concur with the recommendation. A contingency plan for the CashNet system will be developed by August 30, d. We concur with the recommendation. Within 24 hours of an employee s termination, their UNIX logon ID is removed and their CashNet operator ID is disabled. This process was implemented on June 18, Page 12

16 OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES e. We concur with the recommendation. We will be installing a system utility that will enhance our ability track usage of the CashNet system. This utility will be installed by September 30, RECONCILIATIONS Bank, revolving fund, and State Controller s Office reconciliations were not prepared and reviewed in a timely manner. We found that: Bank Reconciliations The August 2001 reconciliation was completed on March 12, The September 2001 reconciliation was completed on March 13, The October 2001 reconciliation was completed on March 14, Revolving Fund Reconciliation The November 2001 reconciliation was completed on March 11, The December 2001 reconciliation was completed on March 11, The January 2002 reconciliation was completed on March 22, State Controller s Office Reconciliations The July 2001 reconciliation was completed on March 22, The August 2001 reconciliation was completed on March 22, SAM 7920 requires reconciliation of agency accounts with records other than those prepared by the agency to be completed monthly. SAM 8193 states two monthly reconciliations are required for revolving fund transactions. The revolving fund cash book balance plus the general ledger balance will be reconciled to the general checking account in the centralized state treasury system. Also, the revolving fund resources will be reconciled with the amount of cash advanced. SAM 8060 states that all bank and centralized state treasury system accounts will be reconciled promptly at the end of each month. The manager of budget planning and management stated that they were aware that they were behind in the revolving fund reconciliations and this was due to learning the new processes involved with the CMS implementation. The general accounting manager stated that the bank reconciliations and the State Controller s Office reconciliations were behind due to staffing shortages and the CMS Page 13

17 OBSERVATIONS, RECOMMENDATIONS, AND CAMPUS RESPONSES implementation. She further stated that the target date to have the bank reconciliations up to date is the end of April. Failure to timely prepare reconciliations compromises accountability and increases the risk of errors and irregularities. Recommendation 8 We recommend that the campus strengthen procedures to complete and review reconciliations in a timely manner. Campus Response We concur with the recommendation. Reconciliations will be completed and prepared timely by August 30, Page 14

18 APPENDIX A: PERSONNEL CONTACTED Name Jolene Koester Clarence Askew Robert Barker Karen Berkeland Spero Bowman Ronald Clouse Annagrace Collins John Darakjy Fred Dukes Margo Dutton Nancy Edwards Tasia Erickson Steven Fitzgerald Phillip Gin Carolyn Holmes Julie Hudson Diane Jansen Tamara Kotylar Shirley Krilowicz Brian Kritzell Stephanie Levy Paula Lumowa Howard Lutwak Meredith Lyon Angela McHugh Stephen Montgomery Chea Perry Mohammad Qayoumi Judy Reyes Janine Ridgeway Mary Rueda Anja-Leigh Russell Kimberly Sheldone Tim Trevan Bruce Weinstein Jeff Whitney Chris Xanthos Title President Manager, Asset Management/Mail Services University Controller Accounting Technician III, Library Associate Vice President of Academic Resources and Chief Information Officer Director, Budget Planning and Management Senior Associate Athletics Director Assistant Director, Financial Services Executive Assistant, Administration and Finance Manager, Budget Planning and Management Manager, Payroll Services Registration Coordinator, College of Extended Learning Chief Technology Officer Associate Director, Business and Hospitality Services Payroll Supervisor Assistant Director of Business Services, Residential Life Manager, University Cash Services Accounts Payable Technician Business Manager, Athletics Director, Purchasing and Logistical Services General Accounting Manager Student Accounting Supervisor University Internal Auditor Library Assistant II Accounts Receivable Supervisor Director, Human Resource Services Cash Operations Coordinator Vice President for Administration and Finance Accounts Payable Manager Lead Library Assistant III Assistant Director, Purchasing and Logistical Services Administrative Assistant to the University Controller Manager, Financial Systems and Trust Accounting Director, Residential Life and University Conference Services Material Manager, Purchasing and Logistical Services Human Resources Technical Lead Director, Systems and Technology

19 APPENDIX B Page 1 of 2 STATEMENT OF INTERNAL CONTROLS A. INTRODUCTION Internal accounting and related operational controls established by the state of California, the CSU Board of Trustees, and the Office of the Chancellor are evaluated by the University Auditor, in compliance with professional standards for the conduct of internal audits, to determine if an adequate system of internal control exists and is effective for the purposes intended. Any deficiencies observed are brought to the attention of appropriate management for corrective action. B. INTERNAL CONTROL DEFINITION Internal control, in the broad sense, includes controls which may be characterized as either accounting or operational as follows: 1. Internal Accounting Controls Internal accounting controls comprise the plan of organization and all methods and procedures that are concerned mainly with, and relate directly to, the safeguarding of assets and the reliability of financial records. They generally include such controls as the systems of authorization and approval, separation of duties concerned with record keeping and accounting reports from those concerned with operations or asset custody, physical controls over assets, and personnel of a quality commensurate with responsibilities. 2. Operational Controls Operational controls comprise the plan of organization and all methods and procedures that are concerned mainly with operational efficiency and adherence to managerial policies and usually relate only indirectly to the financial records. C. INTERNAL CONTROL OBJECTIVES The objective of internal accounting and related operational control is to provide reasonable, but not absolute, assurance as to the safeguarding of assets against loss from unauthorized use or disposition, and the reliability of financial records for preparing financial statements and maintaining accountability for assets. The concept of reasonable assurance recognizes that the cost of a system of internal accounting and operational control should not exceed the benefits derived and also recognizes that the evaluation of these factors necessarily requires estimates and judgment by management.

20 APPENDIX B Page 2 of 2 D. INTERNAL CONTROL SYSTEMS LIMITATIONS There are inherent limitations that should be recognized in considering the potential effectiveness of any system of internal accounting and related operational control. In the performance of most control procedures, errors can result from misunderstanding of instruction, mistakes of judgment, carelessness, or other personal factors. Control procedures whose effectiveness depends upon segregation of duties can be circumvented by collusion. Similarly, control procedures can be circumvented intentionally by management with respect to the executing and recording of transactions. Moreover, projection of any evaluation of internal accounting and operational control to future periods is subject to the risk that the procedures may become inadequate because of changes in conditions and that the degree of compliance with the procedures may deteriorate. It is with these understandings that internal audit reports are presented to management for review and use.

21

22

23

24

25