Table Of Contents
378.106
L72BSIS
1996
Legislative Audit Division
State of Montana
Report to the Legislature
EDP
Audit Report
June 1996
&WTE
Documents
collection
MONTANA STATE LIBRARY
uHrE.LEpN1?A.,15MEO-N6TtAhNAAVE5.9620
Banner Student Information Systems
The University of Montana - Missoula
This report provides information regarding application controls related
to The University's Banner Student Information Systems. It contains
recommendations for improving controls within the University's
electronic data processing environment and its student grading
procedures. These recommendations address:
Improving procedures over Student Accounts Receivable
collections.
Communicating formal grade procedures to campus instructors
and data entry employees.
Improving physical security over grade sheets and change forms.
Improving electronic access controls.
.,*>-<
Direct comments/inquiries to:
Legislative Audit Division
Room
135, State Capitol
PO Box 201705
MT
Helena 59620-1705 95DP-06
MONTANASTATELIBRARY
3 0864 0010 3901 8
EDP AUDITS
ElectronicDataProcessing (EDP)audits conductedbytheLegislativeAuditDivisionaredesigned
to assess controls in an EDP environment. EDP controls provide assurance over the accuracy,
reliability, and integrity ofthe information processed. From the audit work, a determination is
made as to whether controls exist and are operating as designed. In performing the audit work,
the audit staffuses audit standards set forth by the United States General Accounting Office.
Members of the EDP audit staff hold degrees in disciplines appropriate to the audit process.
Areas ofexpertise include business and public administration.
EDP audits areperformed as stand-aloneaudits ofEDP controls or in conjunction with financial-
compliance and/or performance audits conducted by the office. These audits are done under the
oversight of the Legislative Audit Committee which is a bicameral and bipartisan standing
committee oftheMontanaLegislature. Thecommittee consists ofsix members ofthe Senate and
six members ofthe House of Representatives.
MEMBERS OF THE LEGISLATIVE AUDIT COMMITTEE
Senator Greg Jergeson, Vice Chairman RepresentativeErnestBergsagel,Chairman
Senator Sue Bartlett Representative Beverly Barnhart
Senator Reiny Jabs Representative A. R. "Toni" Hagener
Senator Tom Keating Representative Bob Keenan
Senator Ken Miller Representative Robert Pavlovich
Senator Linda Nelson Representative Bruce Simon
Montana
Legislative
Legislative Audit Division
otanCn
ScottA. Seacat, Legislative Auditor
June 1996
The Legislative Audit Committee
ofthe Montana State Legislature:
This is our EDP audit report of The University of Montana - Missoula's internal controls
relating to its computer-based Banner Student Information Systems. We reviewed application
controls over the Banner application. This report contains recommendations for improving
EDP controls at the University. Our recommendations include improving electronic access
security and student grade recording procedures. Written responses to our audit
recommendations are included in the back ofthe audit report.
We thank The University of Montana - Missoula personnel for their cooperation and
assistance throughout the audit.
Respectfully submitted,
Scott A. Seacat
Legislative Auditor
Room 136, State CapitolBuilding POBox201706 HelenaMT69620-1706
Phone406-444-3122 FAX406-444-9784
Legislative Audit Division
EDP
Audit Report
Banner Student Information Systems
The University of Montana - Missoula
Members of the audit staff involved in this audit were Dawn Brewer, Alan
Lloyd, and Rich McRae.
Table of Contents
Administrative and Appointed Officials
Report Summary S-
Chapter I - Introduction Introduction
and Background EDP General Controls
Conclusion: General Controls Provide Controlled
Application Processing for Banner
EDP
Application Controls
BANNER
Conclusion: Application Controls
Provide for Reliable Processing 2
Audit Objectives 2
Audit Scope and Methodology 2
Compliance 3
Background 3
Chapter II - Banner Introduction 4
Application Controls
Student Admissions 7
Student Registration 7
Student Accounts Receivable 8
Segregation of Cashier Duties 8
Grade Entry Procedures 10
Student Financial Aid 11
Chapter in - Electronic Introduction 13
Access Controls Employee Access Based on Job Duties 14
Generic Logon IDs 15
Electronic Access Authorization Procedures 16
Agency Response The University of Montana - Missoula 21
Page
i
Appointed and Administrative Officials
Board of Regents of Term
Higher Education Expires
Marc Racicot, Governor*
Nancy Keenan, Superintendent of Public Instruction*
Jim Kaze, Chairman Havre 1999
Margie Thompson Butte 2003
Kermit R. Schwanke Missoula 1997
Paul Boylan Bozeman 1998
Patrick P. Davison Billings 2000
L. Colleen Conroy Hardin 2001
Mike Green, Student Regent Belgrade 1997
*Ex officio members
Commissioner of Higher Jeffrey D. Baker Commissioner of Higher Education
Education
Richard Crofts Deputy Commissioner for Academic
Affairs
Rod Sundsted Associate Commissioner for Fiscal Affairs
Laurie O. Neils Director of Budget and Accounting
The University of George M. Dennison President
Montana - Missoula
James E. Todd Vice President for Administration and
Finance
John Cleaveland Executive Director, Office of Information
Technology
Page
ii
Report Summary
Introduction This report discusses our review of application controls over
Banner Student Admissions, Registration, Academic History,
Financial Aid and Accounts Receivable modules. A discussion of
application controls and the objectives and scope of this audit is
included in Chapter I. Further detail for the audit issues
summarized below is included in Chapters II and III ofthe report.
Overall, wefound Bannerapplication controlsprovidefor reliable
processingresults.
Student Admissions The Banner Student Admissions module establishes admission
records and identifies items an applicant should provide to
complete the application for admission. This module verifies
students are admitted in accordance with University criteria. Our
objective was to ensure students are admitted according to Board of
We
Regents policy prior to registering for courses. reviewed data
entry controls over student information entered into the Admissions
module. We concluded input controls were adequate to ensure
accuracy and completeness ofstudent admissions data entry.
Student Registration The University uses Dial Bear, an interactive voice response
software, for student registration. Following authorization to
register, students telephone Dial Bear and respond to a voice
recording to enter registration selections. Dial Bear accepts only
valid course codes, and prevents registration based on course
prerequisite and/or vacancy. Once students confirm their
selections, Dial Bear automatically posts the selections to the
Registration module. Registration data is later used by the
Accounts Receivable module to assess student registration fees.
We
verified Dial Bear properly converts student data entry into
Banner machine-readable form and posts registration additions or
deletions to the Student Registration module. We concluded input
andprocessing controls over Student Registration were adequate
to ensure data entry andprocessingis accurate and complete.
PageS-1
Report Summary
Student Accounts The Accounts Receivable module tracks all assessed fees to the
Receivable student account in addition to waivers and credits associated with
registration. The Accounts Receivable module displays term
specific tuition, housing, meal plan, and fee charges and applies
student fees to the student account according to University policy.
Thefee assessmentprogram accurately and completelyprocessed
studentfeesper credit based on the approvedBoard ofRegents
fee schedule.
We
also reviewed procedures for collecting student fees as
processed in the Accounts Receivable module. The following
section discusses how the University could improve procedures
which ensure University collections are complete and accurate.
Segregation of Cashier Cashiers adjust Banner student fees by entering registration fee
Duties waivers to the student account. Fee waivers include late
registration fees, student health insurance, or parking decal fees.
Data entry personnel may also adjust student fees, record student
payments into Banner, and print new student receipts. Banner
electronic access allows cashiers or data entry employees to adjust
fees and record student payments without authorization from
campus departments.
Management procedures should ensure individual employees are
not in a position to conceal transaction errors or irregularities.
Existing procedures allow employees to apply fee waivers after
receiving a student payment. Employees could pocket the
difference and record a "refund" adjustment to the student account.
Academic History Employees establish University grading policies and maintain
student grade reports within the Academic History module. This
module calculates academic standing based on University defined
rules regarding probation and dean's list policies. The module also
computes and maintains semester and cumulative GPA information.
We limited our review to grade data entry and GPA processing
Page S-2
