VIRGINIA COMMUNITY COLLEGE SYSTEM

REPORT ON AUDIT
FOR THE YEAR ENDED
JUNE 30, 2011
1
AUDI T SUMMARY

Our audit of the Virginia Community College System for the year ended June 30, 2011, found:

! the financial statements are presented fairly, in all material respects;

! certain matters involving internal control Iindings requiring Management`s attention; however,
we do not consider them to be material weaknesses;

! instances of noncompliance or other matters required to be reported under Government Auditing
Standards; and

! Northern Virginia Community College has not completed corrective action with respect to the
prior year Iinding 'Strengthen Internal Controls over Small Purchase Charge Card Program.

We have audited the basic financial statements of the Virginia Community College System as of and
for the year ended June 30, 2011, and issued our report thereon, dated June 18, 2012. Our report, included in
the System`s Annual Financial Report, is available at the Auditor oI Public Accounts` website at
www.apa.virginia.gov and at the System`s website at www.vccs.edu.



2
INTERNAL CONTROL AND COMPLIANCE FINDINGS AND RECOMMENDATIONS


Improve Monitoring Controls Over High Risk Transactions

Applicable to: System Office
Mountain Empire Community College
New River Community College
Northern Virginia Community College
Southwest Virginia Community College
Tidewater Community College
Virginia Highlands Community College
Wytheville Community College

The Virginia Community College System (VCCS) designed its application controls within the
PeopleSoft Accounting Information System to potentially permit improper separation of duties within the
general accounting and accounts payable processes. While VCCS designed roles within the application in
order to accommodate both large and small business offices at each College, there are some inherent risks
involved in doing this. Our review of application role assignments across all of the Colleges tested found
multiple instances where users could perform the following high risk activities.

! Change the vendor table and create and process accounts payable transactions, which allows for
payments.
! Enter and release general ledger entries.
! Enter and release accounts payable entries.

These permission combinations within the accounting system are inherently risky as they permit
processes which the same users should not perform. We understand that many of the Colleges with minimal
staff in their business office need to have these access roles for backup and contingency planning purposes in
the event of an emergency or absence of key personnel. However, the Colleges should have a means of
monitoring these transactions when they do occur since they carry a higher amount of risk.

Modern accounting systems rely on programmed internal controls and not manual processes. While
manual processes may create the allusion of having proper internal control and separation of duties, the
responsibilities and duties as they exist in the system are what the individual can really do regardless of
whether a person signs or reviews a piece of paper.

While each College outlines how individuals manually separate their performance within processes in
their policies and procedures manuals, there is an absence of a monitoring activity combined with the lack of
preventive system controls discussed above. We believe this situation creates undue risk that managers and
others could override manual policies and authorize improper transactions within the system without
detection.

Our additional substantive tests did not discover any inappropriate or unreasonable accounts payable
or general ledger transactions. However, the System office should develop and disseminate a monitoring
report to each College on a periodic basis that would identify instances where individuals have overridden
these policies and procedures so management can take action to ensure that those high risk transactions are
appropriate.



3
Deactivate Separated Employees` Finance Application Access Timely

Applicable to: Northern Virginia Community College

Our review of all active AIS and SIS PeopleSoft users found 15 terminated employees with active
access to Northern Virginia Community College`s Student InIormation System. It is a generally accepted
best practice for timely removal of all application access upon employee termination to enhance the security
of sensitive and mission critical data and processes.

Management needs to change the current College procedures for removing access to the network,
operating systems, and applications to include the timely removal of all system access. We recommend the
Colleges develop, implement, and enforce adequate procedures to ensure deleting all system access in a
timely manner upon employee termination.

Update the Authorized Signatory Card for Local Fund Accounts

Applicable to: Wytheville Community College

A terminated Wytheville Community College employee had bank signatory authority for more than
11 months after resigning. This signatory authority allowed this individual to act as a representative with the
bank on behalf of Wytheville Community College. Although we found no indication of misappropriation of
funds, this represents an internal control weakness.

Wytheville Community College should establish, implement, and document a process to update
signature authority immediately upon employee separation. Management should also periodically review the
appropriateness of signatory authority as an additional measure to prevent unauthorized access.

Deactivate Separated Employees` Procurement Application (eVA) Access Timely

Applicable to: Northern Virginia Community College (Repeat Finding)
Tidewater community College
Wytheville Community College

We found that the College personnel were not following employee separation procedures for the
removal of information system access to various applications.

We found Northern Virginia Community College did not remove access to eVA for 19 of 27
terminated employees within a reasonable time after separation.

We found Tidewater Community College did not remove access to eVA for 5 of 8 terminated
employees within a reasonable time after separation.

Wytheville Community College did not have a process in place to review user access to the eVA
application periodically.

The Department of General Services` (General Services) eVA Electronic Procurement System
Security Standards section 3.1.5 requires the deactivation of all system privileges within 24 hours after an
employee`s termination. Compliance with these standards is necessary to prevent misuse and possible Iraud.
eVA is a web application that anyone can access by computer, therefore; deactivating eVA user IDs promptly
is necessary to keep former employees from accessing the system after their termination.

4
Strengthen Controls over Purchase Card Program

Applicable to: Northern Virginia Community College (Repeat Finding)

Northern Virginia Community College continues to have inadequate control over its purchase card
program. Individual cardholders for Northern Virginia Community College that are responsible for
maintaining relevant documentation supporting charge card purchases were unable to provide complete
purchase logs, reconciliations, or supporting receipts.

The College should enforce their established policies and procedures for use of small purchase charge
cards. Management may employ procedures to enhance the enforcement of the policies and procedures
through monitoring processes, increased training, increasing the pre-approval process for purchase card
transactions, or any combination of the three. When management identifies cardholders who are not
following the College`s policies and procedures, they should take appropriate action in order to mitigate the
risk of fraud, waste and abuse by cardholders.

Perform Fixed Asset Physical Inventories

Applicable to: Mountain Empire Community College
New River Community College
Wytheville Community College

Mountain Empire Community College did not perform a complete physical inventory of capital assets
within the two year period established within its fixed asset accounting policy. While we recognize that
MECC`s Iixed asset employee leIt employment while in the process oI conducting the bi-annual inventory,
MECC did not finish the inventory until after the completion of our fieldwork.

New River Community College did not perform a complete capital asset inventory within the
required two year period. While staff did an inventory of some equipment, they did not perform a full
inventory of all controllable assets. The College also did not properly identify or correct reconciling items
during the partial inventory.

Wytheville Community College did not complete a capital asset inventory within the required two
year period. We recognize that Wytheville also experienced significant turnover during the audit period,
however the periodic inventory process is a critical control in ensuring the existence and completeness of
equipment.

Periodic inventories are a key control that helps to ensure the accuracy and integrity of capital asset
records and mitigates the risk of stolen or lost College property. The Colleges should follow their established
policies and carry out the periodic inventory in a manner that allows a 100 percent inventory of all
controllable assets within a two year period to address this risk.


5
Improve Payroll and Leave Controls

Applicable to: New River Community College

New River Community College (NRCC) could not provide work study timesheets for fiscal year
2011. Colleges must verify that an appropriate party has properly completed and authorized all source
documents such as timecards, timesheets, or any other authorization to pay or adjust an employee's pay, and
that such documents are accurate and recorded in the payroll system. Additionally, the Colleges must
maintain evidence of any changes so that it is accessible for current or future reviews. Not having the
appropriate evidence of student work-study work times increases the risk that the College may have to repay
the Federal Government all of amounts paid. NRCC should revise its records retention procedures to ensure
payroll source documents are properly maintained and accessible for a reasonable period of time.

Additionally, NRCC could not provide policies, procedures, or supporting evidence for their leave
liability accrual. While we were able to materially substantiate the College`s leave liability through
alternative analytical procedures, the College should develop, implement, and adhere to consistent procedures
for calculating leave liability each year.



6
STUDENT FINANCIAL AID COMPLIANCE AND INTERNAL CONTROL FINDINGS

Improve Notification of Direct Loan Awards to Students

Applicable to: Dabney S. Lancaster Community College
New River Community College

The Financial Aid Office is not properly notifying students of Federal Direct Loan Awards. The
Financial Aid Office communicates loan awards verbally to students when they speak with a financial aid
staff member instead of the required written notification to students which provide important details on the
rights, options, and requirements of the student loan.

Code of Federal Regulations, Title 34 CFR 668.165(a)(2), requires institutions to properly notify
students receiving direct loans, in writing, oI the date and amount oI the disbursement, the student`s right to
cancel all or a portion of a loan or loan disbursement, and the procedure and time by which the student must
notify the institution that he or she wishes to cancel the loan. Failure to properly notify students in
accordance with Federal Regulations may result in fines, withholding of Title IV funds, or suspension or
termination of participation in Title IV programs.

Reconcile Financial Aid Activity to Federal Systems

Applicable to: Dabney S. Lancaster Community College
New River Community College
Virginia Western Community College

These Colleges are not reconciling their accounting records with the Direct Loan Servicing System
(DLSS) or their Pell financial records with the Common Origination and Disbursement (COD) system.

In accordance with 34 CFR 685.301(e) and 34 CFR 685.201(b), colleges must report all loan
disbursements and submit required records to the Direct Loan Servicing System via the COD within 30 days
of disbursement. Each month, the COD provides the college with a School Account Statement (SAS) data
file which consists of a Cash Summary, Cash Detail, and Loan Detail records. The Financial Aid Office
should reconcile its financial records with those of the Federal Government monthly to help ensure the
accuracy and completeness of both sets of records.

Appropriately Report Federal Pell Grant Disbursements

Applicable to: Dabney S. Lancaster Community College
Southwest Virginia Community College

The College must report Federal Pell Grant disbursements to COD within 30 days of disbursement
but no more than seven days before disbursement in accordance with 76 FR 32961.

In five of 35 (14 percent) students tested at Dabney S. Lancaster Community College and in 16 of 35
(46 percent) students tested at Southwest Virginia Community College, the Financial Aid office did not
record disbursements using the Common Origination and Disbursement system for Pell awards within the
required timeframe by reporting the disbursements up to six months before actual disbursement. The
Financial Aid Office should report disbursements to COD within the required timeframes.


7
Properly Calculate and Return Title IV Funds

Applicable to: New River Community College
Southwest Virginia Community College
Dabney S. Lancaster Community College
Virginia Western Community College


Student Financial Aid offices at these colleges did not properly calculate Return of Title IV funds for
students who officially or unofficially withdrew from courses and no-longer qualified for Federal Financial
Aid.

New River Community College inaccurately calculated return of Title IV funds for students that
withdrew in fall 2010 and spring 2011. We found errors in 26 out of 31 student accounts tested resulting in
the College incorrectly returning $2,830 in Title IV funds to the U. S. Department of Education. In spring
2011, the College incorrectly reduced the original award amounts prior to completing the return to Title IV
calculation resulting in the total grants and loans awarded, for the purposes of the calculation, to be
understated. The Code of Federal Regulations 668.22 (e) (ii) requires the College to calculate the percentage
earned by the student on the total of the Title IV grants and loans awarded. In fall 2010 the College used an
inaccurate number of days in the semester for the purpose of determining the proportion of unearned financial
aid.

Southwest Virginia Community College returned incorrect Title IV funds for 19 of 20 students tested
(95 percent). The College used an inaccurate number of days in the semester for the purpose of determining
the proportion of unearned financial aid. This caused overpayments of $871 and underpayments of $7,664 to
the Department of Education.

For three of ten students (30 percent) tested, we found Dabney S. Lancaster Community College
returned the total amount of aid to be returned instead of the amount required to be returned by school as by
federal regulation. This caused an overpayment to the Department of Education and erroneous billings to
students for returned amounts of $1,347.

We found Virginia Western Community College returned incorrect amounts for three of twelve
students tested (25 percent). This caused overpayments and underpayments to the Department of Education
and erroneous billings to students for returned amounts. For two students, the college overpaid $340.32 and
erroneously billed those students for the returned aid, and for one student, the college returned $373.20 less
than it should have to the Department of Education.

Failure to properly calculate and return Title IV funds may jeopardize continued participation in Title
IV programs.



8
Improve Student Financial Aid Control Environment

Applicable to: Virginia Western Community College
Southwest Virginia Community College

We found that both Southwest Virginia and Virginia Western Community Colleges lack adequate
contingency planning and documented procedures sufficient to ensure continued control over Student
Financial Aid processes in the event that key personnel cannot perform their duties. We found that
management of both colleges have not fully trained or cross-trained their staff on various financial aid
processes.

Over the past few years, Virginia Western Community College has had significant turnover of key
Financial Aid staff. As a result, management has not resolved prior control recommendations, has not created
clearly defined roles and tasks for staff, and has not provided adequate training on federal compliance
requirements. The impact of incomplete management oversight caused delays in processing student aid
transactions and noncompliance with federal requirements.

Southwest Community College has only one trained employee to perform critical financial aid duties
including the management of Title IV refunds, federal reporting and reconciliations, and eligibility
determinations. The lack of cross training other individuals or documenting procedures performed by this
individual sufficient to ensure continuity during their absence creates substantial risk over controls in the
Financial Aid process.

We recommend that both colleges devote the resources necessary to ensure continuity in operations in
the Financial Aid office in the event of an absence of their respective managers. Proper contingency planning
would include cross-training financial aid staff to perform multiple duties and adequately documenting
procedures that reflects the operations of the office.

9



June 18, 2012


The Honorable Robert F. McDonnell
Governor of Virginia

The Honorable John M. O`Bannon, III
Chairman, Joint Legislative Audit
And Review Commission

State Board of Community Colleges
Virginia Community College System


INDEPENDENT AUDITOR`S REPORT ON INTERNAL CONTROL OVER

FINANCIAL REPORTING AND ON COMPLIANCE AND OTHER MATTERS

We have audited the financial statements of the business-type activities and aggregate discretely
presented component units of the Vi rginia Community College System as of and for the year ended
June 30, 2011, which collectively comprise the System`s basic Iinancial statements and have issued our report
thereon dated June 18, 2012. Our report includes a reference to other auditors. We conducted our audit in
accordance with auditing standards generally accepted in the United States of America and the standards
applicable to financial audits contained in Government Auditing Standards, issued by the Comptroller
General of the United States. We did not consider internal controls over financial reporting or test
compliance with certain provisions of laws, regulations, contracts, and grant agreements for the financial
statements of the component units of the System, which were audited by other auditors in accordance with
auditing standards generally accepted in the United States of America, but not in accordance with
Government Auditing Standards.

Internal Control Over Financial Reporting

Management of the System is responsible for establishing and maintaining effective internal control
over financial reporting. In planning and performing our audit, we considered the System`s internal control
over financial reporting as a basis for designing our auditing procedures for the purpose of expressing our
opinions on the financial statements, but not for the purpose of expressing an opinion on the effectiveness of
the System`s internal control over Iinancial reporting. Accordingly, we do not express an opinion on the
effectiveness of the System`s internal control over Iinancial reporting.

A deficiency in internal control exists when the design or operation of a control does not allow
management or employees, in the normal course of performing their assigned functions, to prevent, or detect
and correct misstatements on a timely basis. A material weakness is a deficiency, or a combination of
deficiencies, in internal control such that there is a reasonable possibility that a material misstatement of the
entity`s Iinancial statements will not be prevented, or detected and corrected on a timely basis.

10

Our consideration of internal control over financial reporting was for the limited purpose described in
the first paragraph of this section and was not designed to identify all deficiencies in internal control over
financial reporting that might be deficiencies, significant deficiencies or material weaknesses. We did not
identify any deficiencies in internal control over financial reporting that we consider to be material
weaknesses, as defined above. However, we identified certain deficiencies in internal control over financial
reporting, which are described in the sections titled 'Internal Control and Compliance Findings and
Recommendations, and 'Student Financial Aid Compliance and Internal Control Findings that we consider
to be significant deficiencies in internal control over financial reporting. A significant deficiency is a
deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness,
yet important enough to merit attention by those charged with governance.

Compliance and Other Matters

As part of obtaining reasonable assurance about whether the System`s financial statements are free of
material misstatement, we performed tests of its compliance with certain provisions of laws, regulations,
contracts and grant agreements, noncompliance with which could have a direct and material effect on the
determination of financial statement amounts. However, providing an opinion on compliance with those
provisions was not an objective of our audit and, accordingly, we do not express such an opinion. The results
of our tests disclosed instances of noncompliance or other matters that are required to be reported under
Government Auditing Standards. Instances of noncompliance and other matters are described in the sections
titled 'Internal Control and Compliance Findings and Recommendations and 'Student Financial Aid
Compliance and Internal Control Findings.

The System`s response to the findings identified in our audit is included in the section titled 'Agency
Response. We did not audit the System`s response and, accordingly, we express no opinion on it.

Status of Prior Findings

Northern Virginia Community College has not taken adequate corrective action with respect to the
previously reported findings 'Deactivate Separated Employees` Procurement Application Access Timely
and 'Strengthen Controls over Purchase Card Program. Accordingly, we included these findings in the
section entitled 'Internal Control and Compliance Findings and Recommendations. The System has taken
adequate corrective action with respect to audit findings reported in the prior year that are not repeated in this
report.

Report Distribution and Exit Conference

The 'Independent Auditor`s Report on Internal Control over Financial Reporting and on Compliance
and Other Matters is intended solely for the information and use of the Governor and General Assembly of
Virginia, the Board of Visitors, and management, and is not intended to be and should not be used by anyone,
other than these specified parties. However, this report is a matter of public record and its distribution is not
limited.

We discussed this report with management at an exit conference held on June 28, 2012.



AUDITOR OF PUBLIC ACCOUNTS

AWP/clj


11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

STATE BOARD FOR COMMUNITY COLLEGES

As of June 30, 2011



Nathaniel Xavier Marshall, Chairman

Jeffery K. Mitchell, Vice Chairman


Hank W. Chao Adele C. Johnson
Idalia P. Fernandez Bruce Meyer
Sasha Gong R. Michael Mohler
Gary C. Hancock Robert W. Shinn
Dorcas Helfant-Browning William H. Talley, III
Danny Hunley Michael E. Thomas
Barbara A. Johnsen



CHANCELLOR

Dr. Glenn DuBois



26

COMMUNITY COLLEGE PRESIDENTS

As of June 30, 2011

Blue Ridge Community College Dr. John A. Downey

Central Virginia Community College Dr. John Capps

Dabney S. Lancaster Community College Dr. Richard R. Teaff

Danville Community College Dr. B. Carlyle Ramsey

Eastern Shore Community College Dr. Linda Thomas-Glover

Germanna Community College Dr. David A. Sam

J. Sargeant Reynolds Community College Dr. Gary L. Rhodes

John Tyler Community College Dr. Marshall W. Smith

Lord Fairfax Community College Dr. Cheryl Thompson-Stacy

Mountain Empire Community College Dr. J. Scott Hamilton

New River Community College Dr. Jack M. Lewis

Northern Virginia Community College Dr. Robert G. Templin, Jr.

Patrick Henry Community College Dr. Max F. Wingett

Paul D. Camp Community College Dr. Paul W. Conco

Piedmont Virginia Community College Dr. Frank Friedman

Rappahannock Community College Dr. Elizabeth H. Crowther

Southside Virginia Community College Dr. John J. Cavan

Southwest Virginia Community College Dr. J. Mark Estepp

Thomas Nelson Community College Dr. Alvin J. Schexnider

Tidewater Community College Dr. Deborah M. DiCroce

Virginia Highlands Community College Dr. Ron E. Proffitt

Virginia Western Community College Dr. Robert H. Sandel

Wytheville Community College Dr. Charlie White

!
27