Purpose

To determine the extent of implementation of the nine recommendations included in our initial report, Controls Over CUNY Fully Integrated Resources and Services Tool (2015-S-34).

Background

CUNY is the largest urban university in the United States, consisting of 24 institutions. The CUNY Fully Integrated Resources and Services Tool (CUNYfirst), which replaced CUNY’s legacy systems, is an Enterprise Resource Program used for various applications including student administration, financial administration, and human resources. As of February 15, 2018, there were 1.64 million CUNYfirst users, consisting of both active and inactive employees and current and former students. Our prior audit report was issued September 2, 2016. We found that CUNY’s processes and controls did not adequately ensure that CUNYfirst users had access only to functions that were necessary to meet their needs. For example, CUNY Central Office granted 60 roles to Application Security Liaisons, or ASLs (information technology personnel who grant access to CUNYfirst at the campuses), without adequate justification. The business needs for the ASLs to have the roles in question were unclear. In addition, there were 27 roles that were removed from employees who had left CUNY, but not until 3 to 32 months after their departure.

Key Finding

We found that officials have made progress in addressing the issues identified in our initial report. Of the nine prior audit recommendations, one was implemented, six were partially implemented, and two were not implemented.

Key Recommendation

Officials are given 30 days after the issuance of the follow-up review to provide information on any actions that are planned to address the unresolved issues discussed in this review.