Spreadsheet: 00356135-91b5-42ce-9593-37db6c63d0b1
Sheet: Sheet1

KENTUCKY COMMUNITY AND TECHNICAL COLLEGE SYSTEM
RISK ASSESSMENT QUESTIONNAIRE
COLLEGE
COMPLETED BY
DATE COMPLETED
 |  |  |  |  |  |  |  |  |  |  | YES | NO | N/A
CASH HANDLING
1. | Is proper segregation of duties in place for the following processes:
 | A. | Billing
 | B. | Recording of Revenue
 | C. | Cash Receipts
 | D. | Preparation of Bank Deposit
 | E. | Posting Cash Receipts to PeopleSoft
 | F. | Reconciling Bank Accounts
 | G. | Reconciling Accounts Receivable
2. | Please attach a brief explanation of the aforementioned segregation of duties as support for
 | answers provided to Questions 1A - 1G.
3. | Are all checks received restrictively endorsed to KCTCS immediately using a stamp?
4. | Are deposits made on a daily basis?
4a. | If no, please describe deposit frequency along with reasoning for non-daily deposit schedule.
5. | Are any funds that are received, but not deposited by the end-of-business on any particular day
 | physically safeguarded until deposit is made?
5a. | If so, what methods of safeguarding are used?
6. | Do areas where large volumes of cash are received employ additional controls such as the
 | following:
 | A. | Security cameras
 | B. | Security personnel, if needed
7. | Is a detailed cash receipts log maintained?
8. | Is detailed cash receipts log periodically reconciled with deposit records (to be performed by
 | someone other than person handling receipts)?
9. | Are employees who handle cash receipts required to take vacation leave?
10. | Are duties of personnel handling cash receipts ever rotated?
11. | Are there cash handling procedures in place that have been approved by KCTCS Director of Business
 | Services?
11a. | Have all employees who handle cash signed a document stating that they have received and read
 | such cash handling procedures?
EXPENDITURES
Purchasing
1. | Is proper segregation of duties in place for the following processes:
 | A. | Purchase Orders/Requisitions (Preparation and Authorization)
 | B. | Receiving of Goods
 | C. | Recording of Accounts Payable
2. | Please attach a brief explanation of the aforementioned segregation of duties as support for
 | answers provided to Questions 1A - 1C.
Procard
1. | Have all cardholders been properly notified of KCTCS Business Procedures as they relate specifically
 | to Procard use?
2. | Have all cardholders evidenced this notification and understanding of such procedures through
 | signature?
3. | Has number of cards issued been "right sized" to only those most necessary for daily business
 | operations?
4. | Have transaction limits and cycle limits been reviewed and adjusted according to need and historical
 | use?
5. | Are any issues of non-compliance immediately acted upon, including suspension or revocation of
 | the Procard?
6. | Are there any recurring issues of non-compliance from any specific cardholders and/or departments?
7. | Are purchases of supplies monitored by department or employee to determine any trends that may
 | signal possible theft or other instances of fraud?
8. | Please attach a brief explanation of all procedures, if any,  related to Procard that would be
 | considered "above and beyond" those that are set forth in KCTCS Business Procedures.
Payroll
1. | Is proper segregation of duties present (to the maximum extent possible) for the following processes:
 | A. | New employee hires
 | B. | Pay rate authorizations
 | C. | Duties associated with deleting employees from master file from duties involving processing of
 |  | payroll
 | D. | Data entry (Master) into the payroll system
 | E. | Timesheet data entry
 | F. | Timesheet approval
 | G. | Employee leave accruals and data entry
2. | Please attach a brief explanation of the aforementioned segregation of duties as support for
 | answers provided to Questions 1A - 1G.
3. | Are all salaries and wage rates properly authorized by designated official/s?
3a. | If so, are all authorizations evidenced through actual signature (no stamps) on proper forms (PAAR)?
4. | Are periodic comparisons performed between rosters of authorized employees and actual payroll
 | reports?
5. | Are periodic reviews performed on payroll master file data to note any duplications of the following:
 | A. | Employee addresses
 | B. | Employee social security numbers
 | C. | Direct deposit bank account numbers
6. | Are periodic comparisons performed between list of terminated employees with payroll register?
7. | Are timesheets reviewed and approved by direct supervisors with first-hand knowledge of the
 | applicable employee?
8. | Are timesheets ever returned to employee AFTER review and approval by supervisor?
9. | Are any corrections to timesheets made only with proper approvals by supervisor?
10. | Are there specific and explicit rules related to timeliness of timesheet submission to supervisors?
11. | Are periodic reviews performed on pay rates to cross-check rates per payroll register to authorized
 | (by signature) in personnel files?
Travel
1. | Have all employees who travel been properly informed of KCTCS policies and procedures regarding
 | reimbursement of travel expenditures prior to actual travel dates including, but not limited to, the
 | following areas:
 | A. | Allowable vs. unallowable expenses
 | B. | Procedures and responsibilities for monitoring budgets for each respective department
 | C. | Dollar limitations, where applicable
 | D. | Proper approvals for out-of-state or out-of-country travel
 | E. | Requirements for completion and submission of travel expense reimbursement vouchers,
 |  | including timeliness of submission
 | F. | Documentation requirements (originals vs. copies)
2. | Are all travel reimbursement vouchers required to be reviewed and approved (through signature)
 | by the direct supervisor of the submitting employee?
3. | Are all travel reimbursement vouchers re-calculated to ensure all amounts are correct?
4. | Are periodic reviews performed to cross-check amounts actually paid through PeopleSoft with
 | amounts submitted on travel reimbursement vouchers?
5. | Are periodic reviews performed between travel logs and amounts actually paid through PeopleSoft
 | to ensure there have been no duplicate payments?
CAPITAL ASSETS AND INVENTORY
1. | Is proper segregation of duties present (to the maximum extent possible) for the following processes:
 | A. | Purchasing of capital assets and/or inventory
 | B. | Receipt of new capital assets and/or inventory
 | C. | Maintaining capital asset/inventory records/schedules
 | D. | Disposals and/or write-offs of obsolete or unused capital assets/inventory
 | E. | Physical inventories of capital assets/inventory
2. | Are policies and procedures documented that explicitly prohibit any non-business use of KCTCS
 | capital assets and/or inventory?
3. | Are "check-out" logs maintained and used to document use of individual assets, namely laptops?
4. | Are there methods in place for employees to report any noted abuses of KCTCS capital assets
 | [NAME] to proper college or System Office officials?
5. | Are surveillance cameras in place and in use to observe areas that may be prone to theft of capital
 | assets and/or inventory by employees or other outside parties?
HUMAN RESOURCES
Hiring Practices
1. | Are formal policies and procedures in place that clearly state the requirements to obtain/verify the
 | following information (including, but not limited to) as a normal part of the pre-employment screening
 | of potential hires:
 | A. | Identity verification (Form I-9)
 | B. | Criminal background checks
 | C. | Driving records (where applicable)
 | D. | Educational achievements
 | E. | Licenses and/or certifications
1a. | If certain new hires are not subjected to the minimum requirements set forth in questions 1A - 1E,
 | which positions are not subjected and why are they not subjected?
2. | Are all new hires required to attend a formal orientation?
3. | Does the college's new employee orientation include the following elements (but not limited to):
 | A. | Detailed review of KCTCS code of conduct
 | B. | KCTCS Business Procedures and related memorandums (in detail)
Performance Evaluations
1. | Are current and accurate job descriptions maintained for all positions?
2. | Have performance standards been explicitly stated to each position or department at the college?
3. | Are annual evaluations reviewed by someone other than the primary evaluator to determine
 | accuracy and integrity?
4. | Are primary evaluators (typically direct supervisors) formally evaluated on the adequacy of their
 | evaluations?
Departing Employees
1. | Does a representative of the college's Human Resources department conduct exit interviews with all
 | departing employees?
2. | During exit interviews, are departing employees asked about his/her knowledge of any potential
 | fraud within the college or KCTCS System?
3. | Are all departing employees required to return all keys, passes, or other identification upon their
 | departure?
4. | Are all accesses to KCTCS information technology (i.e. PeopleSoft or other databases containing
 | confidential information) disontinued for all departing employees upon their departure?
GENERAL ADMINISTRATIVE
Physical Security
1. | Is access to individual offices restricted using locks of some sort?
2. | For colleges that utilize any kind of parking garage, is access to such garage restricted?
3. | Are security cameras or security guards utilized for high-traffic areas that might be prone to theft or
 | other instances of fraud?
Information Technology
1. | Are passwords utilized to restrict access to systems containing sensitive data?
2. | Are employees with access to such passwords instructed not to give out the passwords to other
 | employees?
3. | Are passwords required to be changed on a regular basis?
4. | Are employees instructed to log off their systems when they are away from their workstations?
5. | Are accesses to system data immediately updated when an employee changes jobs within KCTCS?
6. | Are accesses to system data immediately discontinued when an employee departs KCTCS?
Confidential Information
1. | Are employees instructed on policies and procedures related to dealing with sensitive and confidential
 | information?  Such issues would include, but not be limited to, the following:
 | A. | The overall importance of confidentiality as it pertains to KCTCS' goal of integrity?
 | B. | What types of information would be considered confidential?
 | C. | Discussing confidential information via telephone should be done quietly
 | D. | Proper procedures for sending/receiving confidential information using fax machines?
 | E. | Monitoring copy machines and/or shared printers when known confidential information will be
 |  | copied or printed
 | F. | Sending emails containing confidential information only to those employees necessary
 | G. | Locking offices or files (when unattended) containing confidential information
 | H. | Proper methods for destroying confidential information
Mailroom Security
1. | Is access to mailrooms physically restricted only to authorized individuals?
2. | Are documents containing confidential information left in exposed areas while mailroom is
 | unattended?