METROPOLITAN STATE UNIVERSITY OF DENVER FINANCIAL AND COMPLIANCE AUDIT Years Ended June 30, 2019 and 2018 LEGISLATIVE AUDIT COMMITTEE Senator Nancy Todd – Chair Representative Lori Saine – Vice-Chair Representative Rod Bockenfeld Senator Paul Lundeen Senator Rhonda Fields Representative Dafna Michaelson Jenet Representative Tracy Kraft-Tharp Senator Jim Smallwood OFFICE OF THE STATE AUDITOR Dianne E. Ray State Auditor Kerri Hunter Deputy State Auditor Matt Devlin Deputy State Auditor Brad Walcher Contract Monitor Cindi Radke IT Contract Monitor Plante & Moran, PLLC Contractor AN ELECTRONIC VERSION OF THIS REPORT IS AVAILABLE AT WWW.STATE.CO.US/AUDITOR A BOUND REPORT MAY BE OBTAINED BY CALLING THE OFFICE OF THE STATE AUDITOR 303.869.2800 PLEASE REFER TO REPORT NUMBER 1923F WHEN REQUESTING THIS REPORT Members of the Legislative Audit Committee We have completed the financial statement and compliance audit of Metropolitan State University of Denver as of and for the year ended June 30, 2019. Our audit was conducted in accordance with auditing standards generally accepted in the United States of American and the standards applicable to financial audits contained in Government Auditing Standards, issued by the Comptroller General of the United States. We were engaged to conduct our audits pursuant to Section 2-3-103, C.R.S., which authorizes the State Auditor to conduct or cause to be conducted audits of all departments, institutions and agencies of state government. The reports which we have issued as a result of this engagement are set forth in the table of contents which follows. Lisa Meacham, Partner November 26, 2019 METROPOLITAN STATE UNIVERSITY OF DENVER TABLE OF CONTENTS Report Summary (Unaudited) ............................................................................................................... 1 Recommendation Locator (Unaudited) ................................................................................................. 3 Financial and Compliance Audit Report Section: Description of the Metropolitan State University of Denver (Unaudited) ......................................... 4 Schedule of Findings and Questioned Costs .................................................................................. 5 Disposition of Prior Audit Findings and Recommendations .......................................................... ..9 Independent Auditors’ Report ............................................................................................................. 10 Management’s Discussion and Analysis (Unaudited) ......................................................................... 13 Basic Financial Statements Statements of Net Position ........................................................................................................... 28 Discretely Presented Component Unit – Statements of Financial Position ................................... 30 Statements of Revenues, Expenses, and Changes in Net Position ............................................. 31 Discretely Presented Component Unit – Statements of Activities. ................................................ 32 Statements of Cash Flows ............................................................................................................ 33 Notes to Financial Statements ...................................................................................................... 35 Notes to Component Units Metropolitan State University of Denver Foundation ............................................................... 73 HLC@Metro, Inc. .................................................................................................................... 91 Required Supplementary Information ............................................................................................... 101 Independent Auditors’ Report on Internal Control over Financial Reporting and on Compliance and Other Matters Based on an Audit of Financial Statements Performed in Accordance with Government Auditing Standards ................................................ 106 Required Communications to Legislative Audit Committee .............................................................. 108 METROPOLITAN STATE UNIVERSITY OF DENVER REPORT SUMMARY (UNAUDITED) YEARS ENDED JUNE 30, 2019 AND 2018 Purpose and Scope The Office of the State Auditor of the State of Colorado engaged Plante & Moran, PLLC (Plante Moran) to conduct a financial and compliance audit of the Metropolitan State University of Denver (formerly, the Metropolitan State College of Denver) (the University) for the year ended June 30, 2019. Plante Moran performed this audit in accordance with auditing standards generally accepted in the United States of America and the standards applicable to financial audits contained in Government Auditing Standards, issued by the Comptroller General of the United States. Plante Moran conducted the related fieldwork from June 2019 to October 2019. The purpose and scope of Plante Moran’s audit were to: Express an opinion on the financial statements of the University as of and for the year ended June 30, 2019. This includes a report on internal control over financial reporting and compliance and other matters based on the audit of the financial statements performed in accordance with Government Auditing Standards. Perform tests of the University’s compliance with certain provisions of laws, regulations, contracts, grant agreements, and other matters, as it relates to financial reporting. The University’s schedule of expenditures of federal awards and applicable opinions thereon, issued by the Office of the State Auditor, State of Colorado, are included in the June 30, 2019 Statewide Single Audit Report issued under separate cover. Audit Opinion and Reports Plante Moran expressed an unmodified opinion on the University’s financial statements as of and for the year ended June 30, 2019. Plante Moran issued a report on the University’s compliance and internal control over financial reporting based on an audit of the basic financial statements performed in accordance with Government Auditing Standards. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. A material weakness is a deficiency, or combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected on a timely basis. A significant deficiency is a deficiency or a combination of deficiencies in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance. Plante Moran noted no matters involving the internal control over financial reporting and its operation that Plante Moran considers to be material weaknesses and three matters that Plante Moran considers to be significant deficiencies, as noted in the report on internal control over financial reporting and compliance and other matters based on the audit of the financial statements performed in accordance with Government Auditing Standards, located on page 106. Summary of Findings and Recommendations The University has three findings that are considered sensitive in nature related to information technology general controls and are outlined further in the report on internal control over financial reporting and compliance and other matters based on the audit of the financial statements performed in accordance with Government Auditing Standards located on page 106. Government Auditing Standards allow for information that is considered sensitive in nature, such as detailed information related to information technology system security, to be issued through a separate “classified or limited use” report. This is due to the potential damage that could be caused by the misuse of that information. 1 METROPOLITAN STATE UNIVERSITY OF DENVER REPORT SUMMARY (UNAUDITED) YEARS ENDED JUNE 30, 2019 AND 2018 Plante Moran considers the specific technical details of these three findings to be sensitive in nature and not appropriate for public disclosure. Therefore, the details of the summarized findings have been provided to the University. A summary of the recommendations for the above findings is included in the Recommendation Locator on page 3. The Recommendation Locator also shows the University’s responses to the audit recommendations. Summary of Progress in Implementing Prior Year Audit Recommendations The audit report for the year ended June 30, 2018 included three findings and recommendations. The first and second findings were partially implemented. The third finding was fully implemented. A detailed description of the progress on the audit comments and recommendations are contained in the disposition of prior audit recommendations section located on page 8. 2 METROPOLITAN STATE UNIVERSITY OF DENVER RECOMMENDATION LOCATOR (UNAUDITED) YEARS ENDED JUNE 30, 2019 AND 2018 Recommendation University Implementation No. Page No. Recommendation Summary Response Date 1 5 The University should improve Agree June 30, 2020 information technology access controls. 2 7 The University should improve Agree February 1, change management information 2020 technology controls. 3 8 The University should update its Agree November 21, endpoint protection information 2019 technology controls.