State University of New York 2011 Audit Committee Presentation October 28, 2011 kpmg

1. State University of New York2011 Audit Committee PresentationOctober 28, 2011kpmg.com

2. KPMG LLP is a Delaware limited liability partnership, the U.S. member firm of KPMG International Cooperative (�KPMG International�), a Swiss entity. Telephone +1 518 427 4600 Internet www.us.kpmg.com KPMG LLP 515 Broadway Albany, NY 12207-2974 October 25, 2011 The Members of the Audit Committee of the State University of New York: This presentation has been prepared for our meeting with the State University of New York�s (SUNY) Audit Committee on October 28, 2011. Included are required communications of the scope and the preliminary results of our audit of SUNY�s financial statements as of and for the year ended June 30, 2011. In addition, we have provided control enhancement observations, status of other deliverables and an update on new accounting matters SUNY will face in future years. We are pleased to have the opportunity to meet with the members of the Audit Committee to review this information and any other matters of interest. Very truly yours, KPMG LLP Jane H. LettsPartner

3. Table of Contents Executive Summary Deliverables KPMG Responsibilities Under GAAS Consideration of Fraud Summary of SUNY�s Components Results of Substantive Testing to Date Open Areas Required Communications Preliminary Management Letter Comments Preliminary Audit Differences Other Matters

4. Executive Summary Financial Statements Plan to issue an unqualified opinion for the year ended June 30, 2011, subject to completion of final audit procedures. Significant disclosures for 2011: Acquisition of the Long Island College Hospital, footnote 1. As outlined in footnote 13 to the financial statements, several events subsequent to the financial statement date have been disclosed. Management Cooperation We received full cooperation from management and had no disagreements on accounting, reporting or disclosure matters. Internal Controls We did not identify any material weaknesses or significant deficiencies in internal control over financial reporting. We did identify certain control deficiencies and other observations that will be reported in a management letter. Independence To the best of our knowledge, there are no circumstances or relationships between KPMG and SUNY which would impair our independence in reporting on SUNY�s financial statements. Required Communications Our responsibility for communicating with the Audit Committee, as required by our professional standards, is outlined in our Required Communications, other than as contained in this report, we have no matters of significance to address with the Audit Committee at this time.

5. Deliverables Audit Plan, delivered in May, 2011 Auditors� report on the basic financial statements Auditors� report on internal control and compliance Management Letter Letter to the Audit Committee fulfilling our requirements under SAS No. 114, Communications With Those Charged With Governance

6. KPMG Responsibilities Under GAAS Our Responsibilities under GAAS: We have a responsibility to conduct our audit in accordance with generally accepted auditing standards. In carrying out this responsibility, we planned and performed the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether caused by error or fraud. Because of the nature of audit evidence and the characteristics of fraud, we are to obtain reasonable, not absolute, assurance that material misstatements are detected. We have no responsibility to plan and perform the audit to obtain reasonable assurance that misstatements, whether caused by error or fraud, that are not material to the financial statements are detected.� In addition, in planning and performing our audit, we considered internal control over financial reporting in order to determine our auditing procedures for the purpose of expressing our opinion on the financial statements. An audit does not include examining the effectiveness of internal control and does not provide assurance on internal control. However, our internal control testwork to date did not identify any deficiencies in internal control over financial reporting that we consider to be material weaknesses.

7. Consideration of Fraud �The auditor has a responsibility to plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether caused by error or fraud� We addressed on our professional responsibility by executing the following procedures: Management interviews and discussions including existing management fraud controls Interviews with staff level and management employees Review of journal entries, including large, unusual and non-recurring journal entries Assess potential illegal acts or fraud allegations Consideration of the following risks in the performance of our substantive procedures: Internal pressures Third party pressures Related party transactions Manual journal entries Management bias Based upon our inquiries and testing to date, no financial statement fraud came to our attention for the period ending June 30, 2011.

8. Summary of SUNY�s Components

9. Results of Substantive Testing to Date

10. Open Areas SUNY�s acquisition of the Long Island College Hospital: Examination of LICH�s final audited financial statements. Review SUNY�s determination for inclusion of newly created separate legal corporations (LICH Holding Corporation and Staffco) in SUNY�s reporting entity. Determine the adequacy of footnote disclosures. Review of legal documentation to determine: Assets to be received by SUNY. Assets to be received by LICH Holding Corporation. Liabilities to be assumed by SUNY. Assets and liabilities to be placed in legal trusts. Future commitments and contingencies. Completion Procedures: Down to date inquiries Final analytical procedures Review of final financial statements, including KPMG�s national office. Formalize conclusions on non-gaap accounting policies, passed audit differences and control deficiencies/observations. Management representation letter

11. Required Communications

12. Required Communications (continued)

13. Required Communications (continued)

14. Required Communications (continued)

15. Required Communications (continued)

16. Preliminary Management Letter Comments

17. Preliminary Management Letter Comments (continued) Control Deficiencies Campus Cash Reconciliations � cash reconciliations were prepared for each account, however, we noted the existence of stale reconciling items. Review of SAS 70s � SUNY�s campuses utilize third party service organizations to perform student loan account administration functions. We noted that certain SUNY campus personnel did not obtain and review service organization SAS 70s. User Access Rights Reviews � periodic user access reviews are currently not being performed. System Backups � regular backups are performed, however, we were unable to determine the operating effectiveness of this control as documentation is not retained beyond 3 months. Testing of Disaster Recovery Plan � no disaster recovery tests were performed during the current year that could be used to prove the recoverability of CAS Mainframe application. Observations Password Configurations � password settings are configured to enforce passwords of minimum 5 characters length. We believe that at a minimum 8 characters should be present for a strong password. Emergency Changes � follow the same process as normal program changes; however the policy and procedure document for program changes does not specifically define emergency changes and the policies related to those changes. Timeliness of Component Reporting � SUNY�s financial reporting process is dependent upon information supplied by other organizations. In order to prepare SUNY�s June 30th year-end financial statements, they require final audited financial statements from the Long Island College Hospital. To date these audited statements have not been supplied to SUNY. Additionally, The University Hospital of Brooklyn Foundation has not completed their financial audit for the period ending July 31, 2010. These financial statements are required to be included in the Foundation financial statements of SUNY.

18. Preliminary Audit Differences We have identified the following audit differences which we are currently in the process of quantifying: Accrued Interest SUNY records debt information supplied by DASNY at March 31, 2011. Accordingly, accrued interest expense is understated for the 3-month period April 1st to June 30th. This error is expected to have an inconsequential impact to net assets as a corresponding understatement in State appropriation revenue/receivable exists. There were no debt issuances or repayments made during the April 1st to June 30th timeframe. Capital Assets/Deposits with Trustees SUNY records capital asset information for educational facilities and residence hall facilities as of March 31st. As a result, capital spending from April 1st to June 30th is excluded from the financial statements. The offset to the understatement of capital assets is an almost equal offset in deposits held with trustees. We expect this to have an inconsequential impact to net assets. Summer Tuition SUNY defers all summer tuition. Accordingly, summer tuition related to the periods on or before June 30th has been recognized in the subsequent reporting period. As this accounting policy is consistently applied year over year, the rollover impact is expected to be inconsequential to net assets.

19. Other Matters Consideration Items for the 2012 Audit: Upstate Medical Center�s acquisition of Community General Hospital The State-wide implementation of SFS. New accounting standards: GASB Statement No. 60, Accounting and Financial Reporting for Service Concession Arrangements GASB Statement No. 61, The Financial Reporting Entity: Omnibus, an amendment of GASB Statement No. 14 and No. 34 GASB Statement No. 62, Codification of Accounting and Financial Reporting Guidance Contained in Pre-November 30, 1989 FASB and AICPA Pronouncements GASB Statement No. 63, Financial Reporting of Deferred Outflows of Resources, Deferred Inflows of Resources and Net Position

20. � 2011 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (�KPMG International�), a Swiss entity. All rights reserved. 71814NYO The KPMG name, logo and �cutting through complexity� are registered trademarks or trademarks of KPMG International.