Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.
Statistically Valid Sample
The sample was not intended to be, and was not, a statistically valid sample.
Identification of whether the audit finding is a repeat of a finding in the immediately prior audit.
This is not a repeat finding.
Recommendation
We recommend that management implement appropriate controls and processes which include proper logical access controls over relevant IT systems within the review and approval process, or implement manual controls to evidence management’s review and approval of expenditures incurred.
Management’s Response
During fiscal year 2023, Arkansas Children’s implemented an automated tool that allows us to monitor and audit general IT controls going forward over logical access to the relevant systems. We have also strengthened our controls around provisioning and deprovisioning through formalization of our policies around privileged access and have implemented continuous auditing of sensitive roles.
As the automated controls were not in place during the full fiscal year, and therefore not tested during the audit, in fiscal year 2024 Arkansas Children’s implemented temporary manual controls and processes.
These controls support the review and approval of expenditures monthly to verify that they are allowable,
incurred within the designated period of performance and incurred prior to reimbursement.