Audit 396899

2025 001 Eligibility, Reporting (Financial) and Special Tests (Disbursements to or on Behalf of Students) Student Financial Assistance Cluster: U.S. Department of Education Federal Supplemental Educational Opportunity Grants (ALN 84.007) Federal Work Study Program (ALN 84.033) Federal Perkins Loans (ALN 84.038) Federal Pell Grant Program (ALN 84.063) Federal Direct Student Loans (ALN 84.268) U.S. Department of Health and Human Services (DHHS) Nurse Faculty Loan Program (ALN 93.264) Health Professions Student Loans, Including Primary Care Loans and Loans for Disadvantaged Students (ALN 93.342) Nursing Student Loans (ALN 93.364) DHHS Health Resources and Services Administration Scholarships for Health Professions Students from Disadvantaged Backgrounds (ALN 93.925) Federal Grant Numbers: E P007A252602 (7/1/2024 – 6/30/2025), E P033A252602 (7/1/2024 – 6/30/2025), E P038A132602 (7/1/2024 – 6/30/2025), E P063P250272 (7/1/2024 – 6/30/2025), P268K260272 (7/1/2024 – 6/30/2025), E-01HP28821-02-02, E-01HP31830-01-00,(7/1/2024 – 6/30/2025), E4CHP42498-01-00 (7/1/2024 – 6/30/2025), E26HP25750, E36HP25751, E11HP27284, E36HP26092, E36HP25751, E26HP25748 (7/1/2024 – 6/30/2025) Statistically valid sample: The sample was not intended to be, and was not, a statistically valid sample. Repeat finding: Yes (2023-001 and 2024-001) Finding Type: Material weakness Criteria: 2 CFR section 200.303 requires that non-federal entities receiving federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure federal expenditures are accurately reported on the Schedule and information provided for audit purposes is complete and accurate. Condition and Context: During fiscal year 2023, the University implemented a new system called Oracle Student Financial Planning (OSFP) which is used to package the students’ financial aid. The system performs the following functions: • Determines eligibility of students using various inputs, including information obtained from the Federal Student Aid Record and student enrollment and demographic information. This information is also used to calculate the cost of attendance, calculated need and the federal award amounts. • Disburses student financial assistance to students. • Reports disbursement information to the Common Origination and Disbursement system. The internal controls over these functions are considered automated controls for the applicable compliance requirements. In order to gain comfort over the automated application controls, we tested the design of the applicable information technology general controls particularly in the areas of logical access and program changes. During our testwork, it was noted that the University’s standard policies and procedures to monitor appropriate user access and program changes were not followed. Related to user access, in fiscal year 2025, the University created a provisioning and deprovisioning process for all access changes to OSFP during fiscal year 2025. The University also implemented a policy to perform an access review and certification for the OSFP system annually. Evidence of the review was documented, however the review did not include all individuals with access to OSFP, certain roles within the system were not recertified and certain users were recertifying their own access. In addition, there was no user log to document that a person who should be removed from the system, was removed. Related to program changes, certain individuals have privileged access to OSFP, however, the roles were not defined. A review was not performed to determine if the access is necessary, access is commensurate with the individual’s job responsibilities and to ensure that a user does not hold multiple roles within the system. In addition, the change management process was not consistently followed for all changes to the OSFP system. Cause: The system was new in fiscal year 2023 and the University’s standard policies and procedures were not followed for the system upon implementation. In fiscal year 2024 and continuing through fiscal year 2025, the University began to implement the standard policies and procedures, however, they were not in effect for the entire current fiscal year. Effect: As the general information technology controls over the OSFP system were determined to be ineffective, the related downstream key application controls could not be relied upon or tested. Such key application controls include: calculation of a student’s need, calculation and application of cost of attendance, determination of a student’s eligibility to receive federal and state awards and calculation of awards based on a student’s need and cost of attendance. Additionally, there were no manual controls over these key compliance areas to mitigate the inability to rely upon the application controls. Questioned Costs: No questioned costs were noted as a result of the audit procedures performed as the finding was related only to internal controls and not to noncompliance. Recommendation: We recommend that the University continue to implement all standard policies and procedures for general information technology controls for this system, including those related to logical access and program changes. Related to user access, we recommend that the University enhance the user access review policy to ensure that all individuals and roles are recertified, users are not recertifying their own access, and to create a user log to document that a person who should be removed from the system was removed. Related to change management, we recommend that the University review these roles and their related definitions to determine if they are necessary, if the related user’s access is commensurate with the user’s job responsibilities and ensure that a user does not hold multiple roles within the system. The University should also ensure that the change management process is consistently followed for all changes to the OSFP system and that users cannot create, approve, and close tickets related to OSFP. Views of Responsible Official: Management agrees with the finding. Since the audit period, the University has strengthened governance and oversight over OSFP by formalizing access controls and reinforcing monitoring practices. Management has established and documented OSFP system roles and responsibilities. A review of user access was performed to ensure alignment with job responsibilities, and users holding multiple or incompatible roles were corrected. In addition, the University implemented an audit log to track user provisioning and deprovisioning activity, providing documented evidence of access changes and removals. The University has also enhanced its change management process to ensure that all updates to OSFP follow the documented change management procedures. These measures collectively strengthen logical access and change management controls and support effective internal control over system operations. Management will continue to monitor the effectiveness of these controls.