Material Weakness in Internal Control over Compliance 10.558 – Child and Adult Care Food Program Commonwealth of Pennsylvania, Department of Education Contract Number: 359-46-477-8 Condition: Based on the Commonwealth of Pennsylvania, Office of the Budget, Bureau of Audits (Commonwealth) review of C...
Material Weakness in Internal Control over Compliance 10.558 – Child and Adult Care Food Program Commonwealth of Pennsylvania, Department of Education Contract Number: 359-46-477-8 Condition: Based on the Commonwealth of Pennsylvania, Office of the Budget, Bureau of Audits (Commonwealth) review of CBS Food Program's financial accounting system, it was noted that the Food Program utilizes QuickBooks software for their accounting system. Based on inquiry with CBS Food Program management, we determined internal controls connected with their QuickBooks accounting software were insufficient in the following areas: - User Access Management: Formal written policies or procedures have not been developed and implemented related to access authorization, access monitoring, and removal of system access. Additionally, certain functions are not properly segregated as users have access to perform both input and authorization of transactions. - Input Management: Formal written policies or procedures to ensure information input into QuickBooks is appropriate and accurate have not been developed and implemented. - Change Control Management: A formal written change management policy for QuickBooks Accounting System has not been developed and implemented including requirements that system security updates are implemented timely. - Backup and Recovery: A formal written policy for regular backup and recovery testing has not been developed and implemented. Recommendation: We recommend that CBS Food Program develop and implement comprehensive written internal control policies and procedures connected with their QuickBooks Accounting System. This should include: - Development and utilization of an Accounting Manual which includes an outline of CBS Food Program's accounting rules, procedures, and guidelines. - Access control policies and procedures to ensure that user access to QuickBooks is appropriate, regularly reviewed and promptly revoked upon termination or when otherwise merited. - A formal written change management policy for QuickBooks should be developed and implemented including requirements that systems security updates are implemented timely. - A disaster recovery plan and procedures to perform periodic testing to ensure that plans are functional and mitigate the risk of extended downtime. This process should also include regular review of backup records to ensure they are appropriately created and maintained. Repeat Finding: Yes Explanation of Disagreement with Audit Finding There is no disagreement with the audit finding. Action taken in response to finding: CBS Food Program will review all users of its new QuickBooks Online platform, document each user, and assign access based on job responsibilities and established best practices. Written procedures will address the timely removal or reassignment of access following terminations or role changes and will be incorporated into the applicable human resources checklists. CBS Food Program will also coordinate with QuickBooks support to identify security updates that may affect financial processes and establish procedures and defined timelines for implementing those updates. In addition, CBS Food Program will develop a disaster recovery plan and procedures for testing backups at least annually, or every 180 days if deemed appropriate, to confirm that backup records are created accurately and maintained properly. Community Benefit Solutions will also develop an accounting manual documenting standard practices for all accounting functions. Planned completion date for corrective action plan: June 30, 2026