CAP for Finding: 2022-007 Planned Corrective Action: The UW System has adequate processes in place for reviewing access to ShopUW+ but agrees to better document these processes. UW System Administration (UWSA) has revised the disbursement internal control template, which all UW universities use in d...
CAP for Finding: 2022-007 Planned Corrective Action: The UW System has adequate processes in place for reviewing access to ShopUW+ but agrees to better document these processes. UW System Administration (UWSA) has revised the disbursement internal control template, which all UW universities use in developing their internal control plans, to document the UW System?s security reviews. UWSA will also update the language surrounding its weekly access reports, to explain their purpose and importance. To monitor this control, the UW System will add a statement to this effect in the universities? annual delegation agreement and certifications. UWSA is actively taking steps to mature its third-party risk management practices, including the development of guidance and best practices for UW universities. Current efforts are focused on optimizing available resources to provide the highest return on value. UWSA currently performs periodic reviews of cloud-based third-party internal controls during precontract evaluations and at the time of contract renewals. This includes obtaining and reviewing service organization audit reports, if available. UWSA will evaluate the efficacy of increasing the periodicity of these reviews to an annual basis. UWSA will also evaluate means for communicating identified expectations systemwide, up to and including the creation of a new policy. Anticipated Completion Date: June 30, 2023 Person responsible for corrective action: Julie Gordon, Senior Associate Vice President Finance, UW System Administration jgordon@uwsa.edu