State Agency: Higher Education Services Corporation
Single Audit Contact: Dora Diaz-Crowe
Title: Director, Audit Division
Telephone: (518) 474-8893
E-mail Address: dora.diaz-crowe@hesc.ny.gov
Federal Program(s) (ALN # [s]): Federal Family Education Loans (Guaranty Agencies)
(84.032)
Audit Report Ref...
State Agency: Higher Education Services Corporation
Single Audit Contact: Dora Diaz-Crowe
Title: Director, Audit Division
Telephone: (518) 474-8893
E-mail Address: dora.diaz-crowe@hesc.ny.gov
Federal Program(s) (ALN # [s]): Federal Family Education Loans (Guaranty Agencies)
(84.032)
Audit Report Reference: 2023-009
Corrective Action Planned:
Higher Education Services Corporation (HESC) assumes full responsibility for ensuring employees are offboarded timely and will ensure prompt notification to Information Technology Services (ITS) to deprovision these accounts occur timely. Internally, we will work to develop a process, with procedures, to ensure the notification meets a set timeframe. While we have no control over when or how ITS performs the deprovisioning, we will include a procedure to confirm the deprovisioning has occurred as requested. HESC will work with ITS to develop a timeline for deprovisioning and include a procedure to confirm the deprovisioning has occurred within the timeframe.
While HESC did not perform a periodic user access review over the Guaranteed Student Loans (GSL), HESC performed this process manually until a decision was made to automate the process. Forced by the pandemic, that system was not available until May 2023; one month after the audit scope. HESC conducted the recertifications, using the new system, in late May and early June 2023.
Going forward, we will establish a process, including written procedures, to perform periodic access reviews over our systems with ITS. We will assign responsibility for this task either to Internal Audit or the Internal Controls Unit.
The Electronic Financial Network (EFAN) procedures was provided detailing out how these users would be granted access. EFAN established the rules for external constituents accessing HESC systems. The provisioning of access to view the screens was handled through ITS Accounts Management; access was read-only thereby ensuring no data could be overwritten. Additionally, if a user did not access the system within a certain time, their access was automatically terminated.
Given that HESC has exited the FFELP, we will no longer be involved with external users accessing the DMCS application and the issue related to this application will no longer exist.