General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-113, 2017-119, 2016-109 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Southern University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always ensure that (1) access to modify information and process transactions in the student information system and (2) administrative access at the network level was limited to only current employees and users who needed that access based on their job responsibilities. The University had a process to review user access to its systems; however, it did not always implement changes based on the results of that review. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made to those systems. Recommendation: The University should ensure that user access to its student information system and administrative access to its network is appropriately limited to employees based on current job responsibilities. Views of Responsible Officials: The Office of Technology acknowledges and agrees with the finding.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Tech University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate level of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-142 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. Specifically, a user was granted administrative access in the student information system, which included the ability to modify information and process transactions, such as authorizing and disbursing aid. The University did not remove the administrative access after the user’s specific job responsibilities no longer required that level of access. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: To the point that The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. OIT and Financial Aid acknowledge that a user was given elevated access that was not removed when the assigned maintenance task was completed.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Austin (University) did not appropriately restrict user access to its student information system. Specifically, an employee retained the ability to modify student financial aid awards after transitioning from the Office of Student Financial Aid to another department within the University. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, one of the University’s departments did not enable the control designed to prevent developers from migrating their own code changes into production. Not having sufficient segregation of duties controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate segregation of duties. Views of Responsible Officials: The University acknowledges and agrees with the finding. In this case, the employee transitioned from the Office of Scholarships and Financial Aid (OSFA) to the Student Financial Aid implementation project. It was intended for this employee to retain his prior access for a time so he could help provide backstop support while his duties were transitioned to other employees within OSFA. This access should have been removed once his duties were successfully transitioned. Views of Responsible Officials: The University acknowledges and agrees with the finding. However, technical limitations in the current financial aid management system require that a particular mainframe programming library be exempted from the change control mechanisms that are used in all other libraries that can update student financial aid information.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas Permian Basin (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to implement further access limitations and enhanced its periodic review of access.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Sam Houston State University (University) did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate levels of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, 1 (14 percent) of 7 changes tested lacked documentation showing that the change was properly tested or validated before it was migrated to production. Not having sufficient controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate validation of changes prior to implementation. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-113, 2017-119, 2016-109 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Southern University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always ensure that (1) access to modify information and process transactions in the student information system and (2) administrative access at the network level was limited to only current employees and users who needed that access based on their job responsibilities. The University had a process to review user access to its systems; however, it did not always implement changes based on the results of that review. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made to those systems. Recommendation: The University should ensure that user access to its student information system and administrative access to its network is appropriately limited to employees based on current job responsibilities. Views of Responsible Officials: The Office of Technology acknowledges and agrees with the finding.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Tech University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate level of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-142 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. Specifically, a user was granted administrative access in the student information system, which included the ability to modify information and process transactions, such as authorizing and disbursing aid. The University did not remove the administrative access after the user’s specific job responsibilities no longer required that level of access. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: To the point that The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. OIT and Financial Aid acknowledge that a user was given elevated access that was not removed when the assigned maintenance task was completed.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Austin (University) did not appropriately restrict user access to its student information system. Specifically, an employee retained the ability to modify student financial aid awards after transitioning from the Office of Student Financial Aid to another department within the University. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, one of the University’s departments did not enable the control designed to prevent developers from migrating their own code changes into production. Not having sufficient segregation of duties controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate segregation of duties. Views of Responsible Officials: The University acknowledges and agrees with the finding. In this case, the employee transitioned from the Office of Scholarships and Financial Aid (OSFA) to the Student Financial Aid implementation project. It was intended for this employee to retain his prior access for a time so he could help provide backstop support while his duties were transitioned to other employees within OSFA. This access should have been removed once his duties were successfully transitioned. Views of Responsible Officials: The University acknowledges and agrees with the finding. However, technical limitations in the current financial aid management system require that a particular mainframe programming library be exempted from the change control mechanisms that are used in all other libraries that can update student financial aid information.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas Permian Basin (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to implement further access limitations and enhanced its periodic review of access.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Sam Houston State University (University) did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate levels of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, 1 (14 percent) of 7 changes tested lacked documentation showing that the change was properly tested or validated before it was migrated to production. Not having sufficient controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate validation of changes prior to implementation. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-113, 2017-119, 2016-109 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Southern University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always ensure that (1) access to modify information and process transactions in the student information system and (2) administrative access at the network level was limited to only current employees and users who needed that access based on their job responsibilities. The University had a process to review user access to its systems; however, it did not always implement changes based on the results of that review. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made to those systems. Recommendation: The University should ensure that user access to its student information system and administrative access to its network is appropriately limited to employees based on current job responsibilities. Views of Responsible Officials: The Office of Technology acknowledges and agrees with the finding.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Tech University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate level of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-142 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. Specifically, a user was granted administrative access in the student information system, which included the ability to modify information and process transactions, such as authorizing and disbursing aid. The University did not remove the administrative access after the user’s specific job responsibilities no longer required that level of access. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: To the point that The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. OIT and Financial Aid acknowledge that a user was given elevated access that was not removed when the assigned maintenance task was completed.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Austin (University) did not appropriately restrict user access to its student information system. Specifically, an employee retained the ability to modify student financial aid awards after transitioning from the Office of Student Financial Aid to another department within the University. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, one of the University’s departments did not enable the control designed to prevent developers from migrating their own code changes into production. Not having sufficient segregation of duties controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate segregation of duties. Views of Responsible Officials: The University acknowledges and agrees with the finding. In this case, the employee transitioned from the Office of Scholarships and Financial Aid (OSFA) to the Student Financial Aid implementation project. It was intended for this employee to retain his prior access for a time so he could help provide backstop support while his duties were transitioned to other employees within OSFA. This access should have been removed once his duties were successfully transitioned. Views of Responsible Officials: The University acknowledges and agrees with the finding. However, technical limitations in the current financial aid management system require that a particular mainframe programming library be exempted from the change control mechanisms that are used in all other libraries that can update student financial aid information.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas Permian Basin (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to implement further access limitations and enhanced its periodic review of access.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Austin (University) did not appropriately restrict user access to its student information system. Specifically, an employee retained the ability to modify student financial aid awards after transitioning from the Office of Student Financial Aid to another department within the University. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, one of the University’s departments did not enable the control designed to prevent developers from migrating their own code changes into production. Not having sufficient segregation of duties controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate segregation of duties. Views of Responsible Officials: The University acknowledges and agrees with the finding. In this case, the employee transitioned from the Office of Scholarships and Financial Aid (OSFA) to the Student Financial Aid implementation project. It was intended for this employee to retain his prior access for a time so he could help provide backstop support while his duties were transitioned to other employees within OSFA. This access should have been removed once his duties were successfully transitioned. Views of Responsible Officials: The University acknowledges and agrees with the finding. However, technical limitations in the current financial aid management system require that a particular mainframe programming library be exempted from the change control mechanisms that are used in all other libraries that can update student financial aid information.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Sam Houston State University (University) did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate levels of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, 1 (14 percent) of 7 changes tested lacked documentation showing that the change was properly tested or validated before it was migrated to production. Not having sufficient controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate validation of changes prior to implementation. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-113, 2017-119, 2016-109 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Southern University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always ensure that (1) access to modify information and process transactions in the student information system and (2) administrative access at the network level was limited to only current employees and users who needed that access based on their job responsibilities. The University had a process to review user access to its systems; however, it did not always implement changes based on the results of that review. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made to those systems. Recommendation: The University should ensure that user access to its student information system and administrative access to its network is appropriately limited to employees based on current job responsibilities. Views of Responsible Officials: The Office of Technology acknowledges and agrees with the finding.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Tech University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate level of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-142 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. Specifically, a user was granted administrative access in the student information system, which included the ability to modify information and process transactions, such as authorizing and disbursing aid. The University did not remove the administrative access after the user’s specific job responsibilities no longer required that level of access. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: To the point that The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. OIT and Financial Aid acknowledge that a user was given elevated access that was not removed when the assigned maintenance task was completed.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Austin (University) did not appropriately restrict user access to its student information system. Specifically, an employee retained the ability to modify student financial aid awards after transitioning from the Office of Student Financial Aid to another department within the University. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, one of the University’s departments did not enable the control designed to prevent developers from migrating their own code changes into production. Not having sufficient segregation of duties controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate segregation of duties. Views of Responsible Officials: The University acknowledges and agrees with the finding. In this case, the employee transitioned from the Office of Scholarships and Financial Aid (OSFA) to the Student Financial Aid implementation project. It was intended for this employee to retain his prior access for a time so he could help provide backstop support while his duties were transitioned to other employees within OSFA. This access should have been removed once his duties were successfully transitioned. Views of Responsible Officials: The University acknowledges and agrees with the finding. However, technical limitations in the current financial aid management system require that a particular mainframe programming library be exempted from the change control mechanisms that are used in all other libraries that can update student financial aid information.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas Permian Basin (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to implement further access limitations and enhanced its periodic review of access.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Sam Houston State University (University) did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate levels of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, 1 (14 percent) of 7 changes tested lacked documentation showing that the change was properly tested or validated before it was migrated to production. Not having sufficient controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate validation of changes prior to implementation. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-113, 2017-119, 2016-109 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Southern University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always ensure that (1) access to modify information and process transactions in the student information system and (2) administrative access at the network level was limited to only current employees and users who needed that access based on their job responsibilities. The University had a process to review user access to its systems; however, it did not always implement changes based on the results of that review. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made to those systems. Recommendation: The University should ensure that user access to its student information system and administrative access to its network is appropriately limited to employees based on current job responsibilities. Views of Responsible Officials: The Office of Technology acknowledges and agrees with the finding.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Tech University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate level of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-142 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. Specifically, a user was granted administrative access in the student information system, which included the ability to modify information and process transactions, such as authorizing and disbursing aid. The University did not remove the administrative access after the user’s specific job responsibilities no longer required that level of access. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: To the point that The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. OIT and Financial Aid acknowledge that a user was given elevated access that was not removed when the assigned maintenance task was completed.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Austin (University) did not appropriately restrict user access to its student information system. Specifically, an employee retained the ability to modify student financial aid awards after transitioning from the Office of Student Financial Aid to another department within the University. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, one of the University’s departments did not enable the control designed to prevent developers from migrating their own code changes into production. Not having sufficient segregation of duties controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate segregation of duties. Views of Responsible Officials: The University acknowledges and agrees with the finding. In this case, the employee transitioned from the Office of Scholarships and Financial Aid (OSFA) to the Student Financial Aid implementation project. It was intended for this employee to retain his prior access for a time so he could help provide backstop support while his duties were transitioned to other employees within OSFA. This access should have been removed once his duties were successfully transitioned. Views of Responsible Officials: The University acknowledges and agrees with the finding. However, technical limitations in the current financial aid management system require that a particular mainframe programming library be exempted from the change control mechanisms that are used in all other libraries that can update student financial aid information.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas Permian Basin (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to implement further access limitations and enhanced its periodic review of access.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Sam Houston State University (University) did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate levels of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, 1 (14 percent) of 7 changes tested lacked documentation showing that the change was properly tested or validated before it was migrated to production. Not having sufficient controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate validation of changes prior to implementation. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-113, 2017-119, 2016-109 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Southern University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always ensure that (1) access to modify information and process transactions in the student information system and (2) administrative access at the network level was limited to only current employees and users who needed that access based on their job responsibilities. The University had a process to review user access to its systems; however, it did not always implement changes based on the results of that review. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made to those systems. Recommendation: The University should ensure that user access to its student information system and administrative access to its network is appropriately limited to employees based on current job responsibilities. Views of Responsible Officials: The Office of Technology acknowledges and agrees with the finding.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Tech University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate level of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-142 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. Specifically, a user was granted administrative access in the student information system, which included the ability to modify information and process transactions, such as authorizing and disbursing aid. The University did not remove the administrative access after the user’s specific job responsibilities no longer required that level of access. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: To the point that The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. OIT and Financial Aid acknowledge that a user was given elevated access that was not removed when the assigned maintenance task was completed.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas Permian Basin (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to implement further access limitations and enhanced its periodic review of access.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Tech University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate level of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-142 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. Specifically, a user was granted administrative access in the student information system, which included the ability to modify information and process transactions, such as authorizing and disbursing aid. The University did not remove the administrative access after the user’s specific job responsibilities no longer required that level of access. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: To the point that The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. OIT and Financial Aid acknowledge that a user was given elevated access that was not removed when the assigned maintenance task was completed.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Austin (University) did not appropriately restrict user access to its student information system. Specifically, an employee retained the ability to modify student financial aid awards after transitioning from the Office of Student Financial Aid to another department within the University. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, one of the University’s departments did not enable the control designed to prevent developers from migrating their own code changes into production. Not having sufficient segregation of duties controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate segregation of duties. Views of Responsible Officials: The University acknowledges and agrees with the finding. In this case, the employee transitioned from the Office of Scholarships and Financial Aid (OSFA) to the Student Financial Aid implementation project. It was intended for this employee to retain his prior access for a time so he could help provide backstop support while his duties were transitioned to other employees within OSFA. This access should have been removed once his duties were successfully transitioned. Views of Responsible Officials: The University acknowledges and agrees with the finding. However, technical limitations in the current financial aid management system require that a particular mainframe programming library be exempted from the change control mechanisms that are used in all other libraries that can update student financial aid information.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-142 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. Specifically, a user was granted administrative access in the student information system, which included the ability to modify information and process transactions, such as authorizing and disbursing aid. The University did not remove the administrative access after the user’s specific job responsibilities no longer required that level of access. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: To the point that The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. OIT and Financial Aid acknowledge that a user was given elevated access that was not removed when the assigned maintenance task was completed.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-113, 2017-119, 2016-109 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Southern University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always ensure that (1) access to modify information and process transactions in the student information system and (2) administrative access at the network level was limited to only current employees and users who needed that access based on their job responsibilities. The University had a process to review user access to its systems; however, it did not always implement changes based on the results of that review. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made to those systems. Recommendation: The University should ensure that user access to its student information system and administrative access to its network is appropriately limited to employees based on current job responsibilities. Views of Responsible Officials: The Office of Technology acknowledges and agrees with the finding.
Allowable Costs/Cost Principles – Cost Allocations, Matching, Level of Effort, Earmarking (CHIP Only) Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture U.S. Department of Education Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) Children’s Health Insurance Program (CHIP) Block Grants for Community Mental Health Services (MHBG) Block Grants for Prevention and Treatment of Substance Abuse (SABG) Medicaid Cluster Aging Cluster (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) SNAP Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 10.557 93.558 93.667 93.767 93.958 93.959 93.775, 93.777, 93.778 93.044, 93.045, 93.053 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 10.551, 10.561 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: WIC 6TX700527, 6TX700507 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2022 – September 30, 2024 TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 CHIP 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01 6B08TI083478- 01M002, 6B08TI083478-01M003, 6B08TI083478-01M004 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC’s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. HHSC experienced significant delays in updating factors. By the end of the fiscal year, cost allocations had been updated only through August 2022. Although there is no documented policy over when the FMAP should be updated, HHSC will allocate costs at the FMAP that is in effect at the time of the transaction and will reallocate the transactions using the FMAP in effect at the time of the reallocation. This procedure was not followed in 2023 when the costs for four of 40 sample allocations tested in the CHIP program were allocated using a rate other than the current one in effect resulting in noncompliance with matching requirements. Questioned costs: Unknown Context: See “Condition.” Cause: HHSC’s General Ledger Unit is responsible for cost allocations. At the start of fiscal year 2023, the Unit suffered a loss of more than half of its staff due to turnover. Additionally, the current Federal Medical Assistance Percentage (FMAP) rates were in a stepdown process whereby the rate changed quarterly as opposed to yearly which intensified the workload. In addition, since transformation, the number of Public Assistance Cost Allocation Plan (PACAP) methodologies (Project IDs) has increased by 243%. These methodologies have become increasingly more complex, now including over 80 dependent factors of which some comprise more than 100 fund sources each. This huge increase in both volume and complexity has greatly increased calculation labor and risk of error. Effect: Failure to update factor allocations timely can result in questioned costs. Repeat finding: 2022-010, 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should allocate adequate resources to ensure factor allocations are performed and reallocations are updated timely in order to present accurate information. Views of responsible officials: HHSC concurs with the finding.
Allowable Costs/Cost Principles – Cost Allocations, Matching, Level of Effort, Earmarking (CHIP Only) Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture U.S. Department of Education Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) Children’s Health Insurance Program (CHIP) Block Grants for Community Mental Health Services (MHBG) Block Grants for Prevention and Treatment of Substance Abuse (SABG) Medicaid Cluster Aging Cluster (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) SNAP Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 10.557 93.558 93.667 93.767 93.958 93.959 93.775, 93.777, 93.778 93.044, 93.045, 93.053 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 10.551, 10.561 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: WIC 6TX700527, 6TX700507 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2022 – September 30, 2024 TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 CHIP 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01 6B08TI083478- 01M002, 6B08TI083478-01M003, 6B08TI083478-01M004 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC’s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. HHSC experienced significant delays in updating factors. By the end of the fiscal year, cost allocations had been updated only through August 2022. Although there is no documented policy over when the FMAP should be updated, HHSC will allocate costs at the FMAP that is in effect at the time of the transaction and will reallocate the transactions using the FMAP in effect at the time of the reallocation. This procedure was not followed in 2023 when the costs for four of 40 sample allocations tested in the CHIP program were allocated using a rate other than the current one in effect resulting in noncompliance with matching requirements. Questioned costs: Unknown Context: See “Condition.” Cause: HHSC’s General Ledger Unit is responsible for cost allocations. At the start of fiscal year 2023, the Unit suffered a loss of more than half of its staff due to turnover. Additionally, the current Federal Medical Assistance Percentage (FMAP) rates were in a stepdown process whereby the rate changed quarterly as opposed to yearly which intensified the workload. In addition, since transformation, the number of Public Assistance Cost Allocation Plan (PACAP) methodologies (Project IDs) has increased by 243%. These methodologies have become increasingly more complex, now including over 80 dependent factors of which some comprise more than 100 fund sources each. This huge increase in both volume and complexity has greatly increased calculation labor and risk of error. Effect: Failure to update factor allocations timely can result in questioned costs. Repeat finding: 2022-010, 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should allocate adequate resources to ensure factor allocations are performed and reallocations are updated timely in order to present accurate information. Views of responsible officials: HHSC concurs with the finding.
Allowable Costs/Cost Principles – Cost Allocations, Matching, Level of Effort, Earmarking (CHIP Only) Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture U.S. Department of Education Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) Children’s Health Insurance Program (CHIP) Block Grants for Community Mental Health Services (MHBG) Block Grants for Prevention and Treatment of Substance Abuse (SABG) Medicaid Cluster Aging Cluster (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) SNAP Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 10.557 93.558 93.667 93.767 93.958 93.959 93.775, 93.777, 93.778 93.044, 93.045, 93.053 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 10.551, 10.561 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: WIC 6TX700527, 6TX700507 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2022 – September 30, 2024 TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 CHIP 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01 6B08TI083478- 01M002, 6B08TI083478-01M003, 6B08TI083478-01M004 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC’s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. HHSC experienced significant delays in updating factors. By the end of the fiscal year, cost allocations had been updated only through August 2022. Although there is no documented policy over when the FMAP should be updated, HHSC will allocate costs at the FMAP that is in effect at the time of the transaction and will reallocate the transactions using the FMAP in effect at the time of the reallocation. This procedure was not followed in 2023 when the costs for four of 40 sample allocations tested in the CHIP program were allocated using a rate other than the current one in effect resulting in noncompliance with matching requirements. Questioned costs: Unknown Context: See “Condition.” Cause: HHSC’s General Ledger Unit is responsible for cost allocations. At the start of fiscal year 2023, the Unit suffered a loss of more than half of its staff due to turnover. Additionally, the current Federal Medical Assistance Percentage (FMAP) rates were in a stepdown process whereby the rate changed quarterly as opposed to yearly which intensified the workload. In addition, since transformation, the number of Public Assistance Cost Allocation Plan (PACAP) methodologies (Project IDs) has increased by 243%. These methodologies have become increasingly more complex, now including over 80 dependent factors of which some comprise more than 100 fund sources each. This huge increase in both volume and complexity has greatly increased calculation labor and risk of error. Effect: Failure to update factor allocations timely can result in questioned costs. Repeat finding: 2022-010, 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should allocate adequate resources to ensure factor allocations are performed and reallocations are updated timely in order to present accurate information. Views of responsible officials: HHSC concurs with the finding.
Allowable Costs/Cost Principles – Cost Allocations, Matching, Level of Effort, Earmarking (CHIP Only) Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture U.S. Department of Education Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) Children’s Health Insurance Program (CHIP) Block Grants for Community Mental Health Services (MHBG) Block Grants for Prevention and Treatment of Substance Abuse (SABG) Medicaid Cluster Aging Cluster (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) SNAP Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 10.557 93.558 93.667 93.767 93.958 93.959 93.775, 93.777, 93.778 93.044, 93.045, 93.053 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 10.551, 10.561 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: WIC 6TX700527, 6TX700507 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2022 – September 30, 2024 TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 CHIP 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01 6B08TI083478- 01M002, 6B08TI083478-01M003, 6B08TI083478-01M004 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC’s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. HHSC experienced significant delays in updating factors. By the end of the fiscal year, cost allocations had been updated only through August 2022. Although there is no documented policy over when the FMAP should be updated, HHSC will allocate costs at the FMAP that is in effect at the time of the transaction and will reallocate the transactions using the FMAP in effect at the time of the reallocation. This procedure was not followed in 2023 when the costs for four of 40 sample allocations tested in the CHIP program were allocated using a rate other than the current one in effect resulting in noncompliance with matching requirements. Questioned costs: Unknown Context: See “Condition.” Cause: HHSC’s General Ledger Unit is responsible for cost allocations. At the start of fiscal year 2023, the Unit suffered a loss of more than half of its staff due to turnover. Additionally, the current Federal Medical Assistance Percentage (FMAP) rates were in a stepdown process whereby the rate changed quarterly as opposed to yearly which intensified the workload. In addition, since transformation, the number of Public Assistance Cost Allocation Plan (PACAP) methodologies (Project IDs) has increased by 243%. These methodologies have become increasingly more complex, now including over 80 dependent factors of which some comprise more than 100 fund sources each. This huge increase in both volume and complexity has greatly increased calculation labor and risk of error. Effect: Failure to update factor allocations timely can result in questioned costs. Repeat finding: 2022-010, 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should allocate adequate resources to ensure factor allocations are performed and reallocations are updated timely in order to present accurate information. Views of responsible officials: HHSC concurs with the finding.
Allowable Costs/Cost Principles – Cost Allocations, Matching, Level of Effort, Earmarking (CHIP Only) Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture U.S. Department of Education Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) Children’s Health Insurance Program (CHIP) Block Grants for Community Mental Health Services (MHBG) Block Grants for Prevention and Treatment of Substance Abuse (SABG) Medicaid Cluster Aging Cluster (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) SNAP Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 10.557 93.558 93.667 93.767 93.958 93.959 93.775, 93.777, 93.778 93.044, 93.045, 93.053 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 10.551, 10.561 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: WIC 6TX700527, 6TX700507 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2022 – September 30, 2024 TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 CHIP 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01 6B08TI083478- 01M002, 6B08TI083478-01M003, 6B08TI083478-01M004 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC’s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. HHSC experienced significant delays in updating factors. By the end of the fiscal year, cost allocations had been updated only through August 2022. Although there is no documented policy over when the FMAP should be updated, HHSC will allocate costs at the FMAP that is in effect at the time of the transaction and will reallocate the transactions using the FMAP in effect at the time of the reallocation. This procedure was not followed in 2023 when the costs for four of 40 sample allocations tested in the CHIP program were allocated using a rate other than the current one in effect resulting in noncompliance with matching requirements. Questioned costs: Unknown Context: See “Condition.” Cause: HHSC’s General Ledger Unit is responsible for cost allocations. At the start of fiscal year 2023, the Unit suffered a loss of more than half of its staff due to turnover. Additionally, the current Federal Medical Assistance Percentage (FMAP) rates were in a stepdown process whereby the rate changed quarterly as opposed to yearly which intensified the workload. In addition, since transformation, the number of Public Assistance Cost Allocation Plan (PACAP) methodologies (Project IDs) has increased by 243%. These methodologies have become increasingly more complex, now including over 80 dependent factors of which some comprise more than 100 fund sources each. This huge increase in both volume and complexity has greatly increased calculation labor and risk of error. Effect: Failure to update factor allocations timely can result in questioned costs. Repeat finding: 2022-010, 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should allocate adequate resources to ensure factor allocations are performed and reallocations are updated timely in order to present accurate information. Views of responsible officials: HHSC concurs with the finding.
Allowable Costs/Cost Principles – Cost Allocations, Matching, Level of Effort, Earmarking (CHIP Only) Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture U.S. Department of Education Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) Children’s Health Insurance Program (CHIP) Block Grants for Community Mental Health Services (MHBG) Block Grants for Prevention and Treatment of Substance Abuse (SABG) Medicaid Cluster Aging Cluster (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) SNAP Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 10.557 93.558 93.667 93.767 93.958 93.959 93.775, 93.777, 93.778 93.044, 93.045, 93.053 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 10.551, 10.561 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: WIC 6TX700527, 6TX700507 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2022 – September 30, 2024 TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 CHIP 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01 6B08TI083478- 01M002, 6B08TI083478-01M003, 6B08TI083478-01M004 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC’s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. HHSC experienced significant delays in updating factors. By the end of the fiscal year, cost allocations had been updated only through August 2022. Although there is no documented policy over when the FMAP should be updated, HHSC will allocate costs at the FMAP that is in effect at the time of the transaction and will reallocate the transactions using the FMAP in effect at the time of the reallocation. This procedure was not followed in 2023 when the costs for four of 40 sample allocations tested in the CHIP program were allocated using a rate other than the current one in effect resulting in noncompliance with matching requirements. Questioned costs: Unknown Context: See “Condition.” Cause: HHSC’s General Ledger Unit is responsible for cost allocations. At the start of fiscal year 2023, the Unit suffered a loss of more than half of its staff due to turnover. Additionally, the current Federal Medical Assistance Percentage (FMAP) rates were in a stepdown process whereby the rate changed quarterly as opposed to yearly which intensified the workload. In addition, since transformation, the number of Public Assistance Cost Allocation Plan (PACAP) methodologies (Project IDs) has increased by 243%. These methodologies have become increasingly more complex, now including over 80 dependent factors of which some comprise more than 100 fund sources each. This huge increase in both volume and complexity has greatly increased calculation labor and risk of error. Effect: Failure to update factor allocations timely can result in questioned costs. Repeat finding: 2022-010, 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should allocate adequate resources to ensure factor allocations are performed and reallocations are updated timely in order to present accurate information. Views of responsible officials: HHSC concurs with the finding.
Allowable Costs/Cost Principles – Cost Allocations, Matching, Level of Effort, Earmarking (CHIP Only) Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture U.S. Department of Education Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) Children’s Health Insurance Program (CHIP) Block Grants for Community Mental Health Services (MHBG) Block Grants for Prevention and Treatment of Substance Abuse (SABG) Medicaid Cluster Aging Cluster (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) SNAP Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 10.557 93.558 93.667 93.767 93.958 93.959 93.775, 93.777, 93.778 93.044, 93.045, 93.053 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 10.551, 10.561 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: WIC 6TX700527, 6TX700507 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2022 – September 30, 2024 TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 CHIP 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01 6B08TI083478- 01M002, 6B08TI083478-01M003, 6B08TI083478-01M004 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC’s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. HHSC experienced significant delays in updating factors. By the end of the fiscal year, cost allocations had been updated only through August 2022. Although there is no documented policy over when the FMAP should be updated, HHSC will allocate costs at the FMAP that is in effect at the time of the transaction and will reallocate the transactions using the FMAP in effect at the time of the reallocation. This procedure was not followed in 2023 when the costs for four of 40 sample allocations tested in the CHIP program were allocated using a rate other than the current one in effect resulting in noncompliance with matching requirements. Questioned costs: Unknown Context: See “Condition.” Cause: HHSC’s General Ledger Unit is responsible for cost allocations. At the start of fiscal year 2023, the Unit suffered a loss of more than half of its staff due to turnover. Additionally, the current Federal Medical Assistance Percentage (FMAP) rates were in a stepdown process whereby the rate changed quarterly as opposed to yearly which intensified the workload. In addition, since transformation, the number of Public Assistance Cost Allocation Plan (PACAP) methodologies (Project IDs) has increased by 243%. These methodologies have become increasingly more complex, now including over 80 dependent factors of which some comprise more than 100 fund sources each. This huge increase in both volume and complexity has greatly increased calculation labor and risk of error. Effect: Failure to update factor allocations timely can result in questioned costs. Repeat finding: 2022-010, 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should allocate adequate resources to ensure factor allocations are performed and reallocations are updated timely in order to present accurate information. Views of responsible officials: HHSC concurs with the finding.
Reporting – FFATA Federal Agency: U.S. Department of Agriculture U.S. Department of Housing and Urban Development Federal Program Title: Child Nutrition Cluster (CNC) Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (CDBG) ALN: 10.553, 10.555, 10.556, 10.559, 10.582 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: CNC 236TX332N1099, 236TX332N1199, 236TX375L1603 October 1, 2022 – September 30, 2023 CDBG B-21-DC-48-0001, B-22-DC-48-0001 September 1, 2021 – September 1, 2028, September 1, 2021 – September 1, 2028, September 1, 2022 – September 1, 2029 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Texas Department of Agriculture (TDA) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). During our testing, we noted the following compliance exceptions: Child Nutrition Cluster- Fresh Fruit and Vegetable Program (ALN 10.582) See chart or table in the Schedule of Findings and Questioned Costs. Child Nutrition Cluster- National School Lunch Program (ALN 10.555) See chart or table in the Schedule of Findings and Questioned Costs. Community Development Block Grant (ALN 14.228) See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None. Context: See "Condition." Cause: As related to ALN 10.582 and 10.555, TDA reports expenditures at the end of the subaward period rather than reporting subawards over $30,000 by the last day of the month following the month in which the subaward/ subaward amendment obligation was made or the subcontract award/subcontract modification was made. This was due to the nature of the subaward agreements, where subaward amounts are not specified in the agreement and subrecipients are reimbursed based on actual expenditures incurred each month. As related to subawards not reported for ALN 10.555, TDA did not attempt to report subawards during the fiscal year due to significant technical difficulties encountered uploading subaward data into the FSRS in previous periods. As related to 14.228, reports were submitted late due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TDA should revise its current policies and procedures to ensure all subaward/ subaward amendment obligations over $30,000 are identified and submitted in FSRS by the last day of the month following the month in which the subaward/ subaward amendment obligation was made or the subcontract award/subcontract modification was made. Additionally, TDA should attempt to submit subaward information as required. If unsuccessful due to technical matters related to FSRS, TDA should retain documentation of the resolution efforts and submit subaward information immediately after the matter has been resolved. Views of responsible officials: CNC – TDA FND agrees with the CLA’s recommendation. CDBG – TDA agrees with the finding. TDA acknowledges the FFATA reports were not submitted timely.
Reporting – FFATA Federal Agency: U.S. Department of Agriculture U.S. Department of Housing and Urban Development Federal Program Title: Child Nutrition Cluster (CNC) Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (CDBG) ALN: 10.553, 10.555, 10.556, 10.559, 10.582 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: CNC 236TX332N1099, 236TX332N1199, 236TX375L1603 October 1, 2022 – September 30, 2023 CDBG B-21-DC-48-0001, B-22-DC-48-0001 September 1, 2021 – September 1, 2028, September 1, 2021 – September 1, 2028, September 1, 2022 – September 1, 2029 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Texas Department of Agriculture (TDA) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). During our testing, we noted the following compliance exceptions: Child Nutrition Cluster- Fresh Fruit and Vegetable Program (ALN 10.582) See chart or table in the Schedule of Findings and Questioned Costs. Child Nutrition Cluster- National School Lunch Program (ALN 10.555) See chart or table in the Schedule of Findings and Questioned Costs. Community Development Block Grant (ALN 14.228) See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None. Context: See "Condition." Cause: As related to ALN 10.582 and 10.555, TDA reports expenditures at the end of the subaward period rather than reporting subawards over $30,000 by the last day of the month following the month in which the subaward/ subaward amendment obligation was made or the subcontract award/subcontract modification was made. This was due to the nature of the subaward agreements, where subaward amounts are not specified in the agreement and subrecipients are reimbursed based on actual expenditures incurred each month. As related to subawards not reported for ALN 10.555, TDA did not attempt to report subawards during the fiscal year due to significant technical difficulties encountered uploading subaward data into the FSRS in previous periods. As related to 14.228, reports were submitted late due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TDA should revise its current policies and procedures to ensure all subaward/ subaward amendment obligations over $30,000 are identified and submitted in FSRS by the last day of the month following the month in which the subaward/ subaward amendment obligation was made or the subcontract award/subcontract modification was made. Additionally, TDA should attempt to submit subaward information as required. If unsuccessful due to technical matters related to FSRS, TDA should retain documentation of the resolution efforts and submit subaward information immediately after the matter has been resolved. Views of responsible officials: CNC – TDA FND agrees with the CLA’s recommendation. CDBG – TDA agrees with the finding. TDA acknowledges the FFATA reports were not submitted timely.
Reporting – FFATA Federal Agency: U.S. Department of Agriculture U.S. Department of Housing and Urban Development Federal Program Title: Child Nutrition Cluster (CNC) Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (CDBG) ALN: 10.553, 10.555, 10.556, 10.559, 10.582 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: CNC 236TX332N1099, 236TX332N1199, 236TX375L1603 October 1, 2022 – September 30, 2023 CDBG B-21-DC-48-0001, B-22-DC-48-0001 September 1, 2021 – September 1, 2028, September 1, 2021 – September 1, 2028, September 1, 2022 – September 1, 2029 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Texas Department of Agriculture (TDA) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). During our testing, we noted the following compliance exceptions: Child Nutrition Cluster- Fresh Fruit and Vegetable Program (ALN 10.582) See chart or table in the Schedule of Findings and Questioned Costs. Child Nutrition Cluster- National School Lunch Program (ALN 10.555) See chart or table in the Schedule of Findings and Questioned Costs. Community Development Block Grant (ALN 14.228) See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None. Context: See "Condition." Cause: As related to ALN 10.582 and 10.555, TDA reports expenditures at the end of the subaward period rather than reporting subawards over $30,000 by the last day of the month following the month in which the subaward/ subaward amendment obligation was made or the subcontract award/subcontract modification was made. This was due to the nature of the subaward agreements, where subaward amounts are not specified in the agreement and subrecipients are reimbursed based on actual expenditures incurred each month. As related to subawards not reported for ALN 10.555, TDA did not attempt to report subawards during the fiscal year due to significant technical difficulties encountered uploading subaward data into the FSRS in previous periods. As related to 14.228, reports were submitted late due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TDA should revise its current policies and procedures to ensure all subaward/ subaward amendment obligations over $30,000 are identified and submitted in FSRS by the last day of the month following the month in which the subaward/ subaward amendment obligation was made or the subcontract award/subcontract modification was made. Additionally, TDA should attempt to submit subaward information as required. If unsuccessful due to technical matters related to FSRS, TDA should retain documentation of the resolution efforts and submit subaward information immediately after the matter has been resolved. Views of responsible officials: CNC – TDA FND agrees with the CLA’s recommendation. CDBG – TDA agrees with the finding. TDA acknowledges the FFATA reports were not submitted timely.