Allowable Costs/Cost Principles – Cost Allocations, Matching, Level of Effort, Earmarking (CHIP Only) Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture U.S. Department of Education Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) Children’s Health Insurance Program (CHIP) Block Grants for Community Mental Health Services (MHBG) Block Grants for Prevention and Treatment of Substance Abuse (SABG) Medicaid Cluster Aging Cluster (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) SNAP Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 10.557 93.558 93.667 93.767 93.958 93.959 93.775, 93.777, 93.778 93.044, 93.045, 93.053 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 10.551, 10.561 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: WIC 6TX700527, 6TX700507 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2022 – September 30, 2024 TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 CHIP 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01 6B08TI083478- 01M002, 6B08TI083478-01M003, 6B08TI083478-01M004 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC’s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. HHSC experienced significant delays in updating factors. By the end of the fiscal year, cost allocations had been updated only through August 2022. Although there is no documented policy over when the FMAP should be updated, HHSC will allocate costs at the FMAP that is in effect at the time of the transaction and will reallocate the transactions using the FMAP in effect at the time of the reallocation. This procedure was not followed in 2023 when the costs for four of 40 sample allocations tested in the CHIP program were allocated using a rate other than the current one in effect resulting in noncompliance with matching requirements. Questioned costs: Unknown Context: See “Condition.” Cause: HHSC’s General Ledger Unit is responsible for cost allocations. At the start of fiscal year 2023, the Unit suffered a loss of more than half of its staff due to turnover. Additionally, the current Federal Medical Assistance Percentage (FMAP) rates were in a stepdown process whereby the rate changed quarterly as opposed to yearly which intensified the workload. In addition, since transformation, the number of Public Assistance Cost Allocation Plan (PACAP) methodologies (Project IDs) has increased by 243%. These methodologies have become increasingly more complex, now including over 80 dependent factors of which some comprise more than 100 fund sources each. This huge increase in both volume and complexity has greatly increased calculation labor and risk of error. Effect: Failure to update factor allocations timely can result in questioned costs. Repeat finding: 2022-010, 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should allocate adequate resources to ensure factor allocations are performed and reallocations are updated timely in order to present accurate information. Views of responsible officials: HHSC concurs with the finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.558 93.667 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM083999-01M001, 6B09SM083830-01M001 October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01M003 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat finding: 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC agrees with the finding but does not concur with the recommendation insofar as it makes a specific designation of CAPPS-Financials as the system to ensure compliance.
Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.558 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: Subrecipient’s unique entity identifier (UEI) Federal award identification number (FAIN) Federal award date of award to the recipient by the federal agency Assistance listings number and title Indirect cost rate for the federal award (including if the de minimis rate is charged) Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted: TANF – For a sample of 17, the contracts did not include: UEI (one sample) FAIN (four samples) Federal award date (four samples) Assistance listings numbers and title (four samples) Indirect cost rate, including if the de minimis rate is charged (four samples) SSBG – For 11 of 19 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. MHBG – For 7 of 8 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Temporary Assistance for Needy Families (TANF) - HHSC concurs with the finding. Social Services Block Grants (SSBG)/ Mental Health Block Grants (MHBG) - HHSC concurs with the finding.
Period of Performance Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1B09SM087345, 6B09SM087345, 1B09SM087322-01 October 1, 2022 – September 30, 2024, October 17,2022 – October 16, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403(h) cost must be incurred during the approved budget period. The Federal awarding agency is authorized, at its discretion, to waive prior written approvals to carry forward unobligated balances to subsequent budget periods pursuant to § 200.308(e)(3). Condition: For projects with period of performance beginning dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the first month of the award. We noted the following instances of noncompliance: For the two sampled transactions, totaling $56,997, one of the expenditures, totaling $31,254, was related to costs incurred prior to the period of performance begin date. Questioned costs: $31,254. Context: See “Condition.” Cause: Current controls are not at the correct precision level to detect costs charged outside of the period of performance. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. Repeat finding: No Recommendation: HHSC should enhance and/or modify existing controls to ensure that costs charged to a project have service dates within the period of performance stated in the federal award. Views of responsible officials: HHSC concurs with the finding.
Allowable Costs/Cost Principles – Cost Allocations, Matching, Level of Effort, Earmarking (CHIP Only) Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture U.S. Department of Education Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) Children’s Health Insurance Program (CHIP) Block Grants for Community Mental Health Services (MHBG) Block Grants for Prevention and Treatment of Substance Abuse (SABG) Medicaid Cluster Aging Cluster (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) SNAP Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 10.557 93.558 93.667 93.767 93.958 93.959 93.775, 93.777, 93.778 93.044, 93.045, 93.053 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 10.551, 10.561 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: WIC 6TX700527, 6TX700507 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2022 – September 30, 2024 TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 CHIP 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01 6B08TI083478- 01M002, 6B08TI083478-01M003, 6B08TI083478-01M004 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC’s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. HHSC experienced significant delays in updating factors. By the end of the fiscal year, cost allocations had been updated only through August 2022. Although there is no documented policy over when the FMAP should be updated, HHSC will allocate costs at the FMAP that is in effect at the time of the transaction and will reallocate the transactions using the FMAP in effect at the time of the reallocation. This procedure was not followed in 2023 when the costs for four of 40 sample allocations tested in the CHIP program were allocated using a rate other than the current one in effect resulting in noncompliance with matching requirements. Questioned costs: Unknown Context: See “Condition.” Cause: HHSC’s General Ledger Unit is responsible for cost allocations. At the start of fiscal year 2023, the Unit suffered a loss of more than half of its staff due to turnover. Additionally, the current Federal Medical Assistance Percentage (FMAP) rates were in a stepdown process whereby the rate changed quarterly as opposed to yearly which intensified the workload. In addition, since transformation, the number of Public Assistance Cost Allocation Plan (PACAP) methodologies (Project IDs) has increased by 243%. These methodologies have become increasingly more complex, now including over 80 dependent factors of which some comprise more than 100 fund sources each. This huge increase in both volume and complexity has greatly increased calculation labor and risk of error. Effect: Failure to update factor allocations timely can result in questioned costs. Repeat finding: 2022-010, 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should allocate adequate resources to ensure factor allocations are performed and reallocations are updated timely in order to present accurate information. Views of responsible officials: HHSC concurs with the finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.558 93.667 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM083999-01M001, 6B09SM083830-01M001 October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01M003 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat finding: 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC agrees with the finding but does not concur with the recommendation insofar as it makes a specific designation of CAPPS-Financials as the system to ensure compliance.
Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.558 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: Subrecipient’s unique entity identifier (UEI) Federal award identification number (FAIN) Federal award date of award to the recipient by the federal agency Assistance listings number and title Indirect cost rate for the federal award (including if the de minimis rate is charged) Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted: TANF – For a sample of 17, the contracts did not include: UEI (one sample) FAIN (four samples) Federal award date (four samples) Assistance listings numbers and title (four samples) Indirect cost rate, including if the de minimis rate is charged (four samples) SSBG – For 11 of 19 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. MHBG – For 7 of 8 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Temporary Assistance for Needy Families (TANF) - HHSC concurs with the finding. Social Services Block Grants (SSBG)/ Mental Health Block Grants (MHBG) - HHSC concurs with the finding.
Period of Performance Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1B09SM087345, 6B09SM087345, 1B09SM087322-01 October 1, 2022 – September 30, 2024, October 17,2022 – October 16, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403(h) cost must be incurred during the approved budget period. The Federal awarding agency is authorized, at its discretion, to waive prior written approvals to carry forward unobligated balances to subsequent budget periods pursuant to § 200.308(e)(3). Condition: For projects with period of performance beginning dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the first month of the award. We noted the following instances of noncompliance: For the two sampled transactions, totaling $56,997, one of the expenditures, totaling $31,254, was related to costs incurred prior to the period of performance begin date. Questioned costs: $31,254. Context: See “Condition.” Cause: Current controls are not at the correct precision level to detect costs charged outside of the period of performance. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. Repeat finding: No Recommendation: HHSC should enhance and/or modify existing controls to ensure that costs charged to a project have service dates within the period of performance stated in the federal award. Views of responsible officials: HHSC concurs with the finding.
Allowable Costs/Cost Principles – Cost Allocations, Matching, Level of Effort, Earmarking (CHIP Only) Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture U.S. Department of Education Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) Children’s Health Insurance Program (CHIP) Block Grants for Community Mental Health Services (MHBG) Block Grants for Prevention and Treatment of Substance Abuse (SABG) Medicaid Cluster Aging Cluster (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) SNAP Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 10.557 93.558 93.667 93.767 93.958 93.959 93.775, 93.777, 93.778 93.044, 93.045, 93.053 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 10.551, 10.561 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: WIC 6TX700527, 6TX700507 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2022 – September 30, 2024 TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 CHIP 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01 6B08TI083478- 01M002, 6B08TI083478-01M003, 6B08TI083478-01M004 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC’s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. HHSC experienced significant delays in updating factors. By the end of the fiscal year, cost allocations had been updated only through August 2022. Although there is no documented policy over when the FMAP should be updated, HHSC will allocate costs at the FMAP that is in effect at the time of the transaction and will reallocate the transactions using the FMAP in effect at the time of the reallocation. This procedure was not followed in 2023 when the costs for four of 40 sample allocations tested in the CHIP program were allocated using a rate other than the current one in effect resulting in noncompliance with matching requirements. Questioned costs: Unknown Context: See “Condition.” Cause: HHSC’s General Ledger Unit is responsible for cost allocations. At the start of fiscal year 2023, the Unit suffered a loss of more than half of its staff due to turnover. Additionally, the current Federal Medical Assistance Percentage (FMAP) rates were in a stepdown process whereby the rate changed quarterly as opposed to yearly which intensified the workload. In addition, since transformation, the number of Public Assistance Cost Allocation Plan (PACAP) methodologies (Project IDs) has increased by 243%. These methodologies have become increasingly more complex, now including over 80 dependent factors of which some comprise more than 100 fund sources each. This huge increase in both volume and complexity has greatly increased calculation labor and risk of error. Effect: Failure to update factor allocations timely can result in questioned costs. Repeat finding: 2022-010, 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should allocate adequate resources to ensure factor allocations are performed and reallocations are updated timely in order to present accurate information. Views of responsible officials: HHSC concurs with the finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.558 93.667 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM083999-01M001, 6B09SM083830-01M001 October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01M003 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat finding: 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC agrees with the finding but does not concur with the recommendation insofar as it makes a specific designation of CAPPS-Financials as the system to ensure compliance.
Allowable Costs/Cost Principles – Cost Allocations, Matching, Level of Effort, Earmarking (CHIP Only) Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture U.S. Department of Education Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) Children’s Health Insurance Program (CHIP) Block Grants for Community Mental Health Services (MHBG) Block Grants for Prevention and Treatment of Substance Abuse (SABG) Medicaid Cluster Aging Cluster (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) SNAP Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 10.557 93.558 93.667 93.767 93.958 93.959 93.775, 93.777, 93.778 93.044, 93.045, 93.053 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 10.551, 10.561 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: WIC 6TX700527, 6TX700507 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2022 – September 30, 2024 TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 CHIP 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01 6B08TI083478- 01M002, 6B08TI083478-01M003, 6B08TI083478-01M004 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC’s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. HHSC experienced significant delays in updating factors. By the end of the fiscal year, cost allocations had been updated only through August 2022. Although there is no documented policy over when the FMAP should be updated, HHSC will allocate costs at the FMAP that is in effect at the time of the transaction and will reallocate the transactions using the FMAP in effect at the time of the reallocation. This procedure was not followed in 2023 when the costs for four of 40 sample allocations tested in the CHIP program were allocated using a rate other than the current one in effect resulting in noncompliance with matching requirements. Questioned costs: Unknown Context: See “Condition.” Cause: HHSC’s General Ledger Unit is responsible for cost allocations. At the start of fiscal year 2023, the Unit suffered a loss of more than half of its staff due to turnover. Additionally, the current Federal Medical Assistance Percentage (FMAP) rates were in a stepdown process whereby the rate changed quarterly as opposed to yearly which intensified the workload. In addition, since transformation, the number of Public Assistance Cost Allocation Plan (PACAP) methodologies (Project IDs) has increased by 243%. These methodologies have become increasingly more complex, now including over 80 dependent factors of which some comprise more than 100 fund sources each. This huge increase in both volume and complexity has greatly increased calculation labor and risk of error. Effect: Failure to update factor allocations timely can result in questioned costs. Repeat finding: 2022-010, 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should allocate adequate resources to ensure factor allocations are performed and reallocations are updated timely in order to present accurate information. Views of responsible officials: HHSC concurs with the finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.558 93.667 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM083999-01M001, 6B09SM083830-01M001 October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01M003 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat finding: 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC agrees with the finding but does not concur with the recommendation insofar as it makes a specific designation of CAPPS-Financials as the system to ensure compliance.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Homeland Security Federal Program Title: Disaster Grants-Public Assistance (Presidentially Declared Disasters) ALN: 97.036 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: FEMA-4332-DR, FEMA-3540-DR, FEMA-4485-DR, FEMA-4586-DR 2017, 2020, 2020, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The Federal Emergency Management Agency (FEMA) evaluates the eligibility of all costs claimed by the applicant. Not all costs incurred as a result of the incident are eligible. Chapter 4 of the Public Assistance Program and Policy Guide states that to be eligible, costs must be: Directly tied to the performance of eligible work. Adequately documented. Reduced by all applicable credits, such as insurance proceeds and salvage values. Authorized and not prohibited under federal, state, territorial, tribal, or local government laws or regulations. Consistent with applicant’s internal policies, regulations, and procedures that apply uniformly to both federal awards and other activities of the applicant; and Necessary and reasonable to accomplish the work properly and efficiently. Condition: Audit procedures included a sample of 60 expenditures, totaling $97,118,451, incurred during the fiscal year to validate allowability with the grant award. DSHS was unable to provide the project worksheets for seven out of the 60 samples, totaling $1,878,609. Thus, we were unable to verify that the costs were allowable per the project worksheets. For eight samples, totaling $561,562, the project worksheets associated with the transactions were not approved. Questioned costs: $2,440,171. Context: See “Condition.” Cause: FEMA project worksheets from the Texas COVID pandemic remain open. DSHS is continually adding and removing invoices from its claims with FEMA as final expenditures are deemed eligible and ineligible by FEMA and claims are reimbursed. Five of the invoices reported on the schedule of expenditures of federal awards and submitted for reimbursement were originally under a project worksheet but later withdrawn by DSHS as updated FEMA policies deemed certain costs ineligible. As a result, these transactions were no longer associated with a project worksheet at the time of audit fieldwork. Additionally, two invoices reported on the schedule of expenditures of federal awards had not been submitted to FEMA for reimbursement and do not have project worksheets associated with them at the time of audit fieldwork. Additionally, expenditures reported on the schedule of federal awards are not reconciled to allowable costs after ineligible expenditures are identified. Effect: Amounts reported on the schedule of expenditures of federal awards that are not reconciled to underlying allowable costs may result in disallowed costs. Repeat finding: No Recommendation: We recommend DSHS reconcile all program expenditures, whether they have been incurred, submitted for reimbursement, or reimbursed, to determine the amount to report on the schedule of expenditures of federal awards. Expenditures deemed to be ineligible subsequent to fiscal year end should be removed from the reported amount. Views of responsible officials: During the COVID-19 pandemic, DSHS’ primary focus was getting resources where they were needed most. The intensity of the pandemic resulted in significantly increased workloads and a need for rapid response. DSHS previously identified the need to review expenditures and ensure costs are allowable and align with required parameters. Because of the shifting of FEMA eligibility criteria over time, we agree that modifications are needed to ensure transactions comply with the most recent guidance.
Reporting – Financial and Special Reporting for FFATA Federal Agency: U.S. Department of Homeland Security Federal Program Title: Disaster Grants - Public Assistance (Presidentially Declared Disasters) ALN: 97.036 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: PA-06-TX-4485, PA-06-TX-4586 March 25, 2020 – March 25, 2028, February 19, 2021 – February 19, 2029 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, hereafter referred as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The action is to be reported in FSRS no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: For one of the nine financial reports tested during the fiscal year, we noted the Texas Division of Emergency Management (TDEM) incorrectly reported total federal funds authorized amount of $14,451,281,005. TDEM should have reported total federal funds authorized amount of $14,450,861,018, resulting in a reported variance of $419,988. During our testing of special reporting for FFATA, we noted the following instances of noncompliance: See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None. Context: See "Condition" Cause: Specific to financial reporting, the variance is due to a manual error in transferring data from the Smartlink report used to report the total federal funds authorized amount to the financial report. TDEM did not reduce the total federal funds authorized for the Hazard Mitigation projects included in the Smartlink report. The untimely submission of the FFATA report was due to the utilization of a new third-party application where gaps were later identified. Effect: Reporting inaccurate information on financial reports could impact the federal agency’s ability to accurately capture key information in order to assess the performance of the program. Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat finding: No Recommendation: TDEM should enhance its internal controls to ensure manual errors on financial reports are identified and FFATA reports are identified in a timely manner in order to be reported in FSRS within the required timeline. Views of responsible officials: Specific to the financial reporting, it appears there was a malfunction with the federal system adhoc legacy inquiry reporting tool when generating federal financial reports containing the total federal funds authorized. The federal system’s malfunction produced a comingled program report which caused an overage in total federal funds authorized. TDEM no longer generates reports from the unreliable federal system adhoc legacy inquiry module. As of October 2023, we began utilizing the federal system APEX reports. TDEM has followed up with the Federal Support Center for the Payment Management System multiple times to determine what is causing the federal system to report inaccuracies, however they have failed to address the issue at hand, have stated that “soon the legacy adhoc will no longer be available”, and are encouraging grantees to only use the APEX reports – seemingly due to the inaccuracies, such as the one noted here, that the federal system generates. Regarding the FFATA reporting, a new automated report developed by a third-party vendor to streamline the reporting timeline was being utilized after an internal testing phase had transpired. A gap was later identified which inadvertently created the timing delay.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Homeland Security Federal Program Title: Disaster Grants-Public Assistance (Presidentially Declared Disasters) ALN: 97.036 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: FEMA-4332-DR, FEMA-3540-DR, FEMA-4485-DR, FEMA-4586-DR 2017, 2020, 2020, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The Federal Emergency Management Agency (FEMA) evaluates the eligibility of all costs claimed by the applicant. Not all costs incurred as a result of the incident are eligible. Chapter 4 of the Public Assistance Program and Policy Guide states that to be eligible, costs must be: Directly tied to the performance of eligible work. Adequately documented. Reduced by all applicable credits, such as insurance proceeds and salvage values. Authorized and not prohibited under federal, state, territorial, tribal, or local government laws or regulations. Consistent with applicant’s internal policies, regulations, and procedures that apply uniformly to both federal awards and other activities of the applicant; and Necessary and reasonable to accomplish the work properly and efficiently. Condition: Audit procedures included a sample of 60 expenditures, totaling $97,118,451, incurred during the fiscal year to validate allowability with the grant award. DSHS was unable to provide the project worksheets for seven out of the 60 samples, totaling $1,878,609. Thus, we were unable to verify that the costs were allowable per the project worksheets. For eight samples, totaling $561,562, the project worksheets associated with the transactions were not approved. Questioned costs: $2,440,171. Context: See “Condition.” Cause: FEMA project worksheets from the Texas COVID pandemic remain open. DSHS is continually adding and removing invoices from its claims with FEMA as final expenditures are deemed eligible and ineligible by FEMA and claims are reimbursed. Five of the invoices reported on the schedule of expenditures of federal awards and submitted for reimbursement were originally under a project worksheet but later withdrawn by DSHS as updated FEMA policies deemed certain costs ineligible. As a result, these transactions were no longer associated with a project worksheet at the time of audit fieldwork. Additionally, two invoices reported on the schedule of expenditures of federal awards had not been submitted to FEMA for reimbursement and do not have project worksheets associated with them at the time of audit fieldwork. Additionally, expenditures reported on the schedule of federal awards are not reconciled to allowable costs after ineligible expenditures are identified. Effect: Amounts reported on the schedule of expenditures of federal awards that are not reconciled to underlying allowable costs may result in disallowed costs. Repeat finding: No Recommendation: We recommend DSHS reconcile all program expenditures, whether they have been incurred, submitted for reimbursement, or reimbursed, to determine the amount to report on the schedule of expenditures of federal awards. Expenditures deemed to be ineligible subsequent to fiscal year end should be removed from the reported amount. Views of responsible officials: During the COVID-19 pandemic, DSHS’ primary focus was getting resources where they were needed most. The intensity of the pandemic resulted in significantly increased workloads and a need for rapid response. DSHS previously identified the need to review expenditures and ensure costs are allowable and align with required parameters. Because of the shifting of FEMA eligibility criteria over time, we agree that modifications are needed to ensure transactions comply with the most recent guidance.
Reporting – Financial and Special Reporting for FFATA Federal Agency: U.S. Department of Homeland Security Federal Program Title: Disaster Grants - Public Assistance (Presidentially Declared Disasters) ALN: 97.036 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: PA-06-TX-4485, PA-06-TX-4586 March 25, 2020 – March 25, 2028, February 19, 2021 – February 19, 2029 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, hereafter referred as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The action is to be reported in FSRS no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: For one of the nine financial reports tested during the fiscal year, we noted the Texas Division of Emergency Management (TDEM) incorrectly reported total federal funds authorized amount of $14,451,281,005. TDEM should have reported total federal funds authorized amount of $14,450,861,018, resulting in a reported variance of $419,988. During our testing of special reporting for FFATA, we noted the following instances of noncompliance: See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None. Context: See "Condition" Cause: Specific to financial reporting, the variance is due to a manual error in transferring data from the Smartlink report used to report the total federal funds authorized amount to the financial report. TDEM did not reduce the total federal funds authorized for the Hazard Mitigation projects included in the Smartlink report. The untimely submission of the FFATA report was due to the utilization of a new third-party application where gaps were later identified. Effect: Reporting inaccurate information on financial reports could impact the federal agency’s ability to accurately capture key information in order to assess the performance of the program. Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat finding: No Recommendation: TDEM should enhance its internal controls to ensure manual errors on financial reports are identified and FFATA reports are identified in a timely manner in order to be reported in FSRS within the required timeline. Views of responsible officials: Specific to the financial reporting, it appears there was a malfunction with the federal system adhoc legacy inquiry reporting tool when generating federal financial reports containing the total federal funds authorized. The federal system’s malfunction produced a comingled program report which caused an overage in total federal funds authorized. TDEM no longer generates reports from the unreliable federal system adhoc legacy inquiry module. As of October 2023, we began utilizing the federal system APEX reports. TDEM has followed up with the Federal Support Center for the Payment Management System multiple times to determine what is causing the federal system to report inaccuracies, however they have failed to address the issue at hand, have stated that “soon the legacy adhoc will no longer be available”, and are encouraging grantees to only use the APEX reports – seemingly due to the inaccuracies, such as the one noted here, that the federal system generates. Regarding the FFATA reporting, a new automated report developed by a third-party vendor to streamline the reporting timeline was being utilized after an internal testing phase had transpired. A gap was later identified which inadvertently created the timing delay.
Allowable Costs/Cost Principles – Cost Allocations, Matching, Level of Effort, Earmarking (CHIP Only) Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture U.S. Department of Education Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) Children’s Health Insurance Program (CHIP) Block Grants for Community Mental Health Services (MHBG) Block Grants for Prevention and Treatment of Substance Abuse (SABG) Medicaid Cluster Aging Cluster (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) SNAP Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 10.557 93.558 93.667 93.767 93.958 93.959 93.775, 93.777, 93.778 93.044, 93.045, 93.053 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 10.551, 10.561 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: WIC 6TX700527, 6TX700507 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2022 – September 30, 2024 TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 CHIP 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01 6B08TI083478- 01M002, 6B08TI083478-01M003, 6B08TI083478-01M004 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC’s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. HHSC experienced significant delays in updating factors. By the end of the fiscal year, cost allocations had been updated only through August 2022. Although there is no documented policy over when the FMAP should be updated, HHSC will allocate costs at the FMAP that is in effect at the time of the transaction and will reallocate the transactions using the FMAP in effect at the time of the reallocation. This procedure was not followed in 2023 when the costs for four of 40 sample allocations tested in the CHIP program were allocated using a rate other than the current one in effect resulting in noncompliance with matching requirements. Questioned costs: Unknown Context: See “Condition.” Cause: HHSC’s General Ledger Unit is responsible for cost allocations. At the start of fiscal year 2023, the Unit suffered a loss of more than half of its staff due to turnover. Additionally, the current Federal Medical Assistance Percentage (FMAP) rates were in a stepdown process whereby the rate changed quarterly as opposed to yearly which intensified the workload. In addition, since transformation, the number of Public Assistance Cost Allocation Plan (PACAP) methodologies (Project IDs) has increased by 243%. These methodologies have become increasingly more complex, now including over 80 dependent factors of which some comprise more than 100 fund sources each. This huge increase in both volume and complexity has greatly increased calculation labor and risk of error. Effect: Failure to update factor allocations timely can result in questioned costs. Repeat finding: 2022-010, 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should allocate adequate resources to ensure factor allocations are performed and reallocations are updated timely in order to present accurate information. Views of responsible officials: HHSC concurs with the finding.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Sam Houston State University (University) did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate levels of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, 1 (14 percent) of 7 changes tested lacked documentation showing that the change was properly tested or validated before it was migrated to production. Not having sufficient controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate validation of changes prior to implementation. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-113, 2017-119, 2016-109 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Southern University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always ensure that (1) access to modify information and process transactions in the student information system and (2) administrative access at the network level was limited to only current employees and users who needed that access based on their job responsibilities. The University had a process to review user access to its systems; however, it did not always implement changes based on the results of that review. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made to those systems. Recommendation: The University should ensure that user access to its student information system and administrative access to its network is appropriately limited to employees based on current job responsibilities. Views of Responsible Officials: The Office of Technology acknowledges and agrees with the finding.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Tech University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate level of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-142 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. Specifically, a user was granted administrative access in the student information system, which included the ability to modify information and process transactions, such as authorizing and disbursing aid. The University did not remove the administrative access after the user’s specific job responsibilities no longer required that level of access. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: To the point that The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. OIT and Financial Aid acknowledge that a user was given elevated access that was not removed when the assigned maintenance task was completed.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Austin (University) did not appropriately restrict user access to its student information system. Specifically, an employee retained the ability to modify student financial aid awards after transitioning from the Office of Student Financial Aid to another department within the University. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, one of the University’s departments did not enable the control designed to prevent developers from migrating their own code changes into production. Not having sufficient segregation of duties controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate segregation of duties. Views of Responsible Officials: The University acknowledges and agrees with the finding. In this case, the employee transitioned from the Office of Scholarships and Financial Aid (OSFA) to the Student Financial Aid implementation project. It was intended for this employee to retain his prior access for a time so he could help provide backstop support while his duties were transitioned to other employees within OSFA. This access should have been removed once his duties were successfully transitioned. Views of Responsible Officials: The University acknowledges and agrees with the finding. However, technical limitations in the current financial aid management system require that a particular mainframe programming library be exempted from the change control mechanisms that are used in all other libraries that can update student financial aid information.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas Permian Basin (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to implement further access limitations and enhanced its periodic review of access.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Sam Houston State University (University) did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate levels of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, 1 (14 percent) of 7 changes tested lacked documentation showing that the change was properly tested or validated before it was migrated to production. Not having sufficient controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate validation of changes prior to implementation. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-113, 2017-119, 2016-109 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Southern University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always ensure that (1) access to modify information and process transactions in the student information system and (2) administrative access at the network level was limited to only current employees and users who needed that access based on their job responsibilities. The University had a process to review user access to its systems; however, it did not always implement changes based on the results of that review. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made to those systems. Recommendation: The University should ensure that user access to its student information system and administrative access to its network is appropriately limited to employees based on current job responsibilities. Views of Responsible Officials: The Office of Technology acknowledges and agrees with the finding.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Tech University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate level of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-142 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. Specifically, a user was granted administrative access in the student information system, which included the ability to modify information and process transactions, such as authorizing and disbursing aid. The University did not remove the administrative access after the user’s specific job responsibilities no longer required that level of access. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: To the point that The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. OIT and Financial Aid acknowledge that a user was given elevated access that was not removed when the assigned maintenance task was completed.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Austin (University) did not appropriately restrict user access to its student information system. Specifically, an employee retained the ability to modify student financial aid awards after transitioning from the Office of Student Financial Aid to another department within the University. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, one of the University’s departments did not enable the control designed to prevent developers from migrating their own code changes into production. Not having sufficient segregation of duties controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate segregation of duties. Views of Responsible Officials: The University acknowledges and agrees with the finding. In this case, the employee transitioned from the Office of Scholarships and Financial Aid (OSFA) to the Student Financial Aid implementation project. It was intended for this employee to retain his prior access for a time so he could help provide backstop support while his duties were transitioned to other employees within OSFA. This access should have been removed once his duties were successfully transitioned. Views of Responsible Officials: The University acknowledges and agrees with the finding. However, technical limitations in the current financial aid management system require that a particular mainframe programming library be exempted from the change control mechanisms that are used in all other libraries that can update student financial aid information.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas Permian Basin (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to implement further access limitations and enhanced its periodic review of access.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Sam Houston State University (University) did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate levels of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, 1 (14 percent) of 7 changes tested lacked documentation showing that the change was properly tested or validated before it was migrated to production. Not having sufficient controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate validation of changes prior to implementation. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-113, 2017-119, 2016-109 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Southern University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always ensure that (1) access to modify information and process transactions in the student information system and (2) administrative access at the network level was limited to only current employees and users who needed that access based on their job responsibilities. The University had a process to review user access to its systems; however, it did not always implement changes based on the results of that review. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made to those systems. Recommendation: The University should ensure that user access to its student information system and administrative access to its network is appropriately limited to employees based on current job responsibilities. Views of Responsible Officials: The Office of Technology acknowledges and agrees with the finding.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Tech University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate level of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-142 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. Specifically, a user was granted administrative access in the student information system, which included the ability to modify information and process transactions, such as authorizing and disbursing aid. The University did not remove the administrative access after the user’s specific job responsibilities no longer required that level of access. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: To the point that The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. OIT and Financial Aid acknowledge that a user was given elevated access that was not removed when the assigned maintenance task was completed.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Austin (University) did not appropriately restrict user access to its student information system. Specifically, an employee retained the ability to modify student financial aid awards after transitioning from the Office of Student Financial Aid to another department within the University. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, one of the University’s departments did not enable the control designed to prevent developers from migrating their own code changes into production. Not having sufficient segregation of duties controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate segregation of duties. Views of Responsible Officials: The University acknowledges and agrees with the finding. In this case, the employee transitioned from the Office of Scholarships and Financial Aid (OSFA) to the Student Financial Aid implementation project. It was intended for this employee to retain his prior access for a time so he could help provide backstop support while his duties were transitioned to other employees within OSFA. This access should have been removed once his duties were successfully transitioned. Views of Responsible Officials: The University acknowledges and agrees with the finding. However, technical limitations in the current financial aid management system require that a particular mainframe programming library be exempted from the change control mechanisms that are used in all other libraries that can update student financial aid information.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas Permian Basin (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to implement further access limitations and enhanced its periodic review of access.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Sam Houston State University (University) did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate levels of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, 1 (14 percent) of 7 changes tested lacked documentation showing that the change was properly tested or validated before it was migrated to production. Not having sufficient controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate validation of changes prior to implementation. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-113, 2017-119, 2016-109 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Southern University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always ensure that (1) access to modify information and process transactions in the student information system and (2) administrative access at the network level was limited to only current employees and users who needed that access based on their job responsibilities. The University had a process to review user access to its systems; however, it did not always implement changes based on the results of that review. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made to those systems. Recommendation: The University should ensure that user access to its student information system and administrative access to its network is appropriately limited to employees based on current job responsibilities. Views of Responsible Officials: The Office of Technology acknowledges and agrees with the finding.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Tech University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate level of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-142 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. Specifically, a user was granted administrative access in the student information system, which included the ability to modify information and process transactions, such as authorizing and disbursing aid. The University did not remove the administrative access after the user’s specific job responsibilities no longer required that level of access. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: To the point that The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. OIT and Financial Aid acknowledge that a user was given elevated access that was not removed when the assigned maintenance task was completed.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Austin (University) did not appropriately restrict user access to its student information system. Specifically, an employee retained the ability to modify student financial aid awards after transitioning from the Office of Student Financial Aid to another department within the University. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, one of the University’s departments did not enable the control designed to prevent developers from migrating their own code changes into production. Not having sufficient segregation of duties controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate segregation of duties. Views of Responsible Officials: The University acknowledges and agrees with the finding. In this case, the employee transitioned from the Office of Scholarships and Financial Aid (OSFA) to the Student Financial Aid implementation project. It was intended for this employee to retain his prior access for a time so he could help provide backstop support while his duties were transitioned to other employees within OSFA. This access should have been removed once his duties were successfully transitioned. Views of Responsible Officials: The University acknowledges and agrees with the finding. However, technical limitations in the current financial aid management system require that a particular mainframe programming library be exempted from the change control mechanisms that are used in all other libraries that can update student financial aid information.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas Permian Basin (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to implement further access limitations and enhanced its periodic review of access.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Austin (University) did not appropriately restrict user access to its student information system. Specifically, an employee retained the ability to modify student financial aid awards after transitioning from the Office of Student Financial Aid to another department within the University. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, one of the University’s departments did not enable the control designed to prevent developers from migrating their own code changes into production. Not having sufficient segregation of duties controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate segregation of duties. Views of Responsible Officials: The University acknowledges and agrees with the finding. In this case, the employee transitioned from the Office of Scholarships and Financial Aid (OSFA) to the Student Financial Aid implementation project. It was intended for this employee to retain his prior access for a time so he could help provide backstop support while his duties were transitioned to other employees within OSFA. This access should have been removed once his duties were successfully transitioned. Views of Responsible Officials: The University acknowledges and agrees with the finding. However, technical limitations in the current financial aid management system require that a particular mainframe programming library be exempted from the change control mechanisms that are used in all other libraries that can update student financial aid information.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Sam Houston State University (University) did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate levels of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, 1 (14 percent) of 7 changes tested lacked documentation showing that the change was properly tested or validated before it was migrated to production. Not having sufficient controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate validation of changes prior to implementation. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-113, 2017-119, 2016-109 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Southern University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always ensure that (1) access to modify information and process transactions in the student information system and (2) administrative access at the network level was limited to only current employees and users who needed that access based on their job responsibilities. The University had a process to review user access to its systems; however, it did not always implement changes based on the results of that review. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made to those systems. Recommendation: The University should ensure that user access to its student information system and administrative access to its network is appropriately limited to employees based on current job responsibilities. Views of Responsible Officials: The Office of Technology acknowledges and agrees with the finding.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Tech University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate level of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-142 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. Specifically, a user was granted administrative access in the student information system, which included the ability to modify information and process transactions, such as authorizing and disbursing aid. The University did not remove the administrative access after the user’s specific job responsibilities no longer required that level of access. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: To the point that The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. OIT and Financial Aid acknowledge that a user was given elevated access that was not removed when the assigned maintenance task was completed.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Austin (University) did not appropriately restrict user access to its student information system. Specifically, an employee retained the ability to modify student financial aid awards after transitioning from the Office of Student Financial Aid to another department within the University. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, one of the University’s departments did not enable the control designed to prevent developers from migrating their own code changes into production. Not having sufficient segregation of duties controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate segregation of duties. Views of Responsible Officials: The University acknowledges and agrees with the finding. In this case, the employee transitioned from the Office of Scholarships and Financial Aid (OSFA) to the Student Financial Aid implementation project. It was intended for this employee to retain his prior access for a time so he could help provide backstop support while his duties were transitioned to other employees within OSFA. This access should have been removed once his duties were successfully transitioned. Views of Responsible Officials: The University acknowledges and agrees with the finding. However, technical limitations in the current financial aid management system require that a particular mainframe programming library be exempted from the change control mechanisms that are used in all other libraries that can update student financial aid information.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas Permian Basin (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to implement further access limitations and enhanced its periodic review of access.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Sam Houston State University (University) did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate levels of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, 1 (14 percent) of 7 changes tested lacked documentation showing that the change was properly tested or validated before it was migrated to production. Not having sufficient controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate validation of changes prior to implementation. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.
General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-113, 2017-119, 2016-109 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Southern University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always ensure that (1) access to modify information and process transactions in the student information system and (2) administrative access at the network level was limited to only current employees and users who needed that access based on their job responsibilities. The University had a process to review user access to its systems; however, it did not always implement changes based on the results of that review. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made to those systems. Recommendation: The University should ensure that user access to its student information system and administrative access to its network is appropriately limited to employees based on current job responsibilities. Views of Responsible Officials: The Office of Technology acknowledges and agrees with the finding.