FAC Explorer

Finding 1026426 (2022-001)

Material Weakness
Requirement
AELN
Questioned Costs
-
Year
2022
Accepted
2023-08-08
Audit: 313337
Organization: Mayo Clinic (MN)
Auditor: Ernst & Young LLP

AI Summary

  • Core Issue: Mayo Clinic failed to implement all required user access controls for the Banner application, impacting the reliability of IT general controls.
  • Impacted Requirements: Compliance with Section 200.303 of the Uniform Guidance and the Ellucian SOC 1 Report regarding internal controls over federal awards.
  • Recommended Follow-Up: Management should finalize the implementation of all required controls and ensure proper documentation is retained for user access reviews and provisioning processes.

Finding Text

Finding 2022-001 ? Information Technology General ControlsIdentification of the federal program:Federal Agency: United States Department of EducationFederal Cluster/Program: Student Financial AssistanceAward Periods: July 1, 2021 through June 30, 2022, and July 1, 2022 through June 30, 2023Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of the Uniform Guidance states the following regarding internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?Condition:Mayo Clinic (the Clinic) did not implement all Complementary User Entity Controls (CUECs) as prescribed in the Ellucian SOC 1 Report that are required to be in place to support effective information technology general controls (ITGCs) for the Banner application. The controls that were not specifically implemented relate to user access review. Additionally, user provisioning and user termination processes were not operating as designed. As a result, Banner ITGCs cannot be relied upon in the period of audit.There is a risk the data relevant to the SFA Cluster program stored within the student financial aid system may be inappropriately created or modified. A user access review was not performed during the current period. For the remainder of the CUECs, evidence of the operation of controls identified to address this risk during the fiscal period under audit was not appropriately retained. Cause:Management did not appropriately implement a user access review. Management did not retain sufficient supporting documentation to evidence that the new user provisioning and termination controls, as required by the CUECs prescribed in the Ellucian SOC 1 Report, were designed effectively and placed in operation during the period under audit.Effect or potential effect:Effective testing of the required CUECs is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period.Questioned costs:None.Context:We reviewed evidence over the testing of the required CUECs and noted the evidence was incomplete and insufficient to conclude on the effective ITGCs over the Banner application. These controls specifically relate to user access review, user provisioning, and user termination. As a result, Banner ITGCs cannot be relied upon in the period of audit.Total expenditures for the Student Financial Assistance Cluster were $16,350,962 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:This is a not a repeat finding from the prior year.Recommendation:Management should complete the implementation for all required CUECs prescribed within the Ellucian SOC 1 Report and retain documentation of the operation of controls.Views of responsible officials:Mayo Clinic IT will work with the Student Financial Aid office to review the risk rating given to the Banner application. A complete user access review based on job roles will be completed for 2023. The review will include each employee?s assigned functions within the Banner system. The user provisioning process will also be updated to include the functions the user will be receiving. Enhanced documentation will be retained for user terminations and other system reports required to complete testing of the Banner controls.

Categories

Student Financial Aid Matching / Level of Effort / Earmarking Internal Control / Segregation of Duties

Other Findings in this Audit

  • 449980 2022-001
    Material Weakness
  • 449981 2022-003
    Material Weakness Repeat
  • 449982 2022-004
    Significant Deficiency Repeat
  • 449983 2022-005
    Significant Deficiency Repeat
  • 449984 2022-001
    Material Weakness
  • 449985 2022-003
    Material Weakness Repeat
  • 449986 2022-004
    Significant Deficiency Repeat
  • 449987 2022-005
    Significant Deficiency Repeat
  • 449988 2022-002
    Significant Deficiency
  • 449989 2022-007
    Material Weakness Repeat
  • 449990 2022-007
    Material Weakness Repeat
  • 449991 2022-007
    Material Weakness Repeat
  • 449992 2022-002
    Significant Deficiency
  • 449993 2022-007
    Material Weakness Repeat
  • 449994 2022-007
    Material Weakness Repeat
  • 449995 2022-007
    Material Weakness Repeat
  • 449996 2022-002
    Significant Deficiency
  • 449997 2022-007
    Material Weakness Repeat
  • 449998 2022-007
    Material Weakness Repeat
  • 449999 2022-002
    Significant Deficiency
  • 450000 2022-007
    Material Weakness Repeat
  • 450001 2022-007
    Material Weakness Repeat
  • 450002 2022-007
    Material Weakness Repeat
  • 450003 2022-007
    Material Weakness Repeat
  • 450004 2022-007
    Material Weakness Repeat
  • 450005 2022-007
    Material Weakness Repeat
  • 450006 2022-007
    Material Weakness Repeat
  • 450007 2022-007
    Material Weakness Repeat
  • 450008 2022-007
    Material Weakness Repeat
  • 450009 2022-007
    Material Weakness Repeat
  • 450010 2022-007
    Material Weakness Repeat
  • 1026422 2022-001
    Material Weakness
  • 1026423 2022-003
    Material Weakness Repeat
  • 1026424 2022-004
    Significant Deficiency Repeat
  • 1026425 2022-005
    Significant Deficiency Repeat
  • 1026427 2022-003
    Material Weakness Repeat
  • 1026428 2022-004
    Significant Deficiency Repeat
  • 1026429 2022-005
    Significant Deficiency Repeat
  • 1026430 2022-002
    Significant Deficiency
  • 1026431 2022-007
    Material Weakness Repeat
  • 1026432 2022-007
    Material Weakness Repeat
  • 1026433 2022-007
    Material Weakness Repeat
  • 1026434 2022-002
    Significant Deficiency
  • 1026435 2022-007
    Material Weakness Repeat
  • 1026436 2022-007
    Material Weakness Repeat
  • 1026437 2022-007
    Material Weakness Repeat
  • 1026438 2022-002
    Significant Deficiency
  • 1026439 2022-007
    Material Weakness Repeat
  • 1026440 2022-007
    Material Weakness Repeat
  • 1026441 2022-002
    Significant Deficiency
  • 1026442 2022-007
    Material Weakness Repeat
  • 1026443 2022-007
    Material Weakness Repeat
  • 1026444 2022-007
    Material Weakness Repeat
  • 1026445 2022-007
    Material Weakness Repeat
  • 1026446 2022-007
    Material Weakness Repeat
  • 1026447 2022-007
    Material Weakness Repeat
  • 1026448 2022-007
    Material Weakness Repeat
  • 1026449 2022-007
    Material Weakness Repeat
  • 1026450 2022-007
    Material Weakness Repeat
  • 1026451 2022-007
    Material Weakness Repeat
  • 1026452 2022-007
    Material Weakness Repeat

Programs in Audit

ALN Program Name Expenditures
84.268 Federal Direct Student Loans $16.34M
93.461 Covid-19 Hrsa Covid-19 Claims Reimbursement for the Uninsured Program and the Covid-19 Coverage Assistance Fund $2.38M
93.397 Cancer Centers Support Grants $1.59M
93.307 Minority Health and Health Disparities Research $1.08M
93.398 Cancer Research Manpower $769,839
93.283 Centers for Disease Control and Prevention_investigations and Technical Assistance $692,494
93.884 Primary Care Training and Enhancement $650,442
93.310 Trans-Nih Research Support $612,862
93.353 21st Century Cures Act - Beau Biden Cancer Moonshot $598,336
93.837 Cardiovascular Diseases Research $561,838
93.838 Lung Diseases Research $467,616
14.157 Supportive Housing for the Elderly $460,426
93.859 Biomedical Research and Research Training $436,170
93.855 Allergy and Infectious Diseases Research $371,120
93.840 Translation and Implementation Science Research for Heart, Lung, Blood Diseases, and Sleep Disorders $365,369
93.847 Diabetes, Digestive, and Kidney Diseases Extramural Research $361,281
93.351 Research Infrastructure Programs $320,374
93.396 Cancer Biology Research $271,331
93.068 Chronic Diseases: Research, Control, and Prevention $260,041
93.286 Discovery and Applied Research for Technological Innovations to Improve Human Health $248,739
93.U01 Military Health Professions Scholarships $232,645
16.560 National Institute of Justice Research, Evaluation, and Development Project Grants $219,911
93.839 Blood Diseases and Resources Research $207,750
14.871 Section 8 Housing Choice Vouchers $187,392
93.113 Environmental Health $180,871
93.889 National Bioterrorism Hospital Preparedness Program $180,824
93.846 Arthritis, Musculoskeletal and Skin Diseases Research $162,288
93.867 Vision Research $151,936
93.233 National Center on Sleep Disorders Research $142,702
93.394 Cancer Detection and Diagnosis Research $118,257
16.575 Crime Victim Assistance $115,942
93.279 Drug Abuse and Addiction Research Programs $101,936
93.242 Mental Health Research Grants $98,952
43.003 Exploration $95,109
93.301 Small Rural Hospital Improvement Grant Program $85,704
64.RD Contract $85,551
93.361 Nursing Research $76,937
12.910 Research and Technology Development $70,656
93.213 Research and Training in Complementary and Integrative Health $65,280
47.074 Biological Sciences $64,069
93.360 Biomedical Advanced Research and Development Authority (barda), Biodefense Medical Countermeasure Development $54,695
93.121 Oral Diseases and Disorders Research $50,672
47.070 Computer and Information Science and Engineering $49,308
93.393 Cancer Cause and Prevention Research $48,222
93.433 Acl National Institute on Disability, Independent Living, and Rehabilitation Research $42,785
93.865 Child Health and Human Development Extramural Research $41,125
93.110 Maternal and Child Health Federal Consolidated Programs $39,588
93.173 Research Related to Deafness and Communication Disorders $32,640
93.172 Human Genome Research $31,531
47.041 Engineering $31,522
93.866 Aging Research $31,099
43.001 Science $31,004
93.879 Medical Library Assistance $29,950
93.134 Grants to Increase Organ Donations $29,590
47.049 Mathematical and Physical Sciences $28,601
93.080 Blood Disorder Program: Prevention, Surveillance, and Research $27,068
12.GSA_MIGRATION Contract $21,585
93.399 Cancer Control $21,196
93.273 Alcohol Research Programs $16,734
12.420 Military Medical Research and Development $13,853
84.063 Federal Pell Grant Program $13,537
93.RD Contract $12,871
93.354 Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis Response $10,696
93.350 National Center for Advancing Translational Sciences $8,706
43.GSA_MIGRATION Contract $8,631
93.103 Food and Drug Administration_research $8,390
47.079 Office of International Science and Engineering $8,063
93.989 International Research and Research Training $5,726
93.368 21st Century Cures Act - Precision Medicine Initiative $4,179
93.226 Research on Healthcare Costs, Quality and Outcomes $3,981
93.395 Cancer Treatment Research $3,652
12.300 Basic and Applied Scientific Research $2,364
47.076 Stem Education (formerly Education and Human Resources) $1,316
93.318 Protecting and Improving Health Globally: Building and Strengthening Public Health Impact, Systems, Capacity and Security $624
93.853 Extramural Research Programs in the Neurosciences and Neurological Disorders $121