Finding 1061856 (2023-002)

Criteria or specific requirement: 2 CFR 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures in place to ensure terminated employees are removed from the State system within a reasonable timeframe. Condition: During our testing, we noted 2 employees out of 6 tested, who were not removed from the County Benefits Management System (CBMS) within a reasonable timeframe after employment change at the County. Questioned costs: No known questioned costs. Context: During our testing over terminated users within CBMS, we noted the County did not have a compensating control in place to ensure that employees were removed from CBMS after the change in employment occurred. One employee was separated from the County in 2022, requested by the County to the State to be removed from CBMS in 2022, but was not removed from CBMS until 2023. The County did not check the employee was properly removed from the system until 2023. The second employee was terminated from the County in 2023 and was not requested by the County to the State to be removed from CBMS until 2024. Cause: The County did not have a compensating control to ensure that State accounts are offboarded when employees separate from the County or change departments that do not require them to keep their CBMS access. Effect: Employees who are terminated or no longer require access to the system, who continue to have access after termination could make changes within CBMS that impact the County’s financials and spending. Repeat Finding: This is not a repeat finding. Recommendation: We recommend the County implement a control to ensure the State accounts are offboarded when employees separate employment or move departments that do not require them to keep CBMS access. Views of responsible officials: There is no disagreement with the audit finding.