FAC Explorer

Finding 1158190 (2024-004)

Material Weakness Repeat Finding
Requirement
N
Questioned Costs
-
Year
2024
Accepted
2025-09-30
Audit: 370096
Organization: Atrium Health, Inc. (NC)
Auditor: Ernst and Young LLP

AI Summary

  • Core Issue: Atrium Health CMHA lacks adequate internal controls and documentation for its Information Security Program, failing to meet GLBA requirements.
  • Impacted Requirements: Compliance with Section 200.303 of Title 2 U.S. Code and 16 CFR 314, which mandate effective internal controls and a comprehensive information security program.
  • Recommended Follow-up: Implement robust internal controls and ensure all GLBA requirements are documented and integrated into the Information Security Program.

Finding Text

Finding 2024-004: Gramm-Leach-Bliley Act (GLBA) – Student Information Security Controls. Identification of the Federal Program:Federal Agency: United States Department of Education. Federal Cluster: Student Financial Assistance Cluster. Assistance Listing No.: 84.268 Federal Direct Student Loans (Direct Loans), 84.063 Federal Pell Grant Program, 84.007 Federal Supplemental Education Opportunity Grant ProgramAward Periods: July 1, 2023 through June 30, 2024; July 1, 2024 through June 30, 2025. Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:“The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).”The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314).Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. Condition:Atrium Health CMHA did not have adequate internal controls in place surrounding the Information Security Program. During our testing, we noted there was no documentation retained to evidence that a review of certain elements of the Information Security Program was performed to ensure compliance with federal regulations. Additionally, the written Information Security Program did not address certain required elements per 16 CFR 314.4 to ensure compliance with federal regulations.Cause:Atrium Health CMHA did not retain sufficient documentation of their review procedures over certain elements of the Information Security Program. Atrium Health CMHA did not include certain required elements within its Information Security Program. Effect or Potential Effect:The written Information Security Program is not compliant with federal regulations. Questioned Costs:None. Context:Total federal expenditures for the Student Financial Assistance Cluster recorded on the Schedule of Expenditures of Federal Awards (Schedule) totaled $2,876,252 for the year ended December 31, 2024.Identification as a Repeat Finding, if Applicable:This finding is a repeat finding of 2023-005 from the prior year. Recommendation:Atrium Health CMHA should design and implement internal controls over the Information Security Program to ensure all requirements of the GLBA are included in the written Information Security Program appropriately.Views of Responsible Officials:Atrium Health CMHA management, as part of the 2025 process and procedures consulting engagement, will ensure that all GLBA requirements over the Information Security Program are both documented completely and inclusive in scope of both general CMHA IT systems as well as IT systems specific to the SFA program.

Corrective Action Plan

Corrective Action Plan: Atrium Health CMHA management, as part of the 2025 process and procedure consulting engagement, will ensure that all GLBA requirements over the Information Security Program are both documented completely and inclusive in scope of both general CMHA IT systems as well as IT systems specific to the SFA program. Proposed Completion Date: By December of 2025, Atrium Health CMHA management will complete the corrective action.

Categories

Student Financial Aid Matching / Level of Effort / Earmarking Allowable Costs / Cost Principles Reporting

Other Findings in this Audit

  • 1158177 2024-001
    Material Weakness Repeat
  • 1158178 2024-002
    Material Weakness Repeat
  • 1158179 2024-003
    Material Weakness Repeat
  • 1158180 2024-004
    Material Weakness Repeat
  • 1158181 2024-005
    Material Weakness Repeat
  • 1158182 2024-001
    Material Weakness Repeat
  • 1158183 2024-002
    Material Weakness Repeat
  • 1158184 2024-003
    Material Weakness Repeat
  • 1158185 2024-004
    Material Weakness Repeat
  • 1158186 2024-005
    Material Weakness Repeat
  • 1158187 2024-001
    Material Weakness Repeat
  • 1158188 2024-002
    Material Weakness Repeat
  • 1158189 2024-003
    Material Weakness Repeat
  • 1158191 2024-005
    Material Weakness Repeat
  • 1158192 2024-006
    Material Weakness Repeat

Programs in Audit

ALN Program Name Expenditures
97.036 Disaster Grants - Public Assistance (presidentially Declared Disasters) $257.94M
84.268 Federal Direct Student Loans $2.11M
84.063 Federal Pell Grant Program $736,444
93.253 Poison Center Support and Enhancement Grant $504,792
21.027 Coronavirus State and Local Fiscal Recovery Funds $429,221
93.958 Block Grants for Community Mental Health Services $373,139
93.078 Strengthening Emergency Care Delivery in the United States Healthcare System Through Health Information and Promotion $253,881
93.391 Activities to Support State, Tribal, Local and Territorial (stlt) Health Department Response to Public Health Or Healthcare Crises $239,599
12.420 Military Medical Research and Development $189,991
93.839 Blood Diseases and Resources Research $182,439
93.069 Public Health Emergency Preparedness $154,980
93.788 Opioid Str $116,081
16.575 Crime Victim Assistance $109,282
93.994 Maternal and Child Health Services Block Grant to the States $100,610
93.866 Aging Research $92,805
93.173 Research Related to Deafness and Communication Disorders $89,163
93.669 Child Abuse and Neglect State Grants $86,338
20.600 State and Community Highway Safety $68,610
93.RD4 Asymptomatic Cmv $58,130
93.855 Allergy, Immunology and Transplantation Research $54,000
93.837 Cardiovascular Diseases Research $51,600
14.250 Rural Housing and Economic Development $48,000
93.847 Diabetes, Digestive, and Kidney Diseases Extramural Research $36,125
10.310 Agriculture and Food Research Initiative (afri) $32,756
93.361 Nursing Research $32,240
93.RD5 Research on Viral Infections $29,234
93.273 Alcohol Research Programs $27,437
84.007 Federal Supplemental Educational Opportunity Grants $27,182
93.310 Trans-Nih Research Support $20,470
93.073 Birth Defects and Developmental Disabilities - Prevention and Surveillance $20,000
93.853 Extramural Research Programs in the Neurosciences and Neurological Disorders $15,600
93.838 Lung Diseases Research $9,300
93.RD6 Gateway for Cancer Research: T2016-002 $8,100
93.889 National Bioterrorism Hospital Preparedness Program $8,093
93.RD2 Chop_cog_agct1531 $7,400
93.846 Arthritis, Musculoskeletal and Skin Diseases Research $7,147
93.RD3 Ecog-Acrin Ea4151 $5,550
12.420 Novel Topical Antibiotic Therapy to Reduce Infection After Operative Treatment of Fracturesat High Risk of Infection: Tobra -A Multicenter Randomized, Controlled Trial $5,350
93.394 Cancer Detection and Diagnosis Research $4,991
12.420 Evaluation of the Diagnostic and Therapeutic Value of Tissue Ultrafiltration in Patients at Risk of Acs $4,578
16.753 Congressionally Recommended Awards $3,885
93.110 Maternal and Child Health Federal Consolidated Programs $3,813
93.395 Cancer Treatment Research $2,940
93.399 Cancer Control $2,800
93.226 Research on Healthcare Costs, Quality and Outcomes $2,644
93.145 Aids Education and Training Centers $1,933
93.RD1 Alliance A011202 $900
93.558 Temporary Assistance for Needy Families $-186
93.121 Oral Diseases and Disorders Research $-394
16.758 Improving the Investigation and Prosecution of Child Abuse and the Regional and Local Children's Advocacy Centers $-1,800
93.840 Translation and Implementation Science Research for Heart, Lung, Blood Diseases, and Sleep Disorders $-2,565
93.865 Child Health and Human Development Extramural Research $-3,172
93.323 Epidemiology and Laboratory Capacity for Infectious Diseases (elc) $-6,584
93.360 Biomedical Advanced Research and Development Authority (barda), Biodefense Medical Countermeasure Development $-13,481
93.137 Community Programs to Improve Minority Health Grant Program $-25,698