Finding Text
Finding 2022-002 ? Information Technology General Controls Identification of the federal program: Federal Program: Student Financial Assistance Cluster: Federal Pell Grant Program (Assistance Listing No. 84.063) and Federal Direct Student Loans (Assistance Listing No. 84.268) Federal Agency: United States Department of Education BJC HealthCare Location: Goldfarb School of Nursing Award Periods: January 1, 2022 through June 30, 2022 (included in award year July 1, 2021 through June 30, 2022), and July 1, 2022 through December 31, 2022 (included in award year July 1, 2022 through June 30, 2023) Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control: ?The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: BJC HealthCare did not implement all logical access controls that are required to be in place to support effective information technology general controls (ITGCs) for the Banner application. The controls that were not specifically implemented during the current period relate to user access review, user provisioning and user termination processes. As a result, Banner ITGCs, and therefore, Banner application controls, cannot be relied upon in the period of audit. Cause: Management did not appropriately implement a user access review for the period under audit. Effect or potential effect: There is a risk the data relevant to the Student Financial Assistance Cluster program stored within the student financial aid system may be inappropriately created or modified. Effective testing of the required logical access controls is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period. Questioned costs: None. Context: Total expenditures for the Student Financial Assistance Cluster were $7,830,734 for the year ended December 31, 2022. Identification as a repeat finding, if applicable: This is a not a repeat finding from the prior year. Recommendation: Management should complete a user access review, including user provisioning and user termination processes, and retain documentation of the operation of controls. Views of responsible officials: Management agrees with the finding. GSON formalized a policy and procedure document regarding access controls to support effective ITGCs for the Banner application. A formal user access review will be completed semi-annually and results of the review, including actions taken, will be formally documented.