Finding 30137 (2022-002)

Finding 2022-02 General Information Technology Controls Federal Agency: U.S. Department of Education Program Name: Student Financial Aid Cluster CFDA Number: Various Grant Identification Number: Various Grant Award Period: July 1, 2021 through June 30, 2022 Criteria The 2 CFR Section 200.303 requires that non federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition Found During test work performed over the Student Financial Aid Cluster, we noted that within the student information system (the system), certain general information technology controls surrounding change management and user access appeared to be missing or ineffectively designed. Specifically, users with certain administrative access rights have access to the underlying source code of the system and could implement changes directly in the system. There were no monitoring controls over these accounts regarding source code changes. In addition, the password to certain administrative accounts that are used to provision/de provision user access is not routinely changed, and thus could result in employees with inappropriate access. Cause A new student information system was implemented resulting in controls which previously were manual in nature, being replaced with automated controls within the system. As automated control reliance on the system increased, monitoring of system changes and policies surrounding access to administrator and super user accounts were not adequately considered or developed consistent with overall information technology policies and procedures in place at MCW. Effect If controls surrounding change management and user access are ineffectively designed, student financial aid may be disbursed in the incorrect amount or to a student who does not meet the eligibility requirements as stated in the Compliance Supplement. Questioned Costs None Statistically Valid Sample The sample was not intended to be, and was not, a statistically valid sample Repeat Finding Yes Recommendation We recommend MCW implement policies and procedures over monitoring of student financial aid system changes and user access. Management?s Response While manual controls mitigated the disbursement of an incorrect amount or disbursement to a student who does not meet the eligibility requirements, MCW concurs and has put significant effort into adding additional change management and user access controls to the student information system. As stated above, these conditions occurred when MCW changed student information systems and began relying more heavily on automated controls within the student information system, instead of solely relying on manual controls outside of the system. Two areas that needed to be addressed were related to general information technology controls: 1. Users with certain administrative access rights have access to the underlying source code of the system and lack monitoring controls over these accounts regarding source code changes. 2. Password requirements for certain administrative accounts were not routinely changed. As of May 10, 2022, MCW implemented controls to address the matters noted above.