FAC Explorer

Finding 449981 (2022-003)

Material Weakness Repeat Finding
Requirement
N
Questioned Costs
-
Year
2022
Accepted
2023-08-08
Audit: 313337
Organization: Mayo Clinic (MN)
Auditor: Ernst & Young LLP

AI Summary

  • Core Issue: The Clinic's security risk program did not assess the student financial aid system, leaving it vulnerable to risks.
  • Impacted Requirements: Compliance with GLBA and internal control standards under Section 200.303(a) and 16 CFR 314.4.
  • Recommended Follow-Up: Include student information systems in the annual risk assessment to ensure comprehensive security measures.

Finding Text

Finding 2022-003 ? Gramm-Leach-Bliley Act ? Student Information Security (GLBA)Identification of the federal program:Federal Agency: United States Department of EducationFederal Cluster: Student Financial AssistanceAward Periods: July 1, 2021 through June 30, 2022, and July 1, 2022 through June 30, 2023Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303(a) of the Uniform Guidance states the following regarding the auditee and internal control:?The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).?16 CFR 314.4(b) requires institutions to ?Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures.?16 CFR 314.4(c) requires institutions to ?Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards? key controls, systems, and procedures.?Condition:The Clinic has a security risk program in place that follows the National Institute of Standards and Technology (NIST) framework to assess its information technology risks. The program includes: (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and (3) detecting, preventing, and responding to attacks, intrusions, or other systems failures.However, for the student financial aid system used by the Clinic, the 2022 NIST risk assessment did not cover (2) information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and (3) detecting, preventing, and responding to attacks, intrusions, or other systems failures.Cause:The Clinic?s security risk program did not include the student financial aid information applications.Effect or potential effect:The absence of internal controls and policies and procedures could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of student account information.Questioned costs:None.Context:Under an institution?s Program Participation Agreement with the U.S. Department of Education and the GLBA, schools must protect student financial aid information, with particular attention to information provided to institutions by the U.S. Department of Education or otherwise obtained in support of the administration of the federal student financial aid programs. Total expenditures for the Student Financial Assistance Cluster were $16,350,962 for the year ended December 31, 2022.Identification as a repeat finding, if applicable:This finding is a repeat of Finding 2021-006 from the prior year.Recommendation:We recommend that the Clinic include the student information systems as part of its annual enterprise-wide risk assessment.Views of responsible officials:Mayo Clinic Office of Information Security created a corrective action plan in the Fall of 2022. The corrective action plan has been fully implemented as of May 2023. The Department of Education reviewed the corrective action plan and concluded it acceptable to address the auditor finding from audit year 2021.

Corrective Action Plan

Finding 2022-003Federal Program InformationFederal Agency: United States Department of EducationFederal Cluster: Student Financial AssistanceAward Periods: July 1, 2021 through June 30, 2022, and July 1, 2022 through June 30, 2023Corrective Action PlannedManagement agrees that Banner, the primary information system used to capture Federal Direct Loan information, was not specifically identified in the Mayo Clinic Information Security annual risk assessment which was primarily designed for compliance with The Health Insurance Portability and Accountability Act (HIPAA) Security rule.The following steps have been completed to address the gap identified:1. Compared the scope of the Mayo Clinic Information Security annual risk assessment and the requirements of the Department of Education, under the Gramm-Leach-Bliley Act and identified any gaps.2. Edited the existing annual risk assessment to close the gaps.3. Completed the risk assessment.Persons Responsible for Corrective ActionSarah Tyson, Senior Manager?Office of Information SecurityTarget Completion DateMay 31, 2023

Categories

Subrecipient Monitoring Matching / Level of Effort / Earmarking Internal Control / Segregation of Duties

Other Findings in this Audit

  • 449980 2022-001
    Material Weakness
  • 449982 2022-004
    Significant Deficiency Repeat
  • 449983 2022-005
    Significant Deficiency Repeat
  • 449984 2022-001
    Material Weakness
  • 449985 2022-003
    Material Weakness Repeat
  • 449986 2022-004
    Significant Deficiency Repeat
  • 449987 2022-005
    Significant Deficiency Repeat
  • 449988 2022-002
    Significant Deficiency
  • 449989 2022-007
    Material Weakness Repeat
  • 449990 2022-007
    Material Weakness Repeat
  • 449991 2022-007
    Material Weakness Repeat
  • 449992 2022-002
    Significant Deficiency
  • 449993 2022-007
    Material Weakness Repeat
  • 449994 2022-007
    Material Weakness Repeat
  • 449995 2022-007
    Material Weakness Repeat
  • 449996 2022-002
    Significant Deficiency
  • 449997 2022-007
    Material Weakness Repeat
  • 449998 2022-007
    Material Weakness Repeat
  • 449999 2022-002
    Significant Deficiency
  • 450000 2022-007
    Material Weakness Repeat
  • 450001 2022-007
    Material Weakness Repeat
  • 450002 2022-007
    Material Weakness Repeat
  • 450003 2022-007
    Material Weakness Repeat
  • 450004 2022-007
    Material Weakness Repeat
  • 450005 2022-007
    Material Weakness Repeat
  • 450006 2022-007
    Material Weakness Repeat
  • 450007 2022-007
    Material Weakness Repeat
  • 450008 2022-007
    Material Weakness Repeat
  • 450009 2022-007
    Material Weakness Repeat
  • 450010 2022-007
    Material Weakness Repeat
  • 1026422 2022-001
    Material Weakness
  • 1026423 2022-003
    Material Weakness Repeat
  • 1026424 2022-004
    Significant Deficiency Repeat
  • 1026425 2022-005
    Significant Deficiency Repeat
  • 1026426 2022-001
    Material Weakness
  • 1026427 2022-003
    Material Weakness Repeat
  • 1026428 2022-004
    Significant Deficiency Repeat
  • 1026429 2022-005
    Significant Deficiency Repeat
  • 1026430 2022-002
    Significant Deficiency
  • 1026431 2022-007
    Material Weakness Repeat
  • 1026432 2022-007
    Material Weakness Repeat
  • 1026433 2022-007
    Material Weakness Repeat
  • 1026434 2022-002
    Significant Deficiency
  • 1026435 2022-007
    Material Weakness Repeat
  • 1026436 2022-007
    Material Weakness Repeat
  • 1026437 2022-007
    Material Weakness Repeat
  • 1026438 2022-002
    Significant Deficiency
  • 1026439 2022-007
    Material Weakness Repeat
  • 1026440 2022-007
    Material Weakness Repeat
  • 1026441 2022-002
    Significant Deficiency
  • 1026442 2022-007
    Material Weakness Repeat
  • 1026443 2022-007
    Material Weakness Repeat
  • 1026444 2022-007
    Material Weakness Repeat
  • 1026445 2022-007
    Material Weakness Repeat
  • 1026446 2022-007
    Material Weakness Repeat
  • 1026447 2022-007
    Material Weakness Repeat
  • 1026448 2022-007
    Material Weakness Repeat
  • 1026449 2022-007
    Material Weakness Repeat
  • 1026450 2022-007
    Material Weakness Repeat
  • 1026451 2022-007
    Material Weakness Repeat
  • 1026452 2022-007
    Material Weakness Repeat

Programs in Audit

ALN Program Name Expenditures
84.268 Federal Direct Student Loans $16.34M
93.461 Covid-19 Hrsa Covid-19 Claims Reimbursement for the Uninsured Program and the Covid-19 Coverage Assistance Fund $2.38M
93.397 Cancer Centers Support Grants $1.59M
93.307 Minority Health and Health Disparities Research $1.08M
93.398 Cancer Research Manpower $769,839
93.283 Centers for Disease Control and Prevention_investigations and Technical Assistance $692,494
93.884 Primary Care Training and Enhancement $650,442
93.310 Trans-Nih Research Support $612,862
93.353 21st Century Cures Act - Beau Biden Cancer Moonshot $598,336
93.837 Cardiovascular Diseases Research $561,838
93.838 Lung Diseases Research $467,616
14.157 Supportive Housing for the Elderly $460,426
93.859 Biomedical Research and Research Training $436,170
93.855 Allergy and Infectious Diseases Research $371,120
93.840 Translation and Implementation Science Research for Heart, Lung, Blood Diseases, and Sleep Disorders $365,369
93.847 Diabetes, Digestive, and Kidney Diseases Extramural Research $361,281
93.351 Research Infrastructure Programs $320,374
93.396 Cancer Biology Research $271,331
93.068 Chronic Diseases: Research, Control, and Prevention $260,041
93.286 Discovery and Applied Research for Technological Innovations to Improve Human Health $248,739
93.U01 Military Health Professions Scholarships $232,645
16.560 National Institute of Justice Research, Evaluation, and Development Project Grants $219,911
93.839 Blood Diseases and Resources Research $207,750
14.871 Section 8 Housing Choice Vouchers $187,392
93.113 Environmental Health $180,871
93.889 National Bioterrorism Hospital Preparedness Program $180,824
93.846 Arthritis, Musculoskeletal and Skin Diseases Research $162,288
93.867 Vision Research $151,936
93.233 National Center on Sleep Disorders Research $142,702
93.394 Cancer Detection and Diagnosis Research $118,257
16.575 Crime Victim Assistance $115,942
93.279 Drug Abuse and Addiction Research Programs $101,936
93.242 Mental Health Research Grants $98,952
43.003 Exploration $95,109
93.301 Small Rural Hospital Improvement Grant Program $85,704
64.RD Contract $85,551
93.361 Nursing Research $76,937
12.910 Research and Technology Development $70,656
93.213 Research and Training in Complementary and Integrative Health $65,280
47.074 Biological Sciences $64,069
93.360 Biomedical Advanced Research and Development Authority (barda), Biodefense Medical Countermeasure Development $54,695
93.121 Oral Diseases and Disorders Research $50,672
47.070 Computer and Information Science and Engineering $49,308
93.393 Cancer Cause and Prevention Research $48,222
93.433 Acl National Institute on Disability, Independent Living, and Rehabilitation Research $42,785
93.865 Child Health and Human Development Extramural Research $41,125
93.110 Maternal and Child Health Federal Consolidated Programs $39,588
93.173 Research Related to Deafness and Communication Disorders $32,640
93.172 Human Genome Research $31,531
47.041 Engineering $31,522
93.866 Aging Research $31,099
43.001 Science $31,004
93.879 Medical Library Assistance $29,950
93.134 Grants to Increase Organ Donations $29,590
47.049 Mathematical and Physical Sciences $28,601
93.080 Blood Disorder Program: Prevention, Surveillance, and Research $27,068
12.GSA_MIGRATION Contract $21,585
93.399 Cancer Control $21,196
93.273 Alcohol Research Programs $16,734
12.420 Military Medical Research and Development $13,853
84.063 Federal Pell Grant Program $13,537
93.RD Contract $12,871
93.354 Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis Response $10,696
93.350 National Center for Advancing Translational Sciences $8,706
43.GSA_MIGRATION Contract $8,631
93.103 Food and Drug Administration_research $8,390
47.079 Office of International Science and Engineering $8,063
93.989 International Research and Research Training $5,726
93.368 21st Century Cures Act - Precision Medicine Initiative $4,179
93.226 Research on Healthcare Costs, Quality and Outcomes $3,981
93.395 Cancer Treatment Research $3,652
12.300 Basic and Applied Scientific Research $2,364
47.076 Stem Education (formerly Education and Human Resources) $1,316
93.318 Protecting and Improving Health Globally: Building and Strengthening Public Health Impact, Systems, Capacity and Security $624
93.853 Extramural Research Programs in the Neurosciences and Neurological Disorders $121