Finding Text
2022 ? 002: GLBA Risk Assessment Requirements Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: The institution is required to perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other system failures. In addition, each institution has to document a safeguard for each risk identified from the criteria noted. Condition: As of June 30, 2022, the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. This was noted from our review of the information technology policies and procedures. Cause: The University is working with an outside service provider to formally document the risk assessment and required safeguards to ensure compliance with the stated criteria. That process had not been completed as of June 30, 2022. Effect: The University was not in compliance with the statement criteria as of June 30, 2022. Repeat Finding: No Recommendation: We recommend that the University continue to work with the outside service provider to ensure compliance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.