Finding Text
2023-009 Application Access Control – Significant Deficiency in internal control over compliance over reporting ALN and Title: 14.871 Section 8 Housing Choice Vouchers
Federal Agency: US Department of Housing and Urban Development Award Year: 2023 Criteria – NMAC 1.12.20.14 (A) Application Access Control, “Access to agency business and systems
applications shall be restricted to those individuals who have an identified business need to access those applications or systems in the performance of their job responsibilities.” ”In addition, Per Title 2 US Code of Federal Regulations Part 200.303a, the non-federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).
Condition – All the users for the Housing Authority within the “Housing Pro” software have
administrative level access. Cause – The Housing Authority gave all of their section 8 and public housing employees’ full access
within the “Housing Pro” software, without considering the need to modify user permission based on their job responsibilities. Effect – The users can access modules within the “Housing Pro” software for which their job duties
do not allow for. Questioned Costs - None Perspective –All employees have administrative access to the Housing Pro software. Recommendation – We recommend that the Housing Authority should review each employees’
access permissions within the “Housing Pro” software and modify their access according to their job responsibilities. Management Response: All employee access was reviewed and corrected so that only the two
Deputy Directors have administrative access. Estimated Completion Date: November 30, 2023 Responsible Party: Deputy Director