FY 2020 ED Financial Statement Audit

Submitting OIG:

Report Description:

Management is responsible for the preparation and fair presentation of these consolidated financial statements in accordance with U.S. generally accepted accounting principles; this includes the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of consolidated financial statements that are free from material misstatement, whether due to fraud or error.

Date Issued:

Monday, November 16, 2020

Agency Reviewed / Investigated:

Department of Education

Submitting OIG-Specific Report Number:

A17U0001

Component, if applicable:

Office of Chief Financial Officer

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

View Document:

Attachment	Size
FY-2020-ED-Financial-Statement-Audit.pdf	9.16 MB

Additional Details Link:

https://www2.ed.gov/about/reports/annual/2020report/agency-financial-report.pdf

Recommendation Number	Recommendation Status	Significant Recommendation
1.1	Open	Yes
We recommend that the Department and FSA strengthen the risk assessment process by considering the impact of IT control deficiencies on internal controls over the reliability of information in the Department’s IT systems. Such considerations should be documented.
1.2	Open	Yes
We recommend that the Department and FSA design and implement additional controls, over the completeness and accuracy of the underlying data used to develop the re-estimate.
2.1	Open	Yes
We recommend that the Department evaluate, develop, and implement a formal process to track and report all new and separated contractors.
2.2	Open	Yes
We recommend that the Department ensure separated contractors are off-boarded and system personnel are notified in a timely manner to disable or remove access to IT resources.
2.3	Open	Yes
We recommend that the Department provide training and oversight to Education personnel with on/off-boarding responsibilities to help ensure new/separated contractors are properly tracked.
2.4	Open	Yes
We recommend that FSA validate that financial and mixed system security plans have identified and documented the required security controls and control enhancements and the control implementation statuses in the plans as required by NIST SP 800-53. Additionally, implement a quality review process of the system security plans prior to signing the plans to ensure compliance with NIST 800-53 requirements.
2.5	Open	Yes
We recommend that FSA implement a process to evaluate the significance of a deficiency by considering the magnitude of impact, likelihood of occurrence, and nature of the deficiency and tailor the corrective actions to remediate the risk and address the root cause. Further, update guidance to ensure that quality reviews over the POA&M closure documentation are conducted to confirm the noted deficiencies are fully addressed to help prevent future reoccurrences.
2.6	Open	Yes
We recommend that FSA Formally develop and implement a quality control review process to ensure that the application change control process is followed completely and accurately to validate that changes were tested and approved prior to migration and post implementation validation was performed, the relevant documentation and approvals are verified prior to closing the change ticket, as required by policy, and supporting documentation is retained.
2.7	Open	Yes
We recommend that FSA ensure segregation of duties and least privilege principles are adhered to when granting user access to prevent users with the ability to develop and/or change application code from having update access to the environment where the final tested and approved changes are staged prior to migration to the financial and mixed systems’ production environment; and prevent users with access to develop code from having update access to the production environment.
3.1	Open	Yes
We recommend that FSA enhance their risk assessment to identify risks impacting financial reporting processes.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

1.1

Open

Yes

We recommend that the Department and FSA strengthen the risk assessment process by considering the impact of IT control deficiencies on internal controls over the reliability of information in the Department’s IT systems. Such considerations should be documented.

1.2

Open

Yes

We recommend that the Department and FSA design and implement additional controls, over the completeness and accuracy of the underlying data used to develop the re-estimate.