FY 2022 ED Financial Statement Audit

Submitting OIG:

Report Description:

In accordance with the GPRA Modernization Act of 2010, the Department’s framework for performance management begins with the Strategic Plan, which serves as the foundation for establishing and implementing priorities, highlighting performance goals and objectives, and developing performance indicators to gauge progress and outcomes. Progress toward the Department’s strategic goals and its two-year Agency Priority Goals (APGs) are measured using data-driven review and analysis.

Date Issued:

Monday, January 23, 2023

Agency Reviewed / Investigated:

Department of Education

Submitting OIG-Specific Report Number:

A22FS0064

Component, if applicable:

Office of Chief Financial Officer

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

View Document:

Attachment	Size
FY-2022-ED-Financial-Statement-Audit.pdf	14.97 MB

Additional Details Link:

https://www2.ed.gov/about/reports/annual/2022report/agency-financial-report.pdf

Recommendation Number	Recommendation Status	Significant Recommendation
1.1	Open	Yes
We recommend that management design and implement controls that require the validation of the relevance and reliability of underlying data used in developing the assumptions related to the subsidy cost estimates. Such review should be documented and maintained.
2.1	Open	Yes
We recommend that the Department evaluate, develop, and implement a formal process to track and report all new and separated contractors.
2.10	Open	Yes
We recommend that the Department adhere to the SSP control requirements and avoid the use of generic and shared accounts. If generic and shared accounts are required, obtain a formal risk acceptance and develop a policy and procedure to: • Authorize the use of these accounts by approved personnel, • Control who can access the generic/shared accounts and those sensitive actions performed by the accounts are logged and reviewed every time the accounts are used, and • Require that generic/shared accounts’ passwords are changed each time approved personnel separate or transfer from the Department.
2.11	Open	Yes
We recommend that FSA implement a process to evaluate the magnitude of impact, likelihood of occurrence, and nature of the deficiency in order to tailor the corrective actions to remediate the risk and address the root cause. Further, update guidance to ensure that quality reviews over the POA&M closure documentation are conducted to confirm the noted deficiencies are fully addressed to help prevent future reoccurrences.
2.12	Open	Yes
We recommend that FSA formally develop and implement a quality control review process to ensure that logical access control processes are followed completely and accurately to validate logical access requests, reviews, and recertifications.
2.13	Open	Yes
We recommend that FSA ensure segregation of duties and least privilege principles are adhered to when granting user access to prevent users from having the ability to develop and/or change application code and having update access to the environment where the final tested and approved changes are staged prior to migration to the production environment; and prevent users with access to develop code from having update access to the production environment.
2.14	Open	Yes
We recommend that FSA evaluate and update the access review control process based on risk and enforce segregation of duties.
2.15	Open	Yes
We recommend that FSA reconcile the list of users’ roles and responsibilities per the identity and access software tools to the lists that reside in each system accessed by such users.
2.16	Open	Yes
We recommend that FSA update access review procedures to require the reviewer to verify the access list, received to be used in the performance of the access reviews, is complete and accurate and not modified prior to commencing the access reviews.
2.17	Open	Yes
We recommend that FSA enforce established access authorization controls and ensure all requirements are met prior to granting access to systems.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

1.1

Open

Yes

We recommend that management design and implement controls that require the validation of the relevance and reliability of underlying data used in developing the assumptions related to the subsidy cost estimates. Such review should be documented and maintained.

2.1

Open

Yes

We recommend that the Department evaluate, develop, and implement a formal process to track and report all new and separated contractors.