FY 2023 U.S. Department of Education Financial Statement Audit

Submitting OIG:

Report Description:

The Chief Financial Officers Act of 1990 requires the Inspector General to audit the agency’s financial statements each year, which is intended to help improve an agency’s financial management and controls over financial reporting. For FY 2023, the independent auditor issued a disclaimer of opinion as it was not able to obtain sufficient appropriate audit evidence to provide a basis for an audit opinion because of unresolved errors identified in the underlying data used to calculate the subsidy re-estimates for the Department’s direct loan and loan guaranty programs. The auditors identified one material weakness related to the Department’s Direct and FFEL student loan portfolios, and two significant deficiencies related to information technology controls and entity-level controls. The auditors also noted the Department did not substantially meet requirements of the Federal Managers Financial Integrity Act. See page 100 for the audit.

Date Issued:

Thursday, November 16, 2023

Agency Reviewed / Investigated:

Department of Education

Submitting OIG-Specific Report Number:

A23FS0127

Component, if applicable:

Office of Finance and Operations

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

View Document:

Attachment	Size
FY24Financial-Report-FY2023012924SECUREDv100.pdf	9.73 MB

Recommendation Number	Recommendation Status	Significant Recommendation
1.1	Open	Yes
We recommend that management design and implement controls that require the validation of the relevance and reliability of underlying data used in developing the assumptions related to the subsidy re-estimates. Such review should be documented and maintained.
2.1	Open	Yes
We recommend that the Department improve the risk assessment process over IT to help ensure the Department is appropriately defining objectives to enable the identification of risks and associated controls to help mitigate the risks.
2.10	Open	Yes
We recommend that the Department ensure the database and server layer controls comply and operate with the disabling of inactive accounts and account lockout duration password setting requirements, as required by Department Policy.
2.11	Open	Yes
We recommend that the Department adhere to the SSP control requirements and avoid the use of generic and shared accounts. If generic and shared accounts are required, obtain a formal risk acceptance and develop a policy and procedure to: a. Authorize the use of these accounts by approved personnel, b. Control who can access the generic/shared accounts and those sensitive actions performed by the accounts are logged and reviewed every time the accounts are used, and c. Require that generic/shared accounts’ passwords are changed each time approved personnel separate or transfer from the Department.
2.12	Open	Yes
We recommend that FSA design and implement improvements for the risk assessment process over IT to help ensure the FSA is appropriately defining objectives to enable the identification of risks and associated controls to help mitigate the risks.
2.13	Open	Yes
We recommend that FSA design and implement controls to evaluate the magnitude of impact, likelihood of occurrence, and nature of the deficiency in order to tailor the corrective actions to remediate the risk and address the root cause. Further, update guidance to ensure that quality reviews over the POA&M closure documentation are conducted to confirm the noted deficiencies are fully addressed to help prevent future reoccurrences.
2.14	Open	Yes
We recommend that FSA formally develop and implement a quality control review process to ensure that logical access control processes are followed completely and accurately to validate logical access requests, reviews, and recertifications.
2.15	Open	Yes
We recommend that FSA ensure segregation of duties and least privilege principles are adhered to when granting user access.
2.16	Open	Yes
We recommend that FSA evaluate and update the access review controls based on risk and enforce segregation of duties.
2.17	Open	Yes
We recommend that FSA reconcile the list of users’ roles and responsibilities from the identity and access software tools to the lists that reside in each system accessed by such users.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

1.1

Open

Yes

We recommend that management design and implement controls that require the validation of the relevance and reliability of underlying data used in developing the assumptions related to the subsidy re-estimates. Such review should be documented and maintained.

2.1

Open

Yes

We recommend that the Department improve the risk assessment process over IT to help ensure the Department is appropriately defining objectives to enable the identification of risks and associated controls to help mitigate the risks.