Fiscal Year 2021 Agency Financial Statement - U.S. Department of Education

Submitting OIG:

Report Description:

KPMG LLP audited the consolidated financial statements of the United States Department of Education, which comprise the consolidated balance sheets as of September 30, 2021 and 2020, and the related consolidated statements of net cost, and changes in net position, and combined statements of budgetary resources for the years then ended, and related notes to the consolidated financial statements.

Date Issued:

Friday, November 19, 2021

Agency Reviewed / Investigated:

Department of Education

Submitting OIG-Specific Report Number:

A21FS0021

Component, if applicable:

Office of Chief Financial Officer

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

View Document:

Attachment	Size
FY22FY2021-Department-Financial-Report021624v100SECURED.pdf	9.64 MB

Additional Details Link:

https://www2.ed.gov/about/reports/annual/2021report/agency-financial-report.pdf

Recommendation Number	Recommendation Status	Significant Recommendation
1.1	Open	Yes
We recommend that the Department and FSA, strengthen the risk assessment process by considering the impact of IT control deficiencies on internal controls over the reliability of information in the Department’s IT systems. Such considerations should be documented.
1.2	Open	Yes
We recommend that the Department and FSA, design and implement additional review controls that operate at a sufficient level of precision over the completeness and accuracy of the underlying data used to develop the re-estimate.
1.3	Open	Yes
We recommend that the Department and FSA, ensure proper documentation of controls identified to evidence the review, the conclusion and actions to be taken to address outstanding differences and/or matters to be researched.
2.1	Open	Yes
We recommend that the Department, evaluate, develop, and implement a formal process to track and report all new and separated contractors.
2.2	Open	Yes
We recommend that the Department, ensure separated contractors are off-boarded and system personnel are notified in a timely manner to disable or remove access to IT resources.
2.3	Open	Yes
We recommend that the Department, provide training and oversight to Education personnel with on/off-boarding responsibilities to help ensure new/separated contractors are properly tracked.
2.4	Open	Yes
We recommend that FSA, implement a process to evaluate the significant of a deficiency by considering the magnitude of impact, likelihood of occurrence, and nature of the deficiency and tailor the corrective actions to remediate the risk and address the root cause. Further, update guidance to ensure that quality reviews over the POA&M closure documentation are conducted to confirm the noted deficiencies are fully addressed to help prevent future reoccurrences.
2.5	Open	Yes
We recommend that FSA, formally develop and implement a quality control review process to ensure that logical access control processes are followed completely and accurately to validate logical access requests, reviews, and recertifications.
2.6	Open	Yes
We recommend that FSA, ensure segregation of duties and least privilege principles are adhered to when grants user access to prevent users with the ability to develop and/or change application code from having update access to the environment where the final tested and approved changes are staged prior to migration to the financial and mixed systems’ production environment; and prevent users with access to develop code from having update access to the production environment.
2.7	Open	Yes
We recommend that FSA, ensure a complete and accurate population of application changes can be provided. Formally develop and implement a quality control review process to ensure that the application change control process is followed and consistently and accurately documented.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

1.1

Open

Yes

We recommend that the Department and FSA, strengthen the risk assessment process by considering the impact of IT control deficiencies on internal controls over the reliability of information in the Department’s IT systems. Such considerations should be documented.

1.2

Open

Yes

We recommend that the Department and FSA, design and implement additional review controls that operate at a sufficient level of precision over the completeness and accuracy of the underlying data used to develop the re-estimate.