13.07.2015 Views

Federal Award Findings, Questioned Costs and Corrective Action Plan

Federal Award Findings, Questioned Costs and Corrective Action Plan

Federal Award Findings, Questioned Costs and Corrective Action Plan

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

<strong>Federal</strong> <strong>Award</strong> <strong>Findings</strong>, <strong>Questioned</strong> <strong>Costs</strong> <strong>and</strong> <strong>Corrective</strong> <strong>Action</strong> <strong>Plan</strong>(Reformatted from FY 2009 Single Audit Report)Special Education Cluster (IDEA):CFDA No.: 84.027 Special Education—Grants to States, #s H027A060007, H027A070007, <strong>and</strong>H027A08000784.173 Special Education—Preschool Grants, #s H173A060003, H173A070003, <strong>and</strong>H173A080003CFDA No.: 84.367 Improving Teacher Quality State Grants, #s S367A060049, S367B060003, S367A070049,S367B070003, S367A080049, <strong>and</strong> S367B080003U.S. Department of Education<strong>Award</strong> Period: July 1, 2006 through September 30, 2007July 1, 2007 through September 30, 2008July 1, 2008 through September 30, 2009Activities Allowed or Unallowed, Allowable <strong>Costs</strong>/Cost Principles, Cash Management, Reporting, <strong>and</strong>Subrecipient Monitoring<strong>Questioned</strong> Cost: UnknownFindingCriteria: States should have effective computer access controls to prevent <strong>and</strong> detect unauthorized use, damage,loss, or modification of data, including sensitive <strong>and</strong> confidential information.Condition <strong>and</strong> context: The Department of Education’s Child Nutrition Program (CNP) Web application, GrantsManagement Enterprise System (Grants Management), the Arizona Local Education Agency Tracker (ALEAT),<strong>and</strong> the School Finance applications were used by internal <strong>and</strong> external users to apply for, approve, <strong>and</strong> disbursefederal grant awards; record federal award expenditures <strong>and</strong> budget information; <strong>and</strong> report <strong>and</strong> monitorcompliance with federal requirements. The Department granted logical access for these systems <strong>and</strong> applicationsto its users through a centralized gateway. Auditors tested access controls <strong>and</strong> determined that there wereinadequate controls over logical access to these systems. Specifically, auditors noted the following deficiencies:• For 5 of 15 employee users tested for Grants Management, the Department did not have documentationauthorizing the user’s access. Specifically, there was no documentation of approval <strong>and</strong> the access levelsgranted. Further, 4 of these employees had access rights that were incompatible with their job responsibilitiesor that allowed them to change data without supervisory review or approval.• For 4 of 5 employee users tested for the CNP Web application, the Department did not have documentationauthorizing the user’s access. Specifically, there was no documentation of approval <strong>and</strong> the access levelsgranted.• For 2 of 48 external users tested for the CNP Web application, the Department did not have documentationauthorizing the user’s access.• The Department did not require users to periodically change passwords for the centralized gateway.• The Department did not have procedures in place to obtain <strong>and</strong> retain documentation of access granted toexternal users of the ALEAT <strong>and</strong> School Finance applications, including the Student AccountabilityInformation System (SAIS).Effect: There is a risk of noncompliance with federal requirements <strong>and</strong> of theft, manipulation, or misuse ofconfidential or sensitive data by unauthorized users or by users who were not monitored. It was not practical toextend our auditing procedures sufficiently to determine questioned costs, if any, that may have resulted from thisfinding. This finding is a material weakness in internal control over compliance with the programs’ <strong>and</strong> clusters’activities allowed or unallowed, allowable costs/cost principles, cash management, reporting, <strong>and</strong> subrecipientmonitoring requirements. In addition, this finding could potentially affect other federal programs, includingARRA programs, the Department administered.27

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!