The Medical College of Wisconsin, IncHigher Education

Finding 2022-02 General Information Technology Controls Federal Agency: U.S. Department of Education Program Name: Student Financial Aid Cluster CFDA Number: Various Grant Identification Number: Various Grant Award Period: July 1, 2021 through June 30, 2022 Criteria The 2 CFR Section 200.303 requires that non federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition Found During test work performed over the Student Financial Aid Cluster, we noted that within the student information system (the system), certain general information technology controls surrounding change management and user access appeared to be missing or ineffectively designed. Specifically, users with certain administrative access rights have access to the underlying source code of the system and could implement changes directly in the system. There were no monitoring controls over these accounts regarding source code changes. In addition, the password to certain administrative accounts that are used to provision/de provision user access is not routinely changed, and thus could result in employees with inappropriate access. Cause A new student information system was implemented resulting in controls which previously were manual in nature, being replaced with automated controls within the system. As automated control reliance on the system increased, monitoring of system changes and policies surrounding access to administrator and super user accounts were not adequately considered or developed consistent with overall information technology policies and procedures in place at MCW. Effect If controls surrounding change management and user access are ineffectively designed, student financial aid may be disbursed in the incorrect amount or to a student who does not meet the eligibility requirements as stated in the Compliance Supplement. Questioned Costs None Statistically Valid Sample The sample was not intended to be, and was not, a statistically valid sample Repeat Finding Yes Recommendation We recommend MCW implement policies and procedures over monitoring of student financial aid system changes and user access. Management?s Response While manual controls mitigated the disbursement of an incorrect amount or disbursement to a student who does not meet the eligibility requirements, MCW concurs and has put significant effort into adding additional change management and user access controls to the student information system. As stated above, these conditions occurred when MCW changed student information systems and began relying more heavily on automated controls within the student information system, instead of solely relying on manual controls outside of the system. Two areas that needed to be addressed were related to general information technology controls: 1. Users with certain administrative access rights have access to the underlying source code of the system and lack monitoring controls over these accounts regarding source code changes. 2. Password requirements for certain administrative accounts were not routinely changed. As of May 10, 2022, MCW implemented controls to address the matters noted above.

Finding 2021-01 General Information Technology Controls Federal Agency: U.S. Department of Education Program Name: Student Financial Aid Cluster CFDA Number: Various Grant Identification Number: Various Grant Award Period: July 1, 2020 through June 30, 2021 Criteria The 2 CFR Section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition Found During testwork performed over the Student Financial Aid Cluster, we noted that within the student information system (the system), certain general information technology controls surrounding change management and user access appeared to be missing or ineffectively designed. Specifically, users with certain administrative access rights have access to the underlying source code of the system and could implement changes directly in the system. There were no monitoring controls over these accounts regarding source code changes. In addition, the password to certain administrative accounts that are used to provision/de-provision user access is not routinely changed, and thus could result in employees with inappropriate access. Cause A new student information system was implemented resulting in controls which previously were manual in nature, being replaced with automated controls within the system. As automated control reliance on the system increased, monitoring of system changes and policies surrounding access to administrator and super user accounts were not adequately considered or developed consistent with overall information technology policies and procedures in place at MCW. Effect If controls surrounding change management and user access are ineffectively designed, student financial aid may be disbursed in the incorrect amount or to a student who does not meet the eligibility requirements as stated in the Compliance Supplement. Questioned Costs None Statistically Valid Sample The sample was not intended to be, and was not, a statistically valid sample Repeat Finding No Recommendation We recommend MCW implement policies and procedures over monitoring of student financial aid system changes and user access. Management?s Response While manual controls mitigated the disbursement of an incorrect amount or disbursement to a student who does not meet the eligibility requirements, MCW concurs and has put significant effort into adding additional change management and user access controls to the student information system. As stated above, these conditions occurred when MCW changed student information systems and began relying more heavily on automated controls within the system, instead of solely relying on manual controls outside of the system. Two areas that needed to be addressed were related to general information technology controls: 1. Users with certain administrative access rights have access to the underlying source code of the system and lack monitoring controls over these accounts regarding source code changes. 2. Password requirements for certain administrative accounts were not routinely changed. In the future, MCW will ensure that all controls relating to student information systems are effectively designed to ensure compliance with regulations for federal funding.

Finding 2021-02 Payroll Costs Federal Agency: U.S Department of Treasury Program Name: Coronavirus Relief Fund CFDA Number: 21.019 Grant Identification Number: Various Grant Award Period: March 1, 2020 through December 31, 2021 Criteria The 2 CFR Section 200.303 requires that non-federal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition Found Management submitted costs allocations to the State of Wisconsin, the passthrough entity of the federal award issued by the U.S. Department of Treasury, as evidence of need for the award. Costs submitted cannot be lawfully funded using a line item, allotment, or allocation within the budget or for substantially different use from expected use of funds in such line item, allotment, or allocation. The costs submitted, specifically relating to the payroll costs, included costs allocated to other awards. The error reported above resulted in an extrapolated difference of $30,137 over duplicate allocations. Management did not establish adequate internal control procedures to ensure allowable cost requirements were followed in accordance with federal and state regulations for this award. Cause Management incorrectly allocated payroll costs related to time spent on COVID-19 tasks, but reimbursed from other awards received, to the Coronavirus Relief Fund award passed through the State of Wisconsin. Effect Inadequate management review of the accuracy of the payroll allocation, including establishing an appropriate level of precision to identify potential errors in allocation also contributed to the inaccurate allocation. Questioned Costs $30,137 Statistically Valid Sample The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding No Recommendation We recommend management implement internal controls that will provide for accurate allocations of payroll costs. Management?s Response As stated above, MCW did not perform a management review at an appropriate level of precision to identify potential errors in the allocation of payroll costs to the Coronavirus Relief Fund award passed through the State of Wisconsin. Upon additional review, MCW identified 7 employees with payroll costs in excess of the amount allowable on Coronavirus Relief Fund award passed through the State of Wisconsin due to payroll costs allocated to other awards. In addition, MCW determined that fringe benefit costs are understated on the Coronavirus Relief Fund award passed through the State of Wisconsin and the excess payroll costs for the 7 employees are more than offset by the under-allocation of fringe benefit costs. In the future, MCW will ensure that all controls relating to management review of the use of Coronavirus Relief Funds passed through the State of Wisconsin are in place and documented, with an appropriate level of precision and a review of calculations is performed to ensure accuracy.