EIN: 420898405
UEI: CK1MDQAWQ9G5
Audited by: WIPFLI LLP
Oversight agency: 93 [Department of Health and Human Services]
View federal awards & risk assessment →
Data as of August 28, 2026
Management decision deadline — for entities that funded this organization
The FAC accepted this audit on March 9, 2026. Under 2 CFR 200.521(d), a pass-through entity that provided federal funds to this organization for this audit period must issue a management decision on these findings by September 9, 2026 (9 days from today).
What is a management decision? →FAC accepted this audit on June 30, 2025 — management decision was due December 30, 2025.
FAC accepted this audit on March 6, 2025 — management decision was due September 6, 2025.
Subsequent to the fiscal year end, HACAP experienced a security breach of their electronic financial information by an outside party which denied HACAP access to their computer servers. Although several attempts were made to recover the financial information, HAPCAP was unable to retrieve essential electronic financial information needed to complete the audit. With the inability to retrieve the information, HACAP had to recreate the financial information manually causing significant delays in reconciling accounts and completion of the audit. Effect: As a result of the deficiencies in adequately safeguarding of electronic financial information and the inability to recreate the electronic financial information using back-ups systems, a material weakness in internal control over financial reporting exists. Cause: HACAP's internal controls over their electronic financial information did not adequately safeguard their financial information and prevent access from outside parties. In addition, HACAP's back-ups of the electronic financial information were not effective in recreating the financial information necessary to complete the audit. Repeat: No Auditor's Recommendations: We recommend HACAP implement procedures to ensure electronic records are secured and adequately backed-up. View of Responsible Officials: Management agrees with the finding and has developed a written corrective action plan.No findings related to the the financial statements.
Show full finding ▾Hide full finding ▴Internal Controls over Electronic Financial Information Criteria or Specific Requirement: 2 CFR part 200 (Uniform Guidance) requires grantees to have effective control over, and accountability for, all funds, property, and other assets. Condition: Subsequent to the fiscal year end, HACAP experienced a security breach of their electronic financial information by an outside party which denied HACAP access to their computer servers. Although several attempts were made to recover the financial information, HAPCAP was unable to retrieve essential electronic financial information needed to complete the audit. With the inability to retrieve the information, HACAP had to recreate the financial information manually causing significant delays in reconciling accounts and completion of the audit. Effect: As a result of the deficiencies in adequately safeguarding of electronic financial information and the inability to recreate the electronic financial information using back-ups systems, a material weakness in internal control over financial reporting exists. Cause: HACAP's internal controls over their electronic financial information did not adequately safeguard their financial information and prevent access from outside parties. In addition, HACAP's back-ups of the electronic financial information were not effective in recreating the financial information necessary to complete the audit. Repeat: No Auditor's Recommendations: We recommend HACAP implement procedures to ensure electronic records are secured and adequately backed-up. View of Responsible Officials: Management agrees with the finding and has developed a written corrective action plan.No findings related to the the financial statements.
Hawkeye Area Community Action Program, Inc. (HACAP) has migrated our financial accounting software to a data center managed by a 3'' party. A full backup of the database is done daily to both the cloud and to a hard drive that is securely stored. Person(s) Responsible: Paula Mahan, Jim McGoldrock Timing for Implementation: Immediate action was taken, and the change was made as soon as the data breach was discovered in October 2023.
The September 30, 2023 audit and reporting package is being submitted after the required due date. Effect: HACAP is not in compliance with federal regulations regarding audit timing and represents a significant deficiency in internal control over major program reporting. Cause: Due to restricted access to computer servers and having to rebuild electronic records, HACAP audit and data collection submission was not done on time. Repeat: No Auditor's Recommendations: HACAP should take steps to ensure that its financial records are available in a timely manner to allow the audit to begin sufficiently before the audit due date. View of Responsible Officials: Management agrees with the finding and has developed a written corrective action plan.
Show full finding ▾Hide full finding ▴Late Audit Submission Criteria or Specific Requirement: 2 CFR section 200.512(a) requires the reporting package and data collection form be submitted to the Federal Audit Clearinghouse the earlier of 30 calendar days after the reports are received from the auditors or nine months after the end of the audit period. Condition: The September 30, 2023 audit and reporting package is being submitted after the required due date. Effect: HACAP is not in compliance with federal regulations regarding audit timing and represents a significant deficiency in internal control over major program reporting. Cause: Due to restricted access to computer servers and having to rebuild electronic records, HACAP audit and data collection submission was not done on time. Repeat: No Auditor's Recommendations: HACAP should take steps to ensure that its financial records are available in a timely manner to allow the audit to begin sufficiently before the audit due date. View of Responsible Officials: Management agrees with the finding and has developed a written corrective action plan.
The 2023 audit for Hawkeye Area Community Action Program, Inc (HACAP) was delayed due to a loss of financial data that was stored on an internal server because of a data breach. The back-up of the financial data was also stored on an internal server, was compromised as well, resulting in a complete loss of information. The financial information had to be rebuilt based on support documentation, and the reconstruction of the data took place over the course of several months. HACAP has migrated our financial accounting software to a data center managed by a 3rd party. A full backup of the database is done daily to both the cloud and to a hard drive that is securely stored. Person(s) Responsible: Jason Fisher, Cindy Johnson, Jim McGoldrick Timing for Implementation: Immediate/Completed
FAC accepted this audit on February 7, 2023 — management decision was due August 7, 2023.
FAC accepted this audit on February 1, 2022 — management decision was due August 1, 2022.
FAC accepted this audit on February 10, 2021 — management decision was due August 10, 2021.
FAC accepted this audit on February 20, 2020 — management decision was due August 20, 2020.
FAC accepted this audit on February 4, 2019 — management decision was due August 4, 2019.
FAC accepted this audit on January 29, 2018 — management decision was due July 29, 2018.
FAC accepted this audit on January 31, 2017 — management decision was due July 31, 2017.
Data source: This information comes from the Federal Audit Clearinghouse, the official repository of Single Audit data. All data is public domain. Verify this organization's audit history at fac.gov.
Browse other Single Audit organizations in Iowa →
Track your findings and corrective action plans across audit cycles.
Start tracking findings →Monitor subrecipient audit findings and filing records.
Start monitoring →© 2026 Single Audit Intelligence. All data is public domain.
