EIN: 741613878
UEI: FXKMA43NTV21
Audited by: Ernst & Young LLP
Cognizant agency: 93 [Department of Health and Human Services]
View federal awards & risk assessment →
Data as of August 28, 2026
Management decision deadline — for entities that funded this organization
The FAC accepted this audit on March 27, 2026. Under 2 CFR 200.521(d), a pass-through entity that provided federal funds to this organization for this audit period must issue a management decision on these findings by September 27, 2026 (27 days from today).
What is a management decision? →The College did not provide evidence of effectively designed internal controls to ensure subrecipients are paid by the College within 30 days of requests for reimbursements received by the College. Cause: The College did not ensure that its established internal control processes were operating effectively to verify that invoices from subrecipients were paid within the required 30‑day period from the date the payment request was received. Effect or potential effect: The College did not comply with the cash management requirements of Uniform Guidance to pay subrecipients within 30 days of their requests for reimbursements. Questioned costs: None. Context: EY selected and tested a sample of 44 payments to subrecipients with expenditures totaling $5,843,778 from a population of $56,294,523 during the year ended June 30, 2025. Of the 44 samples selected for testing, 12 payments to subrecipients totaling $3,490,135 were made outside the required 30‑day payment window. Identification as a repeat finding, if applicable: Not a repeat finding. Recommendation: The College should strengthen its disbursement controls by ensuring that invoices received from subrecipients are promptly identified, logged, and tracked against the 30‑day payment requirement. Views of responsible officials: Management agrees with the finding and has developed a plan to ensure subrecipients are paid within 30 days of their requests for reimbursement.
Show full finding ▾Hide full finding ▴Finding 2025-001 Cash Management Identification of the federal program: U.S. Department of Health and Human Services National Institutes of Health Research and Development Cluster Assistance Listing No. Federal Program Title 43.014 Congressionally Directed Programs 47.049 Mathematical and Physical Sciences 93.172 Human Genome Research 93.393 Cancer Cause and Prevention Research 93.396 Cancer Biology Research 93.837 Cardiovascular Diseases Research 93.847 Diabetes, Digestive, and Kidney Diseases Extramural Research 93.853 Extramural Research Programs in the Neurosciences and Neurological Disorders 93.865 Child Health and Human Development Extramural Research Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 2 CFR 200.305(b)(3) requires that when the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper. Condition: The College did not provide evidence of effectively designed internal controls to ensure subrecipients are paid by the College within 30 days of requests for reimbursements received by the College. Cause: The College did not ensure that its established internal control processes were operating effectively to verify that invoices from subrecipients were paid within the required 30‑day period from the date the payment request was received. Effect or potential effect: The College did not comply with the cash management requirements of Uniform Guidance to pay subrecipients within 30 days of their requests for reimbursements. Questioned costs: None. Context: EY selected and tested a sample of 44 payments to subrecipients with expenditures totaling $5,843,778 from a population of $56,294,523 during the year ended June 30, 2025. Of the 44 samples selected for testing, 12 payments to subrecipients totaling $3,490,135 were made outside the required 30‑day payment window. Identification as a repeat finding, if applicable: Not a repeat finding. Recommendation: The College should strengthen its disbursement controls by ensuring that invoices received from subrecipients are promptly identified, logged, and tracked against the 30‑day payment requirement. Views of responsible officials: Management agrees with the finding and has developed a plan to ensure subrecipients are paid within 30 days of their requests for reimbursement.
2025-001 Cash Management ALN: Research and Development Cluster (R&D) - Various ALNs Finding: The College did not provide evidence of effectively designed internal controls to ensure subrecipients are paid by the College within 30 days of requests for reimbursements received by the College. Corrective Action Plan: Management acknowledges that some of the payments to subrecipients selected for audit were not made within 30 days of receipt. We value the relationships with our subrecipient partners and endeavor to pay all of them timely. Substantially all subrecipient payments are made by the College within the prescribed timeline subject to the underlying transactions being properly approved. This includes the approval by principal investigators and approval of supply chain personnel after the performance of standard controls surrounding disbursements. Management will continue to identify root causes around identified delayed payments and evaluate go-forward process improvements with supply chain services, treasury and academic department personnel. Person(s) Responsible: Rob Falivene, Vice President, Supply Chain Services, and Oswaldo Ramirez, Vice President, Treasurer Expected Completion: December 2026
FAC accepted this audit on March 31, 2025 — management decision was due October 1, 2025.
The College did not maintain records for procurements sufficient to detail the history of procurement, including the rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. Questioned costs: $65,815 Section III – Federal Award Findings and Questioned Costs (continued) Context: EY selected and tested 8 procurements over $50,000 with expenditures totaling, $1,779,434 from a population of $8,490,052 procurements over $50,000 during the year ended June 30, 2024. Of the 8 expenditures selected for testing 1 procurement totaling $65,815 did not have evidence of sole source justification. Effect or potential effect: The College did not comply with the general procurement standards and methods of procurement to be followed per the Uniform Guidance to maintain sufficient detail of the history of the procurement, including the rationale of the method of procurement. Cause: The College did not have effective internal controls and procedures in place to ensure the College maintained records for procurements sufficient to detail the history of procurement, including the rationale for the method of procurement and other required elements. Identification as a repeat finding, if applicable: This is not a repeat finding Recommendation: The College should retain written documentation for procurements, documenting the history of the procurement prior to the procurement of goods or services including, but not limited to, the rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. Views of responsible officials and planned corrective actions: Management agrees with the finding and has developed a plan to ensure that documentation is retained for sole source procurements.
Show full finding ▾Hide full finding ▴Finding 2024‐002 Procurement Information on the federal/state program: Federal Programs: Research and Development Cluster (R&D) ALN: 93.855 Criteria or specific requirement (including statutory, regulatory or other citation): Federal Program 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 2 CFR 200.318 (i) General Procurement Standards states, “the non-Federal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: Rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price.” Condition: The College did not maintain records for procurements sufficient to detail the history of procurement, including the rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. Questioned costs: $65,815 Section III – Federal Award Findings and Questioned Costs (continued) Context: EY selected and tested 8 procurements over $50,000 with expenditures totaling, $1,779,434 from a population of $8,490,052 procurements over $50,000 during the year ended June 30, 2024. Of the 8 expenditures selected for testing 1 procurement totaling $65,815 did not have evidence of sole source justification. Effect or potential effect: The College did not comply with the general procurement standards and methods of procurement to be followed per the Uniform Guidance to maintain sufficient detail of the history of the procurement, including the rationale of the method of procurement. Cause: The College did not have effective internal controls and procedures in place to ensure the College maintained records for procurements sufficient to detail the history of procurement, including the rationale for the method of procurement and other required elements. Identification as a repeat finding, if applicable: This is not a repeat finding Recommendation: The College should retain written documentation for procurements, documenting the history of the procurement prior to the procurement of goods or services including, but not limited to, the rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. Views of responsible officials and planned corrective actions: Management agrees with the finding and has developed a plan to ensure that documentation is retained for sole source procurements.
Finding 2024-002 Procurement ALN: 93.855 Finding: The College did not have effective internal controls and procedures in place to ensure the College maintained records for procurements sufficient to detail the history of procurement, including the rationale for the method of procurement and other required elements. Corrective Action Plan: BCM management agrees that a sole source documentation form was not completed for this procurement. We do believe that this would have been easily justified as a sole source procurement as this vendor had unique capabilities required by the grant. The master service agreement for this procurement was effective September 1, 2019, and the related PO for this scope of work was issued on June 15, 2023. Since this time period, BCM has implemented a new procure to pay system with improved internal controls and approval routings. With this new system, we believe we have already put in place the appropriate corrective actions necessary to prevent this from happening going forward. Person Responsible: Rob Falivene, Vice President, Supply Chain Services, Baylor College of Medicine Expected Completion: March 2025
The College did not retain documentation and evidence of review of the indirect cost amounts being charged to the R&D and CSLFRF programs. Management performed a monthly control that included reviewing a sample of indirect costs charged to grants on a sample basis. The College had a new ERP implementation that went into effect on January 1, 2024. Management did not perform the monthly control subsequent to the ERP implementation for the last 6 months of year. Questioned costs: None Section III – Federal Award Findings and Questioned Costs (continued) Context: During our testing over indirect cost, we selected 2 months during FY24 to test managements control. We observed that during FY24, BCM had a mid year ERP implementation in January 2024. After the ERP implementation, management no longer performed the monthly control for the remainder of FY24. As such for 6 months during FY24, the control was not in place. Effect or potential effect: The incorrect indirect cost rate could be applied to a grant. Cause: Management’s internal control over the review and approval of indirect cost expenditures for compliance was not consistently documented. Identification as a repeat finding, if applicable: This is not a repeat finding Recommendation: The College should reassess its internal controls over the review and approval of indirect cost expenditures post ERP implementation and ensure documentation is retained to evidence review and approval to support the allowability of the expenditure. Views of responsible officials and planned corrective actions: Management agrees with the finding and has developed a plan to ensure indirect costs are reviewed.
Show full finding ▾Hide full finding ▴Finding 2024‐003 Indirect Cost Information on the federal/state program: Federal Award agency; Research and Development Cluster COVID-19 Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) ALN: Various 21.027 Criteria or specific requirement (including statutory, regulatory or other citation): Internal Controls Federal Awards 2 CFR Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: The College did not retain documentation and evidence of review of the indirect cost amounts being charged to the R&D and CSLFRF programs. Management performed a monthly control that included reviewing a sample of indirect costs charged to grants on a sample basis. The College had a new ERP implementation that went into effect on January 1, 2024. Management did not perform the monthly control subsequent to the ERP implementation for the last 6 months of year. Questioned costs: None Section III – Federal Award Findings and Questioned Costs (continued) Context: During our testing over indirect cost, we selected 2 months during FY24 to test managements control. We observed that during FY24, BCM had a mid year ERP implementation in January 2024. After the ERP implementation, management no longer performed the monthly control for the remainder of FY24. As such for 6 months during FY24, the control was not in place. Effect or potential effect: The incorrect indirect cost rate could be applied to a grant. Cause: Management’s internal control over the review and approval of indirect cost expenditures for compliance was not consistently documented. Identification as a repeat finding, if applicable: This is not a repeat finding Recommendation: The College should reassess its internal controls over the review and approval of indirect cost expenditures post ERP implementation and ensure documentation is retained to evidence review and approval to support the allowability of the expenditure. Views of responsible officials and planned corrective actions: Management agrees with the finding and has developed a plan to ensure indirect costs are reviewed.
2024-003 Indirect Costs ALN: Research and Development Cluster (R&D), 21.027 Finding: The College did not retain documentation and evidence of review of the indirect cost amounts being charged to the R&D and CSLFRF programs. Management performed a monthly control that included reviewing a sample of indirect costs charged to grants on a sample basis. The College had a new ERP implementation that went into effect on January 1, 2024. Management did not perform the monthly control subsequent to the ERP implementation for the last 6 months of year. Corrective Action Plan: With the implementation of the new ERP system, BCM went from an on-premises solution to a software-as-a-service solution. Since we no longer have access to modify the code that calculates the F&A expense on awards, management concluded that previous random testing control was no longer necessary. Management also believes that there are numerous compensating reporting controls that would alert us if the F&A calculations were not accurate. Notably, management’s compensating controls and the testing the audit firm conducted identified no instances where the F&A calculations were inaccurate. However, to satisfy this audit finding we will be resuming the manual control procedure used with the legacy system. Person Responsible: Chryll Batiste, Director, Research Administration, Baylor College of Medicine Expected Completion: April 2025
The College did not submit monthly reports for the CSLFRF or TCMHCC grants by the 15th of the each month. Questioned costs: None Context: Federal and State: The College submitted monthly reports for the 4 health initiatives created under the TCMHCC grant. CPAN 6 out of 12 reports were not submitted by the 15th deadline. CPWE 7 out of 12 reports were not submitted by the 15th deadline. CAP 7 out of 12 reports were not submitted by the 15th deadline. Effect or potential effect: The College did not comply with the timing of the CSLFRF and TCMHC reporting requirements. Cause: The College did not have effective internal controls in place to ensure the monthly reports were submitted by the required dates, resulting in noncompliance. Identification as a repeat finding, if applicable: This is not a repeat finding Recommendation: The College should develop and implement effective internal controls to ensure the required reports are submitted by the required due dates. Views of responsible officials and planned corrective actions: Management agrees with the finding and has developed a plan to ensure all reports are filed timely.
Show full finding ▾Hide full finding ▴Finding 2024‐004 Reporting Information on the federal/state program: Federal Programs: COVID-19 Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) ALN: 21.027 State Awarding agency: Texas Higher Education Coordinating Board State Program: Texas Child Mental Health Care Consortium (TCMHCC) Criteria or specific requirement (including statutory, regulatory or other citation): Federal Program 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Pursuant to 47 C.F.R 302.9 and in accordance with the grant agreement, the award recipient was to submit monthly technical progress reports within 15 days of the end of the month. Per the CSLFRF and TCHMCC agreements with UT Austin: A monthly progress report is due to UT System by the 15th of the month for the previous month. Section III – Federal Award Findings and Questioned Costs (continued) Condition: The College did not submit monthly reports for the CSLFRF or TCMHCC grants by the 15th of the each month. Questioned costs: None Context: Federal and State: The College submitted monthly reports for the 4 health initiatives created under the TCMHCC grant. CPAN 6 out of 12 reports were not submitted by the 15th deadline. CPWE 7 out of 12 reports were not submitted by the 15th deadline. CAP 7 out of 12 reports were not submitted by the 15th deadline. Effect or potential effect: The College did not comply with the timing of the CSLFRF and TCMHC reporting requirements. Cause: The College did not have effective internal controls in place to ensure the monthly reports were submitted by the required dates, resulting in noncompliance. Identification as a repeat finding, if applicable: This is not a repeat finding Recommendation: The College should develop and implement effective internal controls to ensure the required reports are submitted by the required due dates. Views of responsible officials and planned corrective actions: Management agrees with the finding and has developed a plan to ensure all reports are filed timely.
Finding 2024-004 Reporting ALN: 21.027 Finding: The College did not submit monthly reports for the CSLFRF or TCMHCC grants by the 15th of each month. Corrective Action Plan: BCM agrees that these reports were not submitted by the 15th deadline. Going forward, BCM will require the department to attest that the programmatic reports were submitted when the monthly financial reports are submitted on the TCMHCC grant. Person Responsible: Chryll Batiste, Director, Research Administration, Baylor College of Medicine Expected Completion: April 2025
The College did not submit the required monthly reconciliation for the direct loan program timely. Section III – Federal Award Findings and Questioned Costs (continued) Questioned costs: None Context: As part of our testing, EY selected 4 months to test the monthly reconciliation between the funds received from G5 to the actual disbursement submitted to the COD. During our testing we determined that the College did not perform the monthly reconciliation timely for 3 of the 4 months selected for testing. Effect or potential effect: The College did not comply with the cash management reporting requirements, which could result in unreconciled differences between the funds the College received to what was actually disbursed to students. Cause: As part of our testing, EY selected 4 months to test the monthly reconciliation between the funds received from G5 to the actual disbursement submitted to the COD. During our testing we determined that the College did not perform the monthly reconciliation timely for 3 of the 4 months selected for testing. There was turnover by management and management was working with the IT department to ensure information was accurately obtained from the system to perform the reconciliation. After the data could be appropriately downloaded, management reconciled all transactions to date. Ultimately, management missed the monthly reconciliation deadline for 4 months during FY24. However the College did perform a year to date reconciliation in order to ensure all months during FY24 were reconciled from G5 to COD. Identification as a repeat finding, if applicable: This is not a repeat finding Recommendation: The College should perform and submit the required monthly reconciliation between the G5 and the COD timely. Views of responsible officials and planned corrective actions: Management agrees with the finding and has developed a plan to ensure that the reconciliation is performed on a monthly basis.
Show full finding ▾Hide full finding ▴Finding 2024‐005 Information on the federal/state program: Federal Programs: Student Financial Assistance Cluster ALN: 84.268 Criteria or specific requirement (including statutory, regulatory or other citation): Federal Program 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Cash Management Program Requirements for Direct Lonas- Monthly Reconciliations Schools participating in the Direct Loan program are required to perform monthly Direct Loan Reconciliations (34 CFR 685.300(b)(5)). Electronic Announcements DL-22-07 and General -22-86 explain that a school must reconcile the funds it received from G5 with actual disbursement records the school submitted to Common Origination and Disbursement (COD). Each month COD sends the school a School Account Statement, which is Department of Education (ED’s) official record of the school’s cash and disbursement records and identifies the difference between net draws from G5 and the actual disbursement information reported to COD by the school. The School is required to account for any differences by reconciling ED’s records (School Account Statement) with the school’s financial and business records. Condition: The College did not submit the required monthly reconciliation for the direct loan program timely. Section III – Federal Award Findings and Questioned Costs (continued) Questioned costs: None Context: As part of our testing, EY selected 4 months to test the monthly reconciliation between the funds received from G5 to the actual disbursement submitted to the COD. During our testing we determined that the College did not perform the monthly reconciliation timely for 3 of the 4 months selected for testing. Effect or potential effect: The College did not comply with the cash management reporting requirements, which could result in unreconciled differences between the funds the College received to what was actually disbursed to students. Cause: As part of our testing, EY selected 4 months to test the monthly reconciliation between the funds received from G5 to the actual disbursement submitted to the COD. During our testing we determined that the College did not perform the monthly reconciliation timely for 3 of the 4 months selected for testing. There was turnover by management and management was working with the IT department to ensure information was accurately obtained from the system to perform the reconciliation. After the data could be appropriately downloaded, management reconciled all transactions to date. Ultimately, management missed the monthly reconciliation deadline for 4 months during FY24. However the College did perform a year to date reconciliation in order to ensure all months during FY24 were reconciled from G5 to COD. Identification as a repeat finding, if applicable: This is not a repeat finding Recommendation: The College should perform and submit the required monthly reconciliation between the G5 and the COD timely. Views of responsible officials and planned corrective actions: Management agrees with the finding and has developed a plan to ensure that the reconciliation is performed on a monthly basis.
Finding 2024‐005 Student Financial Assistance Cluster ALN: 84.268 Finding: The College did not submit the required monthly reconciliation for the direct loan program Corrective Action Plan: To address the issue of not submitting the required monthly reconciliation for the Direct Loan Program, the Financial Aid office has implemented a process to ensure Direct Loan reconciliation is completed monthly. An outlook calendar reminder entry will serve as a reminder to begin the reconciliation process on the 15th of each month. The Senior Financial Aid Counselor requests a YTD SAS report from COD, which contains loan data from the central processor, the report is delivered to our electronic mailbox within 24 hours. The Senior Financial Aid Counselor runs a second report from the SIS System to generate YTD loan disbursement information. The files are reformatted and compared by the Senior Financial Aid Counselor. Any discrepancies are reviewed and resolved in the appropriate system (COD or SIS), dependent on the discrepancy. The Senior Counselor notifies the Senior Manager of Financial Aid that the comparison and updates are complete. The Senior Manager of Financial Aid then reviews delta from the compared data and verifies that corrections are made in the correct system. The Senior Manager ensures that resolved amount is within the COD delta found on the summary page in COD and a screenshot is maintained in the reconciliation file. Senior Manager marks “Sr Manager Reviewed” column on the loan reconciliation spreadsheet with a date of review as evidence. The completed reconciliation is maintained in the Financial Aid Shared Directory. Person Responsible: Scott Moore, Senior Manager, Financial Aid, Baylor College of Medicine Expected Completion: April 2024
FAC accepted this audit on March 25, 2024 — management decision was due September 25, 2024.
FAC accepted this audit on March 28, 2023 — management decision was due September 28, 2023.
FAC accepted this audit on August 4, 2022 — management decision was due February 4, 2023.
Baylor College of Medicine did not perform a risk assessment that addressed the three required areas as noted in 16 CFR 314.4(b) and, as a result, did not document safeguards in response to identified risks as required by 16 CFR 314.4(c). Further, Baylor College of Medicine did not have internal controls in place over GLBA requirements for the fiscal year ended June 30, 2021 (FY 2021). Questioned costs: $0 Context: Total federal expenditures for the SFA Cluster were $21.7 million, of which $21.3 million was from ED, for the year ended June 30, 2021, representing 5% of total federal expenditures. Effect: If risk assessments are not performed in accordance with GLBA requirements, internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information may occur. Cause: Baylor College of Medicine did not have policies and procedures addressing the requirements of 16 CFR 314.4(b) and (c). Identification as a repeat finding, if applicable: N/A Recommendation: We recommend Baylor College of Medicine perform the required risk assessment and document and implement safeguards responding to identified risks annually. Management should implement policies and procedures, including internal controls, to ensure that Baylor College of Medicine is in compliance with the GLBA requirements, 16 CFR 314.4(b) and (c). Management should review the annual updates of risk assessments and documented safeguards and retain evidence of the review and approval. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.
Show full finding ▾Hide full finding ▴Finding 2021-001 - Special Test and Provisions - Gramm-Leach-Bliley Act- Student Information Security (Student Financial Assistance Cluster) Identification of the federal Program: U.S. Department of Education (ED) Office of Federal Student Aid SFA Cluster Assistance Listing Nos. 84.033, 84.038, 84.268 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? 16 CFR 314.4(b) requires institutions to ?Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures.? 16 CFR 314.4(c) requires institutions to ?Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards? key controls, systems, and procedures.? Condition: Baylor College of Medicine did not perform a risk assessment that addressed the three required areas as noted in 16 CFR 314.4(b) and, as a result, did not document safeguards in response to identified risks as required by 16 CFR 314.4(c). Further, Baylor College of Medicine did not have internal controls in place over GLBA requirements for the fiscal year ended June 30, 2021 (FY 2021). Questioned costs: $0 Context: Total federal expenditures for the SFA Cluster were $21.7 million, of which $21.3 million was from ED, for the year ended June 30, 2021, representing 5% of total federal expenditures. Effect: If risk assessments are not performed in accordance with GLBA requirements, internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information may occur. Cause: Baylor College of Medicine did not have policies and procedures addressing the requirements of 16 CFR 314.4(b) and (c). Identification as a repeat finding, if applicable: N/A Recommendation: We recommend Baylor College of Medicine perform the required risk assessment and document and implement safeguards responding to identified risks annually. Management should implement policies and procedures, including internal controls, to ensure that Baylor College of Medicine is in compliance with the GLBA requirements, 16 CFR 314.4(b) and (c). Management should review the annual updates of risk assessments and documented safeguards and retain evidence of the review and approval. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.
Finding 2021-001 ? Special Tests and Provisions ? Gramm-Leach-Bliley Act ? Student Information Security (Student Financial Assistance Cluster) Corrective Action Plan Current status: In progress. Completion Date(s): August 31, 2021 for risk assessment November 30, 2021 for training Condition: Non-Compliance with the Gramm-Leach-Bliley Act (GLBA) ? Student Information Security. Contact Person Name, Title, Office: Jeffrey S. Pounds Information Security Officer Executive Director IT Security Compliance and Audit Services Baylor College of Medicine jpounds@bcm.edu Baylor understands the importance of full compliance with the GLBA. While we feel the college had already taken steps to meet the requirements of the act separately as part of other policies, procedures, processes, and activities, we nevertheless took immediate action to organize and formalize the activities related to GLBA under a separate and distinct structure. We feel that actions below will remedy the deficiency identified. ? Convened a formal GLBA committee to confirm, review, implement the guidelines, and conduct ongoing monitoring as required in the Act. (August 2021) ? Completing an audit and review of the GLBA risk assessment and documented safeguards as they relate to information technology (hardware, systems, access, etc.), processes, procedures, and staff training. (August 2021) ? Confirmed an official as the institutional GLBA point of contact. (August 2021) ? Create and provide GLBA training to all parties including those remotely participating or having access to such data covered by the Act. (November 2021)
FAC accepted this audit on March 30, 2021 — management decision was due September 30, 2021.
FAC accepted this audit on November 6, 2019 — management decision was due May 6, 2020.
FAC accepted this audit on November 1, 2018 — management decision was due May 1, 2019.
FAC accepted this audit on October 24, 2017 — management decision was due April 24, 2018.
FAC accepted this audit on October 24, 2016 — management decision was due April 24, 2017.
Data source: This information comes from the Federal Audit Clearinghouse, the official repository of Single Audit data. All data is public domain. Verify this organization's audit history at fac.gov.
Browse other Single Audit organizations in Texas →
Track your findings and corrective action plans across audit cycles.
Start tracking findings →Monitor subrecipient audit findings and filing records.
Start monitoring →© 2026 Single Audit Intelligence. All data is public domain.
