98 FY 2021 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION

Report of the Independent Auditors

UNITED STATES DEPARTMENT OF EDUCATION

OFFICE OF INSPECTOR GENERAL

 THE INSPECTOR GENERAL

400 MARYLAND AVENUE, S.W., WASHINGTON, DC 20202-1510

Promoting the efficiency, effectiveness, and integrity of the Department’s programs and operations.

November 19, 2021 

The Honorable Miguel Cardona

Secretary of Education

Washington, D.C. 20202

Dear Secretary Cardona: 

The enclosed Independent Auditors’ Report (report) presents the results of the audit of the U.S. 

Department of Education’s (Department) financial statements for fiscal years 2021 and 2020 to 

comply with the Chief Financial Officers Act of 1990, as amended. The report should be read in 

conjunction with the Department’s financial statements and notes to fully understand the 

context of the information contained therein.

We contracted with the independent certified public accounting firm KPMG LLP (KPMG) to 

audit the financial statements of the Department as of September 30, 2021, and 2020, and for 

the years then ended. The contract requires that the audit be performed in accordance with 

U.S. generally accepted government auditing standards and Office of Management and Budget 

bulletin, Audit Requirements for Federal Financial Statements.

Results of the Independent Audit

KPMG found:

• The fiscal years 2021 and 2020 financial statements are presented fairly, in all material 

respects, in accordance with accounting principles generally accepted in the United 

States of America. 

• One material weakness in internal control over financial reporting:

o Controls over the Reliability of Underlying Data Used in Credit Reform Reestimates Need Improvement. 

• Three significant deficiencies in internal control over financial reporting:

o Information Technology Controls Need Improvement, 

o Monitoring Controls over Service Organizations Need Improvement, and

o Entity Level Controls Need Improvement. 
FY 2021 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION 99

REPORT OF ThE INDEPENDENT AuDITORS | FINANCIAL SECTION

Page 2 – The Honorable Miguel Cardona

In connection with the contract, we reviewed KPMG’s report and related documentation and 

inquired of its representatives. Our review, as differentiated from an audit of the financial 

statements in accordance with U.S. generally accepted government auditing standards, was not 

intended to enable us to express, and we do not express, opinions on the Department’s 

financial statements or internal control over financial reporting, or conclusions on whether the 

Department’s financial management systems complied substantially with the three FFMIA 

requirements, or on compliance with laws and other matters. KPMG is responsible for the 

auditor’s report dated November 19, 2021, and the conclusions expressed therein. However, 

our review disclosed no instances where KPMG did not comply, in all material respects, with 

U.S. generally accepted government auditing standards. 

We appreciate the cooperation given KPMG and my office during the audit. If you have any 

questions or would like to discuss the report, please contact me at (202) 245-6900. 

Sincerely, 

Sandra D. Bruce

Deputy Inspector General Delegated the Duties

 of Inspector General

Enclosure
100 FY 2021 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION

FINANCIAL SECTION | REPORT OF ThE INDEPENDENT AuDITORS

Independent Auditors’ Report

Deputy Inspector General Delegated the Duties of Inspector General

United States Department of Education

Secretary

United States Department of Education:

Report on the Financial Statements

We have audited the accompanying consolidated financial statements of the United States Department of 

Education (Department), which comprise the consolidated balance sheets as of September 30, 2021 and 2020,

and the related consolidated statements of net cost, and changes in net position, and combined statements of 

budgetary resources for the years then ended, and the related notes to the consolidated financial statements.

Management’s Responsibility for the Financial Statements

Management is responsible for the preparation and fair presentation of these consolidated financial statements 

in accordance with U.S. generally accepted accounting principles; this includes the design, implementation, and 

maintenance of internal control relevant to the preparation and fair presentation of consolidated financial 

statements that are free from material misstatement, whether due to fraud or error.

Auditors’ Responsibility

Our responsibility is to express an opinion on these consolidated financial statements based on our audits. We 

conducted our audits in accordance with auditing standards generally accepted in the United States of America, 

in accordance with the standards applicable to financial audits contained in Government Auditing Standards

issued by the Comptroller General of the United States, and in accordance with Office of Management and 

Budget (OMB) Bulletin No. 21-04, Audit Requirements for Federal Financial Statements. Those standards and 

OMB Bulletin No. 21-04 require that we plan and perform the audit to obtain reasonable assurance about 

whether the consolidated financial statements are free from material misstatement.

An audit involves performing procedures to obtain audit evidence about the amounts and disclosures in the 

consolidated financial statements. The procedures selected depend on the auditors’ judgment, including the 

assessment of the risks of material misstatement of the consolidated financial statements, whether due to fraud 

or error. In making those risk assessments, the auditor considers internal control relevant to the entity’s

preparation and fair presentation of the consolidated financial statements in order to design audit procedures 

that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness 

of the entity’s internal control. Accordingly, we express no such opinion. An audit also includes evaluating the 

appropriateness of accounting policies used and the reasonableness of significant accounting estimates made 

by management, as well as evaluating the overall presentation of the consolidated financial statements.

We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our 

audit opinion.

Opinion 

In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, 

the financial position of the United States Department of Education as of September 30, 2021 and 2020, and its 

net costs, changes in net position, and budgetary resources for the years then ended in accordance with 

U.S. generally accepted accounting principles.

KPMG LLP

Suite 12000

1801 K Street, NW

Washington, DC 20006

KPMG LLP, a Delaware limited liability partnership and a member firm of 

the KPMG global organization of independent member firms affiliated with 

KPMG International Limited, a private English company limited by guarantee. 
FY 2021 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION 101

REPORT OF ThE INDEPENDENT AuDITORS | FINANCIAL SECTION

2

Other Matters

Interactive Data

Management has elected to reference to information on websites or other forms of interactive data outside the 

FY2021 Agency Financial Report to provide additional information for the users of its consolidated financial 

statements. Such information is not a required part of the basic consolidated financial statements or 

supplementary information required by the Federal Accounting Standards Advisory Board. The information on 

these websites or the other interactive data has not been subjected to any of our auditing procedures, and 

accordingly we do not express an opinion or provide any assurance on it.

Required Supplementary Information

U.S. generally accepted accounting principles require that the information in the Management’s Discussion and 

Analysis and Required Supplementary Information sections be presented to supplement the basic consolidated

financial statements. Such information, although not a part of the basic consolidated financial statements, is 

required by the Federal Accounting Standards Advisory Board who considers it to be an essential part of 

financial reporting for placing the basic consolidated financial statements in an appropriate operational, 

economic, or historical context. We have applied certain limited procedures to the required supplementary 

information in accordance with auditing standards generally accepted in the United States of America, which 

consisted of inquiries of management about the methods of preparing the information and comparing the 

information for consistency with management’s responses to our inquiries, the basic consolidated financial 

statements, and other knowledge we obtained during our audits of the basic consolidated financial statements. 

We do not express an opinion or provide any assurance on the information because the limited procedures do 

not provide us with sufficient evidence to express an opinion or provide any assurance.

Other Information

Our audits were conducted for the purpose of forming an opinion on the basic consolidated financial statements 

as a whole. The information on pages i through iii, Message from the Secretary, the information on page vii, 

Message from the Chief Financial Officer, About the Financial Section, Other Information section, Appendices, 

and Acknowledgments is presented for purposes of additional analysis and is not a required part of the basic 

consolidated financial statements. Such information has not been subjected to the auditing procedures applied 

in the audits of the basic consolidated financial statements, and accordingly, we do not express an opinion or 

provide any assurance on it.

Other Reporting Required by Government Auditing Standards

Internal Control over Financial Reporting

In planning and performing our audit of the consolidated financial statements as of and for the year ended 

September 30, 2021, we considered the Department’s internal control over financial reporting (internal control) 

as a basis for designing procedures that are appropriate in the circumstances for the purpose of expressing our 

opinion on the consolidated financial statements, but not for the purpose of expressing an opinion on the 

effectiveness of the Department’s internal control. Accordingly, we do not express an opinion on the 

effectiveness of the Department’s internal control. We did not test all internal controls relevant to operating 

objectives as broadly defined by the Federal Managers’ Financial Integrity Act of 1982.

Our consideration of internal control was for the limited purpose described in the preceding paragraph and was 

not designed to identify all deficiencies in internal control that might be material weaknesses or significant 

deficiencies and therefore, material weaknesses or significant deficiencies may exist that have not been 

identified. However, as described in the accompanying exhibits, we did identify certain deficiencies in internal 

control that we consider to be a material weakness and significant deficiencies.

A deficiency in internal control exists when the design or operation of a control does not allow management or 

employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, 

misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in 
102 FY 2021 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION

FINANCIAL SECTION | REPORT OF ThE INDEPENDENT AuDITORS

3

internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial 

statements will not be prevented, or detected and corrected, on a timely basis. We consider the deficiency 

described in the accompanying Exhibit A, Controls over the Reliability of Underlying Data Used in Credit 

Reform Re-estimates Need Improvement, to be a material weakness.

A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe 

than a material weakness, yet important enough to merit attention by those charged with governance. We 

consider the deficiencies described in Exhibit B, Information Technology Controls Need Improvement,

Monitoring Controls over Service Organizations Need Improvement, and Entity Level Controls Need 

Improvement, to be significant deficiencies.

Compliance and Other Matters

As part of obtaining reasonable assurance about whether the Department’s consolidated financial statements 

as of and for the year ended September 30, 2021 are free from material misstatement, we performed tests of 

its compliance with certain provisions of laws, regulations, contracts, and grant agreements, noncompliance 

with which could have a direct and material effect on the consolidated financial statements. However, providing 

an opinion on compliance with those provisions was not an objective of our audit, and accordingly, we do not 

express such an opinion. The results of our tests disclosed no instances of noncompliance or other matters that 

are required to be reported under Government Auditing Standards or OMB Bulletin No. 21-04.

We also performed tests of its compliance with certain provisions referred to in Section 803(a) of the Federal 

Financial Management Improvement Act of 1996 (FFMIA). Providing an opinion on compliance with FFMIA was 

not an objective of our audit, and accordingly, we do not express such an opinion. The results of our tests 

disclosed no instances in which the Department’s financial management systems did not substantially comply 

with the (1) Federal financial management systems requirements, (2) applicable Federal accounting standards, 

and (3) the United States Government Standard General Ledger at the transaction level.

Department’s Responses to Findings

The Department’s responses to the findings identified in our audit are described in Exhibit C. The Department’s

responses were not subjected to the auditing procedures applied in the audit of the consolidated financial 

statements and, accordingly, we express no opinion on the responses.

Purpose of the Other Reporting Required by Government Auditing Standards

The purpose of the communication described in the Other Reporting Required by Government Auditing 

Standards section is solely to describe the scope of our testing of internal control and compliance and the 

results of that testing, and not to provide an opinion on the effectiveness of the Department’s internal control or 

compliance. Accordingly, this communication is not suitable for any other purpose.

Washington, D.C.

November 19, 2021
FY 2021 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION 103

REPORT OF ThE INDEPENDENT AuDITORS | FINANCIAL SECTION

A-1 

Exhibit A 

Material Weakness

Controls over the Reliability of Underlying Data Used in Credit Reform Re-estimates Need Improvement 

Under the Federal Credit Reform Act of 1990 (FCRA), the United States Department of Education (Department) 

is required to perform periodic interest rate and technical re-estimates of the subsidy costs of its direct loan and 

guaranty programs. These re-estimates are calculated using an internally developed cash flow model. The 

cash flow model utilizes assumptions based on internally sourced data elements from Information Technology 

(IT) systems. The future cash flow outputs generated from the Department’s cash flow model, the Student Loan 

Model (SLM), are then input into the format required by the Office of Management and Budget (OMB) Credit 

Subsidy Calculator (CSC), a required present value discount tool for agencies with credit reform programs. 

These procedures are necessary to generate subsidy re-estimates in accordance with the FCRA, as required 

by U.S. generally accepted accounting principles.

Condition: 

The Department and Federal Student Aid (FSA) did not design and implement effective controls to ensure that 

the data used to develop the re-estimate is reliable, considering the elevated risk associated with such data 

caused by the IT control deficiencies discussed in Exhibit B of this report. Specifically, the Department and FSA 

management did not perform sufficient procedures to ensure that the data elements transmitted to and 

extracted from the various systems and used in the cash flow model are complete and accurate. 

Cause/Effect: 

The Department’s and FSA’s risk assessment process did not identify completeness and accuracy of the 

underlying data resulting from the IT system control deficiencies as a risk that required additional compensating 

controls. Inadequate controls over the completeness and accuracy of the underlying data used to develop the 

re-estimate increases the risk that the financial statements could be materially misstated. 

Criteria: 

The following criteria were considered in the evaluation of the material weakness presented in this exhibit: 

– The Standards for Internal Control in the Federal Government issued by the Comptroller General of the 

United States (the Green Book), Principle No. 10, Design Control Activities; Principle No. 11, Design 

Activities for the Information System; Principle No. 13, Use Quality Information. 

– FASAB Technical Release 6, Preparing Estimates for Direct Loan and Loan Guarantee Subsidies under 

the Federal Credit Reform Act – Amendments to Technical Release No. 3 Preparing and Auditing Direct 

Loan and Loan Guarantee Subsidies under the Federal Credit Reforms Act, Paragraphs 20 and 40. 

Recommendations: 

We recommend that the Department and FSA: 

1. Strengthen the risk assessment process by considering the impact of IT control deficiencies on internal 

controls over the reliability of information in the Department’s IT systems. Such considerations should be 

documented. 

2. Design and implement additional review controls that operate at a sufficient level of precision over the 

completeness and accuracy of the underlying data used to develop the re-estimate. 

3. Ensure proper documentation of controls identified to evidence the review, the conclusion and actions to be 

taken to address outstanding differences and/or matters to be researched. 
104 FY 2021 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION

FINANCIAL SECTION | REPORT OF ThE INDEPENDENT AuDITORS

B-1 

Exhibit B 

Significant Deficiencies 

A. Information Technology Controls Need Improvement

The following control deficiencies in the areas of IT logical access, security management, segregation of IT 

duties, and application change management are related to both the Department and FSA systems.

Conditions: 

In FY 2020, we reported a significant deficiency related to FSA’s IT controls due to persistent unmitigated IT 

control deficiencies. During FY 2021, the FSA management demonstrated progress implementing corrective 

actions to remediate some prior-year deficiencies such as background investigations. However, management 

has not fully remediated prior-year deficiencies related to logical access administration, separated/transferred 

user access removal, user access reviews and recertification, and configuration management. We noted new 

and existing IT control deficiencies related to security management, access controls, segregation of IT duties, 

and application change management for three of FSA’s financial and mixed systems and two access control 

support systems. In addition, we noted deficiencies related to Department-level logical access for its core 

financial management system. Specifically, we noted the following: 

Department: 

1. Weakness in IT logical access controls: New and separated contractors were not consistently and 

accurately tracked resulting in the inconsistent reporting of start and termination dates and system access 

that was not always removed upon separation from the Department. 

FSA:

1. Weakness in IT security management controls: Plan of Action and Milestone (POA&M) closure 

documentation for FSA systems did not always address the root cause of the deficiencies, thereby not 

preventing future reoccurrences. 

2. Weakness in IT logical access controls: The account management and access control processes were not 

consistently followed for three FSA systems and two access control support systems. We noted evidence 

supporting new, modified, or separated users could not be provided or was provided and missing required 

information and/or approvals. Additionally, we noted evidence supporting complete and accurate access 

reviews and recertifications was not provided or retained. Finally, we noted the Department’s requirement 

for two-factor authentication was not met for all internal system users. 

3. Weaknesses in IT controls related to the segregation of IT duties: For one FSA system, users with 

developer access had access to the system’s production environment or update access to the production 

and development environments. 

4. Weakness in IT application change management controls: The application change management process 

was not consistently followed for one FSA system. FSA was unable to provide a complete and accurate 

population of application changes. We also noted the documentation for a selection of changes contained 

inaccuracies in recorded testing and migration dates. 

Cause/Effect:

There was a lack of effective monitoring controls by the Department and FSA to ensure:

1. Systems and support processes consistently adhered to documented agency-wide policies and procedures 

for the financially and mixed systems hosted and managed by FSA and the Department. 
FY 2021 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION 105

REPORT OF ThE INDEPENDENT AuDITORS | FINANCIAL SECTION

B-2 

Additionally, there was a lack of effective IT controls implemented by FSA to ensure: 

1. Corrective actions to remediate prior-year conditions and associated causes are fully implemented, as well 

as verifying and validating that these corrective actions were effectively addressing the weakness with 

adequate documented supporting evidence. 

2. The established logical access control process is followed and requests for new, modified, or separated 

users were retained, documented completely and accurately, and approved. 

3. Segregation of duties and least privilege principles are followed and enforced. 

4. The established change process is followed and application change tickets accurately document the testing 

and migration dates. 

Ineffective IT controls increases the risk of unauthorized use, disclosure, disruption, modification, or destruction 

of information and information systems that could impact the integrity and reliability of information processed in 

the associated applications which may lead to misstatements of the financial statements. 

Criteria:

The following criteria were considered in the evaluation of the significant deficiency presented in this exhibit: 

– The Departmental Directive OCIO 3-112, Cybersecurity Policy. 

– Department Baseline Cybersecurity Standard, OCIO-STND-01, dated April 1, 2020, Section 3.13. 

Personnel Access.

– The Standards for Internal Control in the Federal Government issued by the Comptroller General of the 

United States (the Green Book), Section OV3.08 Effect of Deficiencies on the Internal Control System, 

Principle 3 Establish Structure, Responsibility, and Authority, Documentation of the Internal Control 

System, Principle No. 3.08 Assignment of Responsibility and Delegation of Authority, Principle No. 8.07 

Response to Fraud Risks, Principle No. 10.3 Design of Appropriate Types of Control Activities, Principle 

No.10.12 Segregation of Duties, Principle No. 11, Design Activities for the Information System, and 

Principle No. 13, Use Quality Information, Principle No.17, Evaluate Issues and Remediate Deficiencies. 

– National Institute of Standards and Technology Special Publication 800-53, Security and Privacy Controls 

for Federal Information Systems and Organizations, Revision 4, dated April 2013, specifically security 

control requirements PM-4 Plan of Action and Milestone, AC-2 Account Management, AC-5 Separation of 

Duties, AC-6 Least Privilege, CM-3 Configuration Change Control, and CM-5 Access Restrictions for 

Change. 

Recommendations: 

We recommend that the Department: 

1. Evaluate, develop, and implement a formal process to track and report all new and separated contractors. 

2. Ensure separated contractors are off-boarded and system personnel are notified in a timely manner to 

disable or remove access to IT resources. 

3. Provide training and oversight to Education personnel with on/off-boarding responsibilities to help ensure 

new/separated contractors are properly tracked. 
106 FY 2021 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION

FINANCIAL SECTION | REPORT OF ThE INDEPENDENT AuDITORS

B-3 

We recommend that FSA: 

4. Implement a process to evaluate the significance of a deficiency by considering the magnitude of impact, 

likelihood of occurrence, and nature of the deficiency and tailor the corrective actions to remediate the risk 

and address the root cause. Further, update guidance to ensure that quality reviews over the POA&M 

closure documentation are conducted to confirm the noted deficiencies are fully addressed to help prevent 

future reoccurrences. 

5. Formally develop and implement a quality control review process to ensure that logical access control 

processes are followed completely and accurately to validate logical access requests, reviews, and 

recertifications. 

6. Ensure segregation of duties and least privilege principles are adhered to when granting user access to 

prevent users with the ability to develop and/or change application code from having update access to the 

environment where the final tested and approved changes are staged prior to migration to the financial and 

mixed systems’ production environment; and prevent users with access to develop code from having 

update access to the production environment. 

7. Ensure a complete and accurate population of application changes can be provided. Formally develop and 

implement a quality control review process to ensure that the application change control process is 

followed and consistently and accurately documented. 
FY 2021 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION 107

REPORT OF ThE INDEPENDENT AuDITORS | FINANCIAL SECTION

B-4 

B. Monitoring Controls over Service Organizations Need Improvement 

The Department and FSA rely on a certain IT system to store data for student loan programs. The Cost 

Estimation and Analysis Division (CEAD) within the Department also uses the data in the system for the 

development and update of the assumptions used in the re-estimation of subsidy allowance, a critical 

component of management’s financial reporting process. The IT system is owned and controlled by FSA, who 

is responsible for the application-level internal controls, and is hosted by a service organization, who is 

responsible for internal controls at the data center. 

Condition:

The Department and FSA did not have effective monitoring controls in place to ensure that the scope of the 

System and Organization Controls (SOC) 1, Type 2 report for the service organization and/or management’s

internal control processes sufficiently cover the relevant key controls to support the reliability and integrity of the 

data stored in the IT system. For example, we noted that there were no sufficient relevant controls identified 

and tested for data transmission/batch job processing at the host level for one FSA system to ensure the 

completeness and accuracy of the data used in the re-estimate. 

Cause/Effect: 

FSA did not perform a comprehensive assessment of key relevant controls to appropriately assess the risks in 

the financial reporting process. 

Ineffective monitoring controls over the service organization increase the risk of disruption, modification, or 

destruction of information that could impact the integrity and reliability of information processed in the 

associated application which may lead to misstatements of the financial statements. 

Criteria: 

The following criteria were considered in the evaluation of the significant deficiency presented in this exhibit:

– The Standards for Internal Control in the Federal Government issued by the Comptroller General of the 

United States (the Green Book), Section OV4.01 Additional Consideration, Service Organizations, Principle 

16.08 - Perform Monitoring Activities.

– National Institute of Standards and Technology Special Publication 800-53, Security and Privacy Controls 

for Federal Information Systems and Organizations, Revision 4, dated April 2013, specifically security 

control requirements SA-9 External Information System Services.

Recommendations: 

We recommend that FSA:

1. Enhance their risk assessment to identify risks impacting financial reporting processes. 

2. Identify the controls at the service organization for the systems that are responsive to risks and that are 

relevant to FSA’s financial statements. 

3. Regularly monitor and meet with the service organization to communicate and ensure that controls that are 

relevant to FSA for financial reporting are adequately tested for design, implementation, and operating 

effectiveness. 

4. Assess the need to implement compensating controls for financial reporting in the event relevant controls at 

the service organization are not within the scope of the SOC 1 report. 
108 FY 2021 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION

FINANCIAL SECTION | REPORT OF ThE INDEPENDENT AuDITORS

B-5 

C. Entity Level Controls Need Improvement 

The Department and FSA are continually seeking ways to improve accountability in achieving the entity’s 

mission. A key factor in improving accountability in achieving an entity’s mission is to implement an effective 

internal control system. The control environment sets the tone of an organization by influencing the control 

consciousness of its personnel. It is also the foundation for all components of internal control, providing 

discipline and structure. The Department and FSA need to address weaknesses in its entity-wide control 

environment as we have observed two entity-wide control environment conditions through our procedures that 

have a pervasive influence on the effectiveness of controls. These common themes, which contributed to the 

deficiencies noted above, are related to the entity’s risk assessment and monitoring activities.

Conditions:

1. Risk Assessment- The Department and FSA’s entity level controls were not designed and implemented 

appropriately in order to define objectives related to the financial reporting process to enable the 

identification of risks, define risk tolerances and identified processes and controls responsive to those risks. 

2. Monitoring Activities- The Department and FSA’s entity level controls were not designed and implemented 

appropriately in order to remediate identified internal control deficiencies in a timely manner.

Cause/Effect

1. Risk Assessment considerations address the risks facing the entity as it seeks to achieve its objectives. 

This assessment provides the basis for developing appropriate risk responses. Specifically, inadequate risk 

assessment throughout the Department and FSA, prevented the proper identification and analysis of risks 

related to the financial reporting process at the Department and FSA, and from designing appropriate risk 

responses. For example, the Department did not identify the risk objectives that should have been either 

addressed by the SOC1, Type 2 report or through compensating controls at the Department and FSA, to 

support the reliability and integrity of the data used in the financial reporting process. 

2. Monitoring Activities considerations address management’s processes to establish and implement 

operations that assess the quality of performance over time and promptly resolve the findings of audits and 

other reviews. Specifically, insufficient monitoring has prevented the Department and FSA from ensuring 

that corrective action plans are implemented, and control deficiencies are remediated timely. 

Criteria

The following criteria were considered in the evaluation of the significant deficiency presented in this Exhibit: 

– GAO Standards for Internal Control in the Federal Government (Green Book) Principle 6, Management 

should define objectives clearly to enable the identification of risks and define risk tolerances.

– GAO Standards for Internal Control in the Federal Government (Green Book) Principle 17, Management 

should remediate identified internal control deficiencies on a timely basis

Recommendations

We recommend that management implement the following to improve the effectiveness of entity-level controls: 

1. Improve the risk assessment process at the financial statement assertion level and at the process level to 

ensure the department is appropriately defining objectives to enable the identification of risks and define 

risk tolerances. 

2. Implement key monitoring controls to ensure that corrective action plans are implemented to timely 

remediate control deficiencies identified. In addition, increase oversight, review, and accountability over the 

process among various offices and directorates within the Department and FSA. 
FY 2021 AGENCY FINANCIAL REPORT | U.S. DEPARTMENT OF EDUCATION 109

REPORT OF ThE INDEPENDENT AuDITORS | FINANCIAL SECTION

UNITED STATES DEPARTMENT OF EDUCATION

OFFICE OF FINANCE AND OPERATIONS

November 16, 2021 

MEMORANDUM

TO:

Bryon S. Gordon 

Assistant Inspector General for Audit 

FROM: Denise L. Carter

Delegated the authority to perform the functions and duties 

of the position of Chief Financial Officer 

Jason Gray

Chief Information Officer

SUBJECT: DRAFT INDEPENDENT AUDITORS’ REPORT

Fiscal Years 2021 and 2020 Financial Statements

U.S. Department of Education 

ED-OIG/A21FS0021 

Please convey the Department’s sincere thanks to everyone on your staff who worked diligently 

on this financial statement audit. The Department reviewed the draft Fiscal Year 2021 Financial 

Statement Audit Report. We concur and agree with the Independent Auditors’ Report, including 

the Opinion on the Financial Statements, Internal Control over Financial Reporting, and 

Compliance and Other Matters. 

We will share the final audit results with responsible senior officials, other interested program 

managers, and staff. At that time, we will also request the preparation of corrective action plans

to be used in the resolution process. 

Again, please convey our appreciation to everyone on your staff whose efforts permitted the 

Department to complete the audit. 

Please contact Gary Wood, Deputy Assistant Secretary, Office of Financial Management, Office 

of Finance and Operations, and Acting Deputy Chief Financial Officer, at 202-453-7631 with 

any questions or comments. 

400 MARYLAND AVE., S.W., WASHINGTON, DC 20202 

www.ed.gov

The Department of Education's mission is to promote student achievement and preparation for global competitiveness by 

fostering educational excellence and ensuring equal access.

Denise Carter Digitally signed by Denise Carter 

Date: 2021.11.16 15:38:29 -05'00'

JASON GRAY Digitally signed by JASON GRAY 

Date: 2021.11.16 15:40:36 -05'00'

Management's Response

Exhibit C
This page intentionally left blank.