FY 2023 AGENCY FINANCIAL REPORT 100 U.S. DEPARTMENT OF EDUCATION

Financial Section (Unaudited)

Report of the Independent Auditors

UNITED STATES DEPARTMENT OF EDUCATION

OFFICE OF INSPECTOR GENERAL

THE INSPECTOR GENERAL

400 MARYLAND AVENUE, S.W., WASHINGTON, DC 20202-1510

Promoting the efficiency, effectiveness, and integrity of the Department’s programs and operations.

November 16, 2023

The Honorable Miguel Cardona

Secretary of Education

Washington, D.C. 20202

Dear Secretary Cardona:

The enclosed Independent Auditors’ Report (report) covers the consolidated balance sheet of 

the United States Department of Education (Department) as of September 30, 2023, and the 

related notes (the consolidated financial statement), to comply with the Chief Financial Officers 

Act of 1990, as amended. The report should be read in conjunction with the Department’s 

consolidated financial statement to fully understand the context of the information contained 

therein.

We engaged the independent certified public accounting firm KPMG LLP (KPMG) to audit the 

consolidated financial statement of the Department as of September 30, 2023. The contract 

requires that the audit be performed in accordance with U.S. generally accepted government 

auditing standards and Office of Management and Budget bulletin, Audit Requirements for 

Federal Financial Statements. Following is a summary of the results reported in the

Independent Auditors’ Report.

Report on the Audit of the Consolidated Financial Statement

Disclaimer of Opinion

KPMG has not been able to obtain sufficient appropriate audit evidence to provide a 

basis for an audit opinion because of unresolved errors KPMG identified in the 

underlying data used to calculate the subsidy re-estimates for the Department’s direct 

loan and loan guaranty programs.

Report on Internal Control Over Financial Reporting

Material Weakness (Exhibit A)

Controls over the Relevance and Reliability of Underlying Data Used in Credit Reform 

Estimates Need Improvement.

Significant Deficiencies (Exhibit B)

Information Technology Controls Need Improvement, and

Entity Level Controls Need Improvement.
FY 2023 AGENCY FINANCIAL REPORT 101 U.S. DEPARTMENT OF EDUCATION

Financial Section (Unaudited)

Page 2 – Independent Auditors’ Report

Report on Compliance and Other Matters 

Compliance and Other Matters (Exhibit C) 

Federal Managers’ Financial Integrity Act of 1982 (FMFIA)

Federal Financial Management Improvement Act of 1996 (FFMIA)

In connection with the contract, the Office of Inspector General reviewed KPMG’s report and 

related documentation and inquired of its representatives. Our review, as differentiated from 

an audit of the consolidated financial statement in accordance with U.S. generally accepted 

government auditing standards, was not intended to enable us to express, and we do not 

express, opinions on the Department’s consolidated financial statement or internal control over 

financial reporting, or conclusions on whether the Department’s financial management systems 

complied substantially with the three FFMIA requirements, or on compliance with laws and 

other matters. KPMG is responsible for the report dated November 16, 2023, and the 

conclusions expressed therein. However, our review disclosed no instances where KPMG did 

not comply, in all material respects, with U.S. generally accepted government auditing 

standards. 

We appreciate the cooperation given KPMG and my office during the audit. If you have any 

questions or would like to discuss the report, please contact me at (202) 245-6900.

Sincerely, 

Sandra D. Bruce

Inspector General

Enclosure
FY 2023 AGENCY FINANCIAL REPORT 102 U.S. DEPARTMENT OF EDUCATION

Financial Section (Unaudited)

Independent Auditors’ Report

Inspector General 

United States Department of Education

Secretary

United States Department of Education:

Report on the Audit of the Consolidated Financial Statement

Disclaimer of Opinion

We were engaged to audit the consolidated balance sheet of the United States Department of Education 

(Department) as of September 30, 2023, and the related notes (the consolidated financial statement).

We do not express an opinion on the accompanying consolidated financial statement of the Department.

Because of the significance of the matter described in the Basis for Disclaimer of Opinion section of our report, 

we have not been able to obtain sufficient appropriate audit evidence to provide a basis for an audit opinion on 

the consolidated financial statement.

Basis for Disclaimer of Opinion 

During fiscal year 2023, we identified errors in the underlying data used to develop assumptions used to 

calculate the subsidy re-estimates for the Department’s direct loan and loan guaranty programs. Management 

was unable to determine the extent of the impact of these issues on the balance sheet and related notes. As a 

result of this matter, we are unable to determine whether any adjustments to the balance sheet might have 

been necessary with respect to the fiscal year 2023 Loan Receivables, Net – Direct Loan Program; Loan 

Receivables, Net – Federal Family Education Loan (FFEL) Program; Subsidy Due to Treasury; Loan 

Guarantee Liabilities; Unexpended Appropriations; Cumulative Results of Operations; and the related notes.

Other Matter - Interactive Data

Management has elected to reference to information on websites or other forms of interactive data outside the 

fiscal year 2023 Agency Financial Report to provide additional information for the users of its consolidated 

financial statement. Such information is not a required part of the consolidated financial statement or 

supplementary information required by the Federal Accounting Standards Advisory Board. The information on 

these websites or the other interactive data has not been subjected to any of our auditing procedures, and 

accordingly we do not express an opinion or provide any assurance on it.

Responsibilities of Management for the Consolidated Financial Statement

Management is responsible for the preparation and fair presentation of the consolidated financial statement in 

accordance with U.S. generally accepted accounting principles, and for the design, implementation, and 

maintenance of internal control relevant to the preparation and fair presentation of the consolidated financial 

statement that is free from material misstatement, whether due to fraud or error.

Auditors’ Responsibilities for the Audit of the Consolidated Financial Statement

Our responsibility is to conduct an audit of the Department’s consolidated financial statement in accordance 

with auditing standards generally accepted in the United States of America (GAAS), Government Auditing 

Standards, issued by the Comptroller General of the United States, and Office of Management and Budget 

KPMG LLP

Suite 12000

1801 K Street, NW

Washington, DC 20006

KPMG LLP, a Delaware limited liability partnership and a member firm of 

the KPMG global organization of independent member firms affiliated with 

KPMG International Limited, a private English company limited by guarantee. 
FY 2023 AGENCY FINANCIAL REPORT 103 U.S. DEPARTMENT OF EDUCATION

Financial Section (Unaudited)

2

(OMB) Bulletin No. 24-01, Audit Requirements for Federal Financial Statements, and to issue an auditors’

report. However, because of the matter described in the Basis for Disclaimer of Opinion section of our report, 

we were not able to obtain sufficient appropriate audit evidence to provide a basis for an audit opinion on this

consolidated financial statement.

We are required to be independent of the Department and to meet our other ethical responsibilities, in 

accordance with the relevant ethical requirements relating to our audit.

Required Supplementary Information

U.S. generally accepted accounting principles require that the information in the Management’s Discussion and 

Analysis and Required Supplementary Information sections be presented to supplement the basic consolidated 

financial statement. Such information is the responsibility of management and, although not a part of the basic 

consolidated financial statement, is required by the Federal Accounting Standards Advisory Board who 

considers it to be an essential part of financial reporting for placing the basic consolidated financial statement in 

an appropriate operational, economic, or historical context. We were unable to apply certain limited procedures 

to the required supplementary information in accordance with GAAS because of the significance of the matter 

described in the Basis for Disclaimer of Opinion paragraph. We do not express an opinion or provide any 

assurance on the information.

Report on Internal Control Over Financial Reporting

In connection with our engagement to audit the Department’s consolidated financial statement as of 

September 30, 2023, we considered the Department’s internal control over financial reporting (internal control) 

as a basis for designing audit procedures that are appropriate in the circumstances for the purpose of 

expressing an opinion on the consolidated financial statement, but not for the purpose of expressing an opinion 

on the effectiveness of the Department’s internal control. Accordingly, we do not express an opinion on the 

effectiveness of the Department’s internal control. We did not test all internal controls relevant to operating 

objectives as broadly defined by the Federal Managers’ Financial Integrity Act of 1982.

Our consideration of internal control was for the limited purpose described in the preceding paragraph and was 

not designed to identify all deficiencies in internal control that might be material weaknesses or significant 

deficiencies and therefore, material weaknesses or significant deficiencies may exist that were not identified. 

However, as described in the accompanying Exhibits, we identified certain deficiencies in internal control that 

we consider to be a material weakness and significant deficiencies.

A deficiency in internal control exists when the design or operation of a control does not allow management or 

employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, 

misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in 

internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial 

statement will not be prevented, or detected and corrected, on a timely basis. We consider the deficiencies 

described in the accompanying Exhibit A, Controls over the Relevance and Reliability of Underlying Data Used 

in Credit Reform Estimates Need Improvement, to be a material weakness.

A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe 

than a material weakness, yet important enough to merit attention by those charged with governance. We 

consider the deficiencies described in the accompanying Exhibit B, Information Technology Controls Need 

Improvement and Entity Level Controls Need Improvement, to be significant deficiencies.

Report on Compliance and Other Matters

In connection with our engagement to audit the Department’s consolidated financial statement as of

September 30, 2023, we performed tests of its compliance with certain provisions of laws, regulations, 

contracts, and grant agreements, noncompliance with which could have a direct and material effect on the 

consolidated financial statement. However, providing an opinion on compliance with those provisions was not 

an objective of our engagement, and accordingly, we do not express such an opinion. The results of our tests 
FY 2023 AGENCY FINANCIAL REPORT 104 U.S. DEPARTMENT OF EDUCATION

Financial Section (Unaudited)

3

disclosed instances of noncompliance or other matters that are required to be reported under Government 

Auditing Standards or OMB Bulletin No. 24-01, and which are described in Exhibit C.

We also performed tests of the Department’s compliance with certain provisions referred to in Section 803(a) of 

the Federal Financial Management Improvement Act of 1996 (FFMIA). Providing an opinion on compliance with 

FFMIA was not an objective of our engagement, and accordingly, we do not express such an opinion. The 

results of our tests disclosed instances in which the Department’s financial management systems did not 

substantially comply with the (1) Federal financial management systems requirements and (2) applicable 

Federal accounting standards. The results of our tests disclosed no instances in which the Department’s 

financial management systems did not substantially comply with the United States Government Standard 

General Ledger at the transaction level.

Additionally, if the scope of our work had been sufficient to enable us to express an opinion on the consolidated 

financial statement, other instances of noncompliance or other matters may have been identified and reported 

herein.

Department’s Response to Findings

Government Auditing Standards requires the auditor to perform limited procedures on the Department's 

response to the findings identified in our engagement and described in Exhibit D. The Department’s response 

was not subjected to the other auditing procedures applied in the engagement to audit the consolidated 

financial statement and, accordingly, we express no opinion on the response.

Purpose of the Reporting Required by Government Auditing Standards

The purpose of the communication described in the Report on Internal Control Over Financial Reporting and 

the Report on Compliance and Other Matters sections is solely to describe the scope of our testing of internal 

control and compliance and the results of that testing, and not to provide an opinion on the effectiveness of the 

Department’s internal control or compliance. Accordingly, this communication is not suitable for any other 

purpose.

Washington, D.C.

November 16, 2023
FY 2023 AGENCY FINANCIAL REPORT 105 U.S. DEPARTMENT OF EDUCATION

Financial Section (Unaudited)

A-1 

Exhibit A

Material Weakness

Controls over the Relevance and Reliability of Underlying Data Used in Credit Reform Estimates Need 

Improvement 

Background:

The material weakness under this section is related to the Department’s Direct and FFEL student loan 

portfolios. 

The Department is required to perform interest rate and technical re-estimates of the subsidy costs (commonly 

referred to as subsidy re-estimates) of its direct loan and loan guaranty programs as of September 30 every 

year. 

These subsidy re-estimates are calculated using an internally developed cash flow model, the Student Loan 

Model (SLM). The SLM utilizes assumptions based on internally sourced data elements from Information 

Technology (IT) systems. The future cash flow outputs generated from the SLM are input into the format 

required by the Office of Management and Budget (OMB) Credit Subsidy Calculator (CSC), a required present 

value discount tool for agencies with credit reform programs, to produce the subsidy re-estimates. 

Condition:

Management did not design and implement sufficiently precise controls over the relevance and reliability of

certain data used in key assumptions for the SLM.

Cause/Effect:

Management’s risk assessment process was not sufficient to identify the risk related to the relevance and 

reliability of the underlying data used in significant assumptions for the subsidy re-estimates. Additionally, 

management did not sufficiently communicate errors in the underlying data internally to those responsible for 

calculating the subsidy re-estimates. Inadequate controls over the relevance and reliability of the underlying 

data used to develop the subsidy re-estimates led to errors which increases the risk that the balance sheet and 

related notes could be materially misstated.

Criteria:

The following criteria were considered in the evaluation of the material weakness presented in this exhibit:

• The Standards for Internal Control in the Federal Government issued by the Comptroller General of the 

United States (the Green Book), Principle 6, Define Objectives and Risk Tolerances; Principle No. 10, 

Design Control Activities; Principle No. 13, Use Quality Information; Principle No. 14, Communicate 

Internally. 

• FASAB Technical Release 6, Preparing Estimates for Direct Loan and Loan Guarantee Subsidies under the 

Federal Credit Reform Act – Amendments to Technical Release No. 3 Preparing and Auditing Direct Loan 

and Loan Guarantee Subsidies under the Federal Credit Reforms Act, Paragraph 20.

Recommendation:

We recommend that management design and implement controls that require the validation of the relevance

and reliability of underlying data used in developing the assumptions related to the subsidy re-estimates. Such 

review should be documented and maintained. 
FY 2023 AGENCY FINANCIAL REPORT 106 U.S. DEPARTMENT OF EDUCATION

Financial Section (Unaudited)

B-1 

Exhibit B

Significant Deficiencies

A. Information Technology Controls Need Improvement

The following control deficiencies in the areas of Information Technology (IT) logical access, security 

management, segregation of IT duties, application change management, and computer operations are related 

to both the Department and Federal Student Aid (FSA) systems. 

Conditions:

In prior years, we reported a significant deficiency related to the Department and FSA’s IT controls due to 

persistent unmitigated IT control deficiencies. During FY 2023, the FSA management demonstrated progress 

implementing corrective actions to remediate some prior-year deficiencies, such as change and configuration 

management controls. However, the Department management and FSA management have not fully 

remediated prior-year deficiencies related to logical access administration, separated and transferred user 

access removal, user access reviews and recertification, configuration management, and computer operations. 

New and existing IT control deficiencies related to security management, access controls, and segregation of IT 

duties for the Department’s core financial management system, three of FSA’s financial and mixed systems, 

and one identity and access management support system are as follows:

Department:

1. Deficiencies in IT security management controls: System deficiencies, including those identified during 

external audits, for the Department’s core financial management system were not documented in Plan of 

Action and Milestones (POA&M) and tracked in the security management tool, as required by Department 

policies and guidance. 

2. Deficiencies in IT logical access controls: Access controls for new and separated contractors were not 

consistently and accurately performed, including the inconsistent reporting of start and termination effective 

dates. Further, the access controls were not consistently followed for the Department’s core financial 

management system. Specifically,

a. documentation supporting the completed security awareness training for new and modified users could 

not be provided; 

b. evidence supporting complete and accurate access reviews and recertifications was not provided or 

retained;

c. password controls were not designed to meet the Department’s requirements; and 

d. the Department’s requirement for the use and monitoring of generic and shared accounts for two of 

three of the Department’s financially relevant applications was not met for all accounts.

3. Deficiencies in IT controls related to the segregation of IT duties: For one of the Department’s core financial 

management systems, users with developer access had access greater than read-only to the system’s 

production environment.

4. Deficiencies in IT application change management and patch management controls: The application 

change management and patch management policies and controls were not consistently followed for the 

Department’s core financial management system in accordance with Department policy. The Department 

did not provide sufficient evidence supporting tracking, security assessment, and approval for certain 

application changes and patches. 
FY 2023 AGENCY FINANCIAL REPORT 107 U.S. DEPARTMENT OF EDUCATION

Financial Section (Unaudited)

B-2 

5. Deficiencies in IT computer operations controls: Controls over computer operations were not properly 

designed and implemented. Specifically, 

a) changes to the job processing and scheduling tools were not centrally tracked; 

b) changes were made directly in the production environment; and

c) the use and monitoring of generic and shared accounts for the job scheduling tool did not follow the 

Department’s requirements.

FSA:

1. Deficiencies in IT security management controls: Management did not effectively operate corrective action, 

remediation, and quality review controls for IT security weaknesses. Specifically, Plan of Action and 

Milestone (POA&M) closure documentation for three FSA systems and one identity and access 

management system did not always address the root cause of the deficiencies, thereby increasing the 

potential of IT control deficiencies reoccurring in the future. 

2. Deficiencies in IT logical access controls: The access control processes were not consistently followed for 

three FSA systems and one identity and access management system. Specifically,

a. evidence supporting complete and accurate access listings and evidence supporting new, modified, or 

separated users was not provided or was provided with missing required information and/or approvals;

b. unauthorized access was provisioned and/or access was provisioned without adhering to the least 

privileged principle;

c. evidence supporting complete and accurate access reviews and recertification controls was 

unavailable or was retained; and

d. the Department’s requirement for multi-factor authentication control was not implemented for all internal 

system users.

Cause/Effect:

Management has not performed effective risk assessments and there was a lack of effective monitoring 

controls over the effectiveness of designed control activities by the Department and FSA to ensure the 

following:

1. All system deficiencies, including those identified during external audits, have a documented POA&M and 

are tracked in the required security management tool. Additionally, corrective actions to remediate 

prior-year conditions and associated causes are fully implemented, as well as verifying and validating that 

these corrective actions were effectively addressing the weakness with adequately documented supporting 

evidence.

2. Systems and support processes consistently adhered to documented agency-wide policies and procedures 

for the financial and mixed systems hosted and managed by FSA and the Department.

3. The established logical access control process is followed and requests and related evidence for new, 

modified, or separated users were retained, documented completely and accurately, and approved.

4. Complete and accurate access reviews are performed to detect and mitigate the risk of unauthorized 

accounts, access that is not commensurate with job responsibilities or least privilege, and access 

permissions not being revoked timely.
FY 2023 AGENCY FINANCIAL REPORT 108 U.S. DEPARTMENT OF EDUCATION

Financial Section (Unaudited)

B-3 

5. Password controls are designed to meet the Department’s requirements.

6. The requirements for the use and monitoring of generic and shared accounts controls are followed and 

enforced. 

7. Segregation of duties and least privilege principles are followed and enforced.

8. The established change process and patch management process are followed.

9. The established process for job processing changes is followed and the requirements for the use and 

monitoring of generic/shared accounts controls for the job scheduling tool are followed and enforced. 

10. The established computer operations process detects and/or prevents unauthorized changes to the job 

processing tool and schedules within the core financial system environment. 

Ineffective IT controls increases the risk of unauthorized use, disclosure, disruption, modification, or destruction 

of information, and information systems that could impact the integrity and reliability of information processed in 

the associated applications which may lead to misstatements of the financial statements.

Criteria:

The following criteria were considered in the evaluation of the significant deficiency presented in this exhibit:

• The Departmental Directive OCIO 3-112, Cybersecurity Policy.

• Department Information Technology (IT) System Access Control Standard.

• Department IT Identification and Authentication (IA) Standard.

• EDCAPS System Security Plan (SSP) control requirements.

• FMS SSP control requirements.

• EDCAPS Configuration Management Plan (CMP).

• Department Information Technology System and Information Integrity (SI) standard policy section 2.2 

control SI-2, Flaw Remediation.

• EDCAPS Patch Management Plan, section 4.7 Patch Maintenance.

• Department Baseline Cybersecurity Standard, OCIO-STND-01, dated September 23, 2021, Section 3.15. 

Acceptable Use. 

• Office of the Chief Information Officer (OCIO), Information Assurance Services (IAS) Plan of Action and 

Milestones, Standard Operating Procedures (SOP), Version 2.8 dated July 7, 2022, Section 1.4 POA&M 

Management and Section 4.7 CAP POA&M Workflow.

• Cybersecurity Policy, Departmental Directive ACSD-OCIO-004, section V. Responsibilities.

• Information Technology (IT) System Security Assessment and Authorization (CA) Standard dated 

January 31, 2023, Section 2.4 CA-5 Plan of Action and Milestones (POA&M) (P, L, M, H and Control 

Overlay).

• IT Program Management (PM) Standard dated January 31, 2023, section 2.4 PM-4 Plan of Action and 

Milestones Process (P, Deployed Organization-Wide).

• The Green Book, Principle No. 2, Exercise Oversight Responsibility, Principle No. 3 Establish Structure, 

Responsibility, and Authority, Principle No. 4, Demonstrate Commitment to Competence, Principle No. 7, 

Identify, Analyze, and Respond to Risks, Principle No. 8 Assess Fraud Risk, Principle No.10, Design 

Control Activities, Principle No. 11, Design Activities for the Information System, Principle No. 13, Use 
FY 2023 AGENCY FINANCIAL REPORT 109 U.S. DEPARTMENT OF EDUCATION

Financial Section (Unaudited)

B-4 

Quality Information, Principle No.16, Perform Monitoring Activities, Principle No.17, Evaluate Issues and 

Remediate Deficiencies. 

• Federal Information Processing Standards (FIPS) 200, Minimum Security Requirements for Federal 

Information and Information Systems.

• National Institute of Standards and Technology Special Publication 800-53, Security and Privacy Controls 

for Federal Information Systems and Organizations, Revision 5, specifically security control requirements 

CA-5 Plan of Action and Milestones, PM-4 Plan of Action and Milestone Process, AC-2 Account 

Management, AC-5 Separation of Duties, AC-6 Least Privilege, AT-3 Role-based Training, AT-4 Training 

records, IA-2 Identification and Authentication (Organizational Users); CM-3 Configuration Change Control, 

and SI-2 Flaw Remediation. 

Recommendations:

We recommend that the Department:

1. Improve the risk assessment process over IT to help ensure the Department is appropriately defining 

objectives to enable the identification of risks and associated controls to help mitigate the risks.

2. Communicate control issues and/or weaknesses through established tools and relevant reporting lines to 

the appropriate parties on a timely basis to enable prompt evaluation and resolution of the issues and/or 

weaknesses.

3. Evaluate, design, and implement controls to track and report all new and separated contractors.

4. Ensure separated contractors are off-boarded and system personnel are notified in a timely manner to 

disable or remove access to IT resources.

5. Provide training and oversight to the Department’s personnel with on/off-boarding controls to help ensure 

new/separated contractors are properly tracked.

6. Update access review procedures to require the reviewers to verify the access lists received to be used in 

the performance and operation of the access reviews is complete and accurate and not modified prior to 

commencing the access reviews.

7. Identify, design, and implement controls requiring a reviewer to validate the population generated for review 

is complete and accurate. 

8. Enforce established access authorization controls and ensure all requirements are met prior to granting 

system access. Formally perform and document the periodic reviews of all database user accounts in 

accordance with Department policy to confirm access is current, authorized, and commensurate with job 

responsibilities.

9. Ensure the application and database server access review controls include the verification of access 

privileges assigned to the user accounts are commensurate with job responsibilities and follow the concept 

of least privilege.

10. Ensure the database and server layer controls comply and operate with the disabling of inactive accounts 

and account lockout duration password setting requirements, as required by Department Policy. 

11. Adhere to the SSP control requirements and avoid the use of generic and shared accounts. If generic and 

shared accounts are required, obtain a formal risk acceptance and develop a policy and procedure to:

a. Authorize the use of these accounts by approved personnel, 
FY 2023 AGENCY FINANCIAL REPORT 110 U.S. DEPARTMENT OF EDUCATION

Financial Section (Unaudited)

B-5 

b. Control who can access the generic/shared accounts and those sensitive actions performed by the 

accounts are logged and reviewed every time the accounts are used, and

c. Require that generic/shared accounts’ passwords are changed each time approved personnel separate 

or transfer from the Department. 

We recommend that FSA:

12. Design and implement improvements for the risk assessment process over IT to help ensure the FSA is 

appropriately defining objectives to enable the identification of risks and associated controls to help mitigate 

the risks.

13. Design and implement controls to evaluate the magnitude of impact, likelihood of occurrence, and nature of 

the deficiency in order to tailor the corrective actions to remediate the risk and address the root cause. 

Further, update guidance to ensure that quality reviews over the POA&M closure documentation are 

conducted to confirm the noted deficiencies are fully addressed to help prevent future reoccurrences.

14. Formally develop and implement a quality control review process to ensure that logical access control 

processes are followed completely and accurately to validate logical access requests, reviews, and 

recertifications.

15. Ensure segregation of duties and least privilege principles are adhered to when granting user access. 

16. Evaluate and update the access review controls based on risk and enforce segregation of duties. 

17. Reconcile the list of users’ roles and responsibilities from the identity and access software tools to the lists 

that reside in each system accessed by such users. 

18. Update access review policies and controls to require the reviewer to verify the access list, received to be 

used in the performance of the access reviews, is complete and accurate and not modified prior to 

commencing the access reviews.

19. Enforce the operation of established access authorization controls and ensure all requirements are met 

prior to granting access to systems.
FY 2023 AGENCY FINANCIAL REPORT 111 U.S. DEPARTMENT OF EDUCATION

Financial Section (Unaudited)

B-6 

B. Entity Level Controls Need Improvement

A key factor in improving accountability in achieving an entity’s mission is to implement an effective internal 

control system. The control environment sets the tone of an organization by influencing the control 

consciousness of its personnel. It is also the foundation for all components of internal control, providing 

discipline and structure. The Department and FSA need to address weaknesses in its entity-wide control 

environment as we have observed, through our procedures, two entity-wide control environment conditions in 

the areas of risk assessment and monitoring activities that have a pervasive influence on the effectiveness of 

controls. 

Conditions:

1. Risk Assessment- The Department and FSA’s entity level controls were not designed and implemented 

appropriately in order to define objectives related to financial reporting processes to enable the 

identification of risks, define risk tolerances and identify controls responsive to those risks.

2. Monitoring Activities- The Department and FSA’s entity level controls were not designed and implemented 

appropriately in order to remediate identified internal control deficiencies in a timely manner.

Cause/Effect: 

1. Inadequate risk assessment throughout the Department and FSA prevented the proper identification and 

analysis of certain risks related to the financial reporting process at the Department and FSA, and from 

designing appropriate risk responses. 

2. Insufficient monitoring prevented the Department and FSA from implementing corrective action plans and 

remediating control deficiencies timely.

The conditions noted above contributed to the control deficiencies described earlier in Exhibits A and B.A and 

could lead to other weaknesses in internal control over financial reporting. 

Criteria: 

The following criteria were considered in the evaluation of the significant deficiency presented in this Exhibit:

• The Green Book Principle 6, Define Objectives and Risk Tolerances. 

• The Green Book Principle 17, Evaluate Issues and Remediate Deficiencies. 

Recommendations: 

We recommend that management:

1. Improve the risk assessment process at the financial statement assertion level and at the process level to 

ensure the department is appropriately defining objectives to enable the identification of risks and define 

risk tolerances.

2. Implement key monitoring controls to ensure that corrective action plans are implemented to timely 

remediate control deficiencies identified. In addition, increase oversight, review, and accountability over the 

process among various offices and directorates within the Department and FSA. 
FY 2023 AGENCY FINANCIAL REPORT 112 U.S. DEPARTMENT OF EDUCATION

Financial Section (Unaudited)

C-1 

Exhibit C

Compliance and Other Matters

A. Federal Managers’ Financial Integrity Act of 1982 (FMFIA)

Condition:

Management performed an internal control assessment as required under FMFIA; however, management’s 

assessment did not substantially comply with FMFIA and the related OMB A-123 requirements. Specifically,

management did not consistently identify and document financial statement and process level risks and key 

controls. 

Cause/Effect:

Management did not substantially meet FMFIA requirements due to a lack of adequate risk assessments over 

key processes and data used in the consolidated financial statement. In addition, management did not 

sufficiently consider FMFIA and OMB Circular No. A-123 requirements when performing their evaluation of

internal controls.

This resulted in the lack of timely identification of errors in data that impacted subsidy re-estimates in the 

consolidated financial statement. Furthermore, management could not determine the effect of these errors on 

the consolidated financial statement. 

Criteria:

The following criteria were considered in the evaluation of the compliance matter presented in this Exhibit:

• Section 2 of FMFIA.

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal 

Control

Recommendation:

We recommend that management update the risk assessment regarding the evaluation of internal controls to 

ensure it includes all key processes, key data, and other material line items on the consolidated financial 

statement. 
FY 2023 AGENCY FINANCIAL REPORT 113 U.S. DEPARTMENT OF EDUCATION

Financial Section (Unaudited)

C-2 

B. Federal Financial Management Improvement Act of 1996 (FFMIA)

Condition:

Management did not establish and maintain financial management systems that substantially comply with the 

following FFMIA requirements: 

1. Federal Financial Management Systems Requirements. As discussed in Exhibit A, deficiencies in controls 

to prevent or detect errors in data used to calculate subsidy re-estimates prevented management from 

issuing reliable and accurate financial reporting. Specifically, management was unable to produce an 

auditable financial statement based on the data from the agency’s financial system.

2. Federal Accounting Standards. As discussed in Exhibit A, the control deficiencies identified during the audit 

provide an indication that the Department’s financial management systems were substantially noncompliant 

with applicable federal accounting standards. Specifically, management was unable to provide evidence 

that the cash flow projections for the subsidy re-estimates were based on sufficient relevant and reliable 

data preventing the agency’s ability to prepare an auditable financial statement.

Cause/Effect:

Management did not substantially meet FFMIA requirements due to an inadequate risk assessment over key 

processes and data used in the consolidated financial statement.

This increases the risk that transactions are incorrectly recorded to the general ledger, impacting the 

completeness, existence, and accuracy of the balances in the consolidated financial statement.

Criteria: 

The following criteria were considered in the evaluation of the compliance matter presented in this Exhibit:

• Section 803(a) of FFMIA.

• Appendix D to OMB Circular No. A-123, Compliance with the Federal Financial Management Improvement 

Act of 1996 

Recommendation:

We recommend that management implement the recommendation presented in the material weakness in 

Exhibit A. 
FY 2023 AGENCY FINANCIAL REPORT 114 U.S. DEPARTMENT OF EDUCATION

Financial Section (Unaudited)

D-1 

Exhibit D 

Att: Management’s Response