State audit: 56 IT weaknesses and major financial adjustments at Health and universities highlight reporting and cybersecurity risks
Loading...
Summary
The Auditor of Public Accounts reported 107 fiscal year findings including 56 IT findings; material weaknesses were issued for Social Services (three material weaknesses), significant audit adjustments at the Department of Health and large university reporting weaknesses at UVA and ODU. APA urged stronger succession planning, updated policies and
Auditor of Public Accounts staff reported systemic issues across state agencies and higher‑education institutions in their fiscal year 2024 audits, highlighting significant information‑technology weaknesses and large financial statement adjustments at major agencies.
Zach Borgerding, deputy auditor, said the APA identified 107 findings in total and that 56 of those were information‑technology related. "Cybersecurity risks continue to evolve and bad actors continue to find different ways to attack the Commonwealth's data," Borgerding said, noting configuration management, access control and risk assessment as recurring control families with problems.
On non‑IT matters, the APA reported substantial audit adjustments at the Department of Health (over $456 million in adjustments) and at the Department of Human Resources (adjustments totaling over $600 million) driven primarily by turnover in key positions and by gaps in policies and procedures, the auditors said. The APA warned that untimely or inaccurate financial reporting can put the Commonwealth—s bond rating at risk and repeated a risk alert urging agencies to document processes and plan for succession.
The APA also issued three material weaknesses in its audit of the Department of Social Services, citing the need to reevaluate IT governance, weaknesses in subrecipient monitoring that risk disallowed federal costs, and inaccurate performance reporting to federal TANF sponsors. Borgerding said the agency has since hired a consultant and "we do feel like the agency heard that message."
In higher education, the APA reiterated a material weakness at the University of Virginia (first issued in 2021 and elevated in 2022) that covers financial reporting governance across complex related organizations, and reported a material weakness at Old Dominion University tied to untimely preparation and ongoing adjustments; APA noted ODU used turnover as an opportunity to reengineer reporting processes and that preliminary follow‑up found improvements in timeliness for FY24 work.
The auditors recommended agencies prioritize succession planning, document key reporting processes and remediate IT control gaps. The APA said difficulties filling accounting positions and increased turnover across state government have amplified these problems, and that agencies should consider succession strategies and up‑to‑date policies to reduce audit adjustments and operational risk.
Ending: APA staff said they will continue follow‑up work, start the FY25 audit cycle, and return to the commission with updates on remediation efforts for the material weaknesses and IT findings.
