2023-001 – Pell Grant Calculation. Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Eligibility). Programs. Student Financial Assistance Cluster; U.S. Department of Education; Numbers 84.007, 84.033, 84.063, and 84.268; Award Numbers P007A222103, P033A222103, P063P225088, and P268K225088. Criteria. The Uniform Guidance states that the College must determine the maximum scheduled award a student would receive based on their Expected Family Contribution (EFC) and Cost of Attendance (COA) using the payment schedule provided by the U.S. Department of Education. Students must be awarded on the basis of a COA comprised of allowable costs assessed to all students carrying the same academic workload. COA must be prorated for students who are attending less than an academic year, or who are less than full-time in a term-based program. Condition. Three students out of the 40 tested had an incorrect COA and/or EFC recorded in PowerFAIDS. The error was isolated to the population of students enrolled less-than-half-time at the College. The College determined that they did not properly adjust the COA for the year. Subsequent to initial testing, the College adjusted and re-calculated the COA and EFC for all less-than-half-time students during the audit fieldwork. From the population of less-than-half-time students who received a Pell Grant during fiscal year 2023, a total of 34 students were awarded a higher amount of Pell than they were eligible to receive. Cause. This condition was caused by insufficient review of the COA and EFC data being used by the College in determining the Pell Grant amount for students. Effect. As a result of this condition, the College was exposed to an increased risk that incorrect information would be used to determine students' Pell Grant award amounts. Questioned Costs. No costs are required to be questioned as the amounts did not exceed the reporting threshold. Recommendation. We recommend the College implement procedures to ensure the COA and EFC used to calculate each student's Pell Grant is updated for each academic year and reviewed by an independent official. View of Responsible Officials. Management concurs with this finding and has prepared a Corrective Action Plan.
2023-001 – Pell Grant Calculation. Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Eligibility). Programs. Student Financial Assistance Cluster; U.S. Department of Education; Numbers 84.007, 84.033, 84.063, and 84.268; Award Numbers P007A222103, P033A222103, P063P225088, and P268K225088. Criteria. The Uniform Guidance states that the College must determine the maximum scheduled award a student would receive based on their Expected Family Contribution (EFC) and Cost of Attendance (COA) using the payment schedule provided by the U.S. Department of Education. Students must be awarded on the basis of a COA comprised of allowable costs assessed to all students carrying the same academic workload. COA must be prorated for students who are attending less than an academic year, or who are less than full-time in a term-based program. Condition. Three students out of the 40 tested had an incorrect COA and/or EFC recorded in PowerFAIDS. The error was isolated to the population of students enrolled less-than-half-time at the College. The College determined that they did not properly adjust the COA for the year. Subsequent to initial testing, the College adjusted and re-calculated the COA and EFC for all less-than-half-time students during the audit fieldwork. From the population of less-than-half-time students who received a Pell Grant during fiscal year 2023, a total of 34 students were awarded a higher amount of Pell than they were eligible to receive. Cause. This condition was caused by insufficient review of the COA and EFC data being used by the College in determining the Pell Grant amount for students. Effect. As a result of this condition, the College was exposed to an increased risk that incorrect information would be used to determine students' Pell Grant award amounts. Questioned Costs. No costs are required to be questioned as the amounts did not exceed the reporting threshold. Recommendation. We recommend the College implement procedures to ensure the COA and EFC used to calculate each student's Pell Grant is updated for each academic year and reviewed by an independent official. View of Responsible Officials. Management concurs with this finding and has prepared a Corrective Action Plan.
2023-001 – Pell Grant Calculation. Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Eligibility). Programs. Student Financial Assistance Cluster; U.S. Department of Education; Numbers 84.007, 84.033, 84.063, and 84.268; Award Numbers P007A222103, P033A222103, P063P225088, and P268K225088. Criteria. The Uniform Guidance states that the College must determine the maximum scheduled award a student would receive based on their Expected Family Contribution (EFC) and Cost of Attendance (COA) using the payment schedule provided by the U.S. Department of Education. Students must be awarded on the basis of a COA comprised of allowable costs assessed to all students carrying the same academic workload. COA must be prorated for students who are attending less than an academic year, or who are less than full-time in a term-based program. Condition. Three students out of the 40 tested had an incorrect COA and/or EFC recorded in PowerFAIDS. The error was isolated to the population of students enrolled less-than-half-time at the College. The College determined that they did not properly adjust the COA for the year. Subsequent to initial testing, the College adjusted and re-calculated the COA and EFC for all less-than-half-time students during the audit fieldwork. From the population of less-than-half-time students who received a Pell Grant during fiscal year 2023, a total of 34 students were awarded a higher amount of Pell than they were eligible to receive. Cause. This condition was caused by insufficient review of the COA and EFC data being used by the College in determining the Pell Grant amount for students. Effect. As a result of this condition, the College was exposed to an increased risk that incorrect information would be used to determine students' Pell Grant award amounts. Questioned Costs. No costs are required to be questioned as the amounts did not exceed the reporting threshold. Recommendation. We recommend the College implement procedures to ensure the COA and EFC used to calculate each student's Pell Grant is updated for each academic year and reviewed by an independent official. View of Responsible Officials. Management concurs with this finding and has prepared a Corrective Action Plan.
2023-001 – Pell Grant Calculation. Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Eligibility). Programs. Student Financial Assistance Cluster; U.S. Department of Education; Numbers 84.007, 84.033, 84.063, and 84.268; Award Numbers P007A222103, P033A222103, P063P225088, and P268K225088. Criteria. The Uniform Guidance states that the College must determine the maximum scheduled award a student would receive based on their Expected Family Contribution (EFC) and Cost of Attendance (COA) using the payment schedule provided by the U.S. Department of Education. Students must be awarded on the basis of a COA comprised of allowable costs assessed to all students carrying the same academic workload. COA must be prorated for students who are attending less than an academic year, or who are less than full-time in a term-based program. Condition. Three students out of the 40 tested had an incorrect COA and/or EFC recorded in PowerFAIDS. The error was isolated to the population of students enrolled less-than-half-time at the College. The College determined that they did not properly adjust the COA for the year. Subsequent to initial testing, the College adjusted and re-calculated the COA and EFC for all less-than-half-time students during the audit fieldwork. From the population of less-than-half-time students who received a Pell Grant during fiscal year 2023, a total of 34 students were awarded a higher amount of Pell than they were eligible to receive. Cause. This condition was caused by insufficient review of the COA and EFC data being used by the College in determining the Pell Grant amount for students. Effect. As a result of this condition, the College was exposed to an increased risk that incorrect information would be used to determine students' Pell Grant award amounts. Questioned Costs. No costs are required to be questioned as the amounts did not exceed the reporting threshold. Recommendation. We recommend the College implement procedures to ensure the COA and EFC used to calculate each student's Pell Grant is updated for each academic year and reviewed by an independent official. View of Responsible Officials. Management concurs with this finding and has prepared a Corrective Action Plan.
2023-002 - Gramm Leach Bliley Missing Compliance Requirements. Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Special Tests & Provisions). Programs. Student Financial Assistance Cluster; U.S. Department of Education; Numbers 84.007, 84.033, 84.063, and 84.268; Award Numbers P007A222103, P033A222103, P063P225088, and P268K225088. Criteria. The Federal Trade Commission (FTC) states that the Gramm Leach Bliley Act "requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data." Condition. The most recent written security policy fails to address how the College will oversee its information system service providers and the evaluation and adjustment of its information security program for any changes in the College's operations or the results of risk assessments. Additionally, the College's policy does not include performing annual penetration tests or biannual vulnerability assessments, as required by the Gramm Leach Bliley Act. Cause. The College does not have a review process in place to ensure all safeguard policies set forth in the Gramm Leach Bliley Act are met in the written security policy. Effect. As a result of this condition, the College isn't meeting the safeguard requirements necessary to comply with the FTC. In addition, the lack of safeguard controls creates an increased risk to highly sensitive data that is possessed by the College. Questioned Costs. No costs were required to be questioned as a result of this finding inasmuch as our testing did not reveal any unallowed costs. Recommendation. We recommend that the College implement procedures to ensure that all Gramm Leach Bliley policies are met and confirmed by a second individual. View of Responsible Officials. Management agrees with this finding and has prepared a Corrective Action Plan.
2023-002 - Gramm Leach Bliley Missing Compliance Requirements. Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Special Tests & Provisions). Programs. Student Financial Assistance Cluster; U.S. Department of Education; Numbers 84.007, 84.033, 84.063, and 84.268; Award Numbers P007A222103, P033A222103, P063P225088, and P268K225088. Criteria. The Federal Trade Commission (FTC) states that the Gramm Leach Bliley Act "requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data." Condition. The most recent written security policy fails to address how the College will oversee its information system service providers and the evaluation and adjustment of its information security program for any changes in the College's operations or the results of risk assessments. Additionally, the College's policy does not include performing annual penetration tests or biannual vulnerability assessments, as required by the Gramm Leach Bliley Act. Cause. The College does not have a review process in place to ensure all safeguard policies set forth in the Gramm Leach Bliley Act are met in the written security policy. Effect. As a result of this condition, the College isn't meeting the safeguard requirements necessary to comply with the FTC. In addition, the lack of safeguard controls creates an increased risk to highly sensitive data that is possessed by the College. Questioned Costs. No costs were required to be questioned as a result of this finding inasmuch as our testing did not reveal any unallowed costs. Recommendation. We recommend that the College implement procedures to ensure that all Gramm Leach Bliley policies are met and confirmed by a second individual. View of Responsible Officials. Management agrees with this finding and has prepared a Corrective Action Plan.
2023-002 - Gramm Leach Bliley Missing Compliance Requirements. Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Special Tests & Provisions). Programs. Student Financial Assistance Cluster; U.S. Department of Education; Numbers 84.007, 84.033, 84.063, and 84.268; Award Numbers P007A222103, P033A222103, P063P225088, and P268K225088. Criteria. The Federal Trade Commission (FTC) states that the Gramm Leach Bliley Act "requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data." Condition. The most recent written security policy fails to address how the College will oversee its information system service providers and the evaluation and adjustment of its information security program for any changes in the College's operations or the results of risk assessments. Additionally, the College's policy does not include performing annual penetration tests or biannual vulnerability assessments, as required by the Gramm Leach Bliley Act. Cause. The College does not have a review process in place to ensure all safeguard policies set forth in the Gramm Leach Bliley Act are met in the written security policy. Effect. As a result of this condition, the College isn't meeting the safeguard requirements necessary to comply with the FTC. In addition, the lack of safeguard controls creates an increased risk to highly sensitive data that is possessed by the College. Questioned Costs. No costs were required to be questioned as a result of this finding inasmuch as our testing did not reveal any unallowed costs. Recommendation. We recommend that the College implement procedures to ensure that all Gramm Leach Bliley policies are met and confirmed by a second individual. View of Responsible Officials. Management agrees with this finding and has prepared a Corrective Action Plan.
2023-002 - Gramm Leach Bliley Missing Compliance Requirements. Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Special Tests & Provisions). Programs. Student Financial Assistance Cluster; U.S. Department of Education; Numbers 84.007, 84.033, 84.063, and 84.268; Award Numbers P007A222103, P033A222103, P063P225088, and P268K225088. Criteria. The Federal Trade Commission (FTC) states that the Gramm Leach Bliley Act "requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data." Condition. The most recent written security policy fails to address how the College will oversee its information system service providers and the evaluation and adjustment of its information security program for any changes in the College's operations or the results of risk assessments. Additionally, the College's policy does not include performing annual penetration tests or biannual vulnerability assessments, as required by the Gramm Leach Bliley Act. Cause. The College does not have a review process in place to ensure all safeguard policies set forth in the Gramm Leach Bliley Act are met in the written security policy. Effect. As a result of this condition, the College isn't meeting the safeguard requirements necessary to comply with the FTC. In addition, the lack of safeguard controls creates an increased risk to highly sensitive data that is possessed by the College. Questioned Costs. No costs were required to be questioned as a result of this finding inasmuch as our testing did not reveal any unallowed costs. Recommendation. We recommend that the College implement procedures to ensure that all Gramm Leach Bliley policies are met and confirmed by a second individual. View of Responsible Officials. Management agrees with this finding and has prepared a Corrective Action Plan.
2023-001 – Pell Grant Calculation. Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Eligibility). Programs. Student Financial Assistance Cluster; U.S. Department of Education; Numbers 84.007, 84.033, 84.063, and 84.268; Award Numbers P007A222103, P033A222103, P063P225088, and P268K225088. Criteria. The Uniform Guidance states that the College must determine the maximum scheduled award a student would receive based on their Expected Family Contribution (EFC) and Cost of Attendance (COA) using the payment schedule provided by the U.S. Department of Education. Students must be awarded on the basis of a COA comprised of allowable costs assessed to all students carrying the same academic workload. COA must be prorated for students who are attending less than an academic year, or who are less than full-time in a term-based program. Condition. Three students out of the 40 tested had an incorrect COA and/or EFC recorded in PowerFAIDS. The error was isolated to the population of students enrolled less-than-half-time at the College. The College determined that they did not properly adjust the COA for the year. Subsequent to initial testing, the College adjusted and re-calculated the COA and EFC for all less-than-half-time students during the audit fieldwork. From the population of less-than-half-time students who received a Pell Grant during fiscal year 2023, a total of 34 students were awarded a higher amount of Pell than they were eligible to receive. Cause. This condition was caused by insufficient review of the COA and EFC data being used by the College in determining the Pell Grant amount for students. Effect. As a result of this condition, the College was exposed to an increased risk that incorrect information would be used to determine students' Pell Grant award amounts. Questioned Costs. No costs are required to be questioned as the amounts did not exceed the reporting threshold. Recommendation. We recommend the College implement procedures to ensure the COA and EFC used to calculate each student's Pell Grant is updated for each academic year and reviewed by an independent official. View of Responsible Officials. Management concurs with this finding and has prepared a Corrective Action Plan.
2023-001 – Pell Grant Calculation. Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Eligibility). Programs. Student Financial Assistance Cluster; U.S. Department of Education; Numbers 84.007, 84.033, 84.063, and 84.268; Award Numbers P007A222103, P033A222103, P063P225088, and P268K225088. Criteria. The Uniform Guidance states that the College must determine the maximum scheduled award a student would receive based on their Expected Family Contribution (EFC) and Cost of Attendance (COA) using the payment schedule provided by the U.S. Department of Education. Students must be awarded on the basis of a COA comprised of allowable costs assessed to all students carrying the same academic workload. COA must be prorated for students who are attending less than an academic year, or who are less than full-time in a term-based program. Condition. Three students out of the 40 tested had an incorrect COA and/or EFC recorded in PowerFAIDS. The error was isolated to the population of students enrolled less-than-half-time at the College. The College determined that they did not properly adjust the COA for the year. Subsequent to initial testing, the College adjusted and re-calculated the COA and EFC for all less-than-half-time students during the audit fieldwork. From the population of less-than-half-time students who received a Pell Grant during fiscal year 2023, a total of 34 students were awarded a higher amount of Pell than they were eligible to receive. Cause. This condition was caused by insufficient review of the COA and EFC data being used by the College in determining the Pell Grant amount for students. Effect. As a result of this condition, the College was exposed to an increased risk that incorrect information would be used to determine students' Pell Grant award amounts. Questioned Costs. No costs are required to be questioned as the amounts did not exceed the reporting threshold. Recommendation. We recommend the College implement procedures to ensure the COA and EFC used to calculate each student's Pell Grant is updated for each academic year and reviewed by an independent official. View of Responsible Officials. Management concurs with this finding and has prepared a Corrective Action Plan.
2023-001 – Pell Grant Calculation. Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Eligibility). Programs. Student Financial Assistance Cluster; U.S. Department of Education; Numbers 84.007, 84.033, 84.063, and 84.268; Award Numbers P007A222103, P033A222103, P063P225088, and P268K225088. Criteria. The Uniform Guidance states that the College must determine the maximum scheduled award a student would receive based on their Expected Family Contribution (EFC) and Cost of Attendance (COA) using the payment schedule provided by the U.S. Department of Education. Students must be awarded on the basis of a COA comprised of allowable costs assessed to all students carrying the same academic workload. COA must be prorated for students who are attending less than an academic year, or who are less than full-time in a term-based program. Condition. Three students out of the 40 tested had an incorrect COA and/or EFC recorded in PowerFAIDS. The error was isolated to the population of students enrolled less-than-half-time at the College. The College determined that they did not properly adjust the COA for the year. Subsequent to initial testing, the College adjusted and re-calculated the COA and EFC for all less-than-half-time students during the audit fieldwork. From the population of less-than-half-time students who received a Pell Grant during fiscal year 2023, a total of 34 students were awarded a higher amount of Pell than they were eligible to receive. Cause. This condition was caused by insufficient review of the COA and EFC data being used by the College in determining the Pell Grant amount for students. Effect. As a result of this condition, the College was exposed to an increased risk that incorrect information would be used to determine students' Pell Grant award amounts. Questioned Costs. No costs are required to be questioned as the amounts did not exceed the reporting threshold. Recommendation. We recommend the College implement procedures to ensure the COA and EFC used to calculate each student's Pell Grant is updated for each academic year and reviewed by an independent official. View of Responsible Officials. Management concurs with this finding and has prepared a Corrective Action Plan.
2023-001 – Pell Grant Calculation. Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Eligibility). Programs. Student Financial Assistance Cluster; U.S. Department of Education; Numbers 84.007, 84.033, 84.063, and 84.268; Award Numbers P007A222103, P033A222103, P063P225088, and P268K225088. Criteria. The Uniform Guidance states that the College must determine the maximum scheduled award a student would receive based on their Expected Family Contribution (EFC) and Cost of Attendance (COA) using the payment schedule provided by the U.S. Department of Education. Students must be awarded on the basis of a COA comprised of allowable costs assessed to all students carrying the same academic workload. COA must be prorated for students who are attending less than an academic year, or who are less than full-time in a term-based program. Condition. Three students out of the 40 tested had an incorrect COA and/or EFC recorded in PowerFAIDS. The error was isolated to the population of students enrolled less-than-half-time at the College. The College determined that they did not properly adjust the COA for the year. Subsequent to initial testing, the College adjusted and re-calculated the COA and EFC for all less-than-half-time students during the audit fieldwork. From the population of less-than-half-time students who received a Pell Grant during fiscal year 2023, a total of 34 students were awarded a higher amount of Pell than they were eligible to receive. Cause. This condition was caused by insufficient review of the COA and EFC data being used by the College in determining the Pell Grant amount for students. Effect. As a result of this condition, the College was exposed to an increased risk that incorrect information would be used to determine students' Pell Grant award amounts. Questioned Costs. No costs are required to be questioned as the amounts did not exceed the reporting threshold. Recommendation. We recommend the College implement procedures to ensure the COA and EFC used to calculate each student's Pell Grant is updated for each academic year and reviewed by an independent official. View of Responsible Officials. Management concurs with this finding and has prepared a Corrective Action Plan.
2023-002 - Gramm Leach Bliley Missing Compliance Requirements. Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Special Tests & Provisions). Programs. Student Financial Assistance Cluster; U.S. Department of Education; Numbers 84.007, 84.033, 84.063, and 84.268; Award Numbers P007A222103, P033A222103, P063P225088, and P268K225088. Criteria. The Federal Trade Commission (FTC) states that the Gramm Leach Bliley Act "requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data." Condition. The most recent written security policy fails to address how the College will oversee its information system service providers and the evaluation and adjustment of its information security program for any changes in the College's operations or the results of risk assessments. Additionally, the College's policy does not include performing annual penetration tests or biannual vulnerability assessments, as required by the Gramm Leach Bliley Act. Cause. The College does not have a review process in place to ensure all safeguard policies set forth in the Gramm Leach Bliley Act are met in the written security policy. Effect. As a result of this condition, the College isn't meeting the safeguard requirements necessary to comply with the FTC. In addition, the lack of safeguard controls creates an increased risk to highly sensitive data that is possessed by the College. Questioned Costs. No costs were required to be questioned as a result of this finding inasmuch as our testing did not reveal any unallowed costs. Recommendation. We recommend that the College implement procedures to ensure that all Gramm Leach Bliley policies are met and confirmed by a second individual. View of Responsible Officials. Management agrees with this finding and has prepared a Corrective Action Plan.
2023-002 - Gramm Leach Bliley Missing Compliance Requirements. Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Special Tests & Provisions). Programs. Student Financial Assistance Cluster; U.S. Department of Education; Numbers 84.007, 84.033, 84.063, and 84.268; Award Numbers P007A222103, P033A222103, P063P225088, and P268K225088. Criteria. The Federal Trade Commission (FTC) states that the Gramm Leach Bliley Act "requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data." Condition. The most recent written security policy fails to address how the College will oversee its information system service providers and the evaluation and adjustment of its information security program for any changes in the College's operations or the results of risk assessments. Additionally, the College's policy does not include performing annual penetration tests or biannual vulnerability assessments, as required by the Gramm Leach Bliley Act. Cause. The College does not have a review process in place to ensure all safeguard policies set forth in the Gramm Leach Bliley Act are met in the written security policy. Effect. As a result of this condition, the College isn't meeting the safeguard requirements necessary to comply with the FTC. In addition, the lack of safeguard controls creates an increased risk to highly sensitive data that is possessed by the College. Questioned Costs. No costs were required to be questioned as a result of this finding inasmuch as our testing did not reveal any unallowed costs. Recommendation. We recommend that the College implement procedures to ensure that all Gramm Leach Bliley policies are met and confirmed by a second individual. View of Responsible Officials. Management agrees with this finding and has prepared a Corrective Action Plan.
2023-002 - Gramm Leach Bliley Missing Compliance Requirements. Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Special Tests & Provisions). Programs. Student Financial Assistance Cluster; U.S. Department of Education; Numbers 84.007, 84.033, 84.063, and 84.268; Award Numbers P007A222103, P033A222103, P063P225088, and P268K225088. Criteria. The Federal Trade Commission (FTC) states that the Gramm Leach Bliley Act "requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data." Condition. The most recent written security policy fails to address how the College will oversee its information system service providers and the evaluation and adjustment of its information security program for any changes in the College's operations or the results of risk assessments. Additionally, the College's policy does not include performing annual penetration tests or biannual vulnerability assessments, as required by the Gramm Leach Bliley Act. Cause. The College does not have a review process in place to ensure all safeguard policies set forth in the Gramm Leach Bliley Act are met in the written security policy. Effect. As a result of this condition, the College isn't meeting the safeguard requirements necessary to comply with the FTC. In addition, the lack of safeguard controls creates an increased risk to highly sensitive data that is possessed by the College. Questioned Costs. No costs were required to be questioned as a result of this finding inasmuch as our testing did not reveal any unallowed costs. Recommendation. We recommend that the College implement procedures to ensure that all Gramm Leach Bliley policies are met and confirmed by a second individual. View of Responsible Officials. Management agrees with this finding and has prepared a Corrective Action Plan.
2023-002 - Gramm Leach Bliley Missing Compliance Requirements. Finding Type. Immaterial Noncompliance/Significant Deficiency in Internal Control over Compliance (Special Tests & Provisions). Programs. Student Financial Assistance Cluster; U.S. Department of Education; Numbers 84.007, 84.033, 84.063, and 84.268; Award Numbers P007A222103, P033A222103, P063P225088, and P268K225088. Criteria. The Federal Trade Commission (FTC) states that the Gramm Leach Bliley Act "requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data." Condition. The most recent written security policy fails to address how the College will oversee its information system service providers and the evaluation and adjustment of its information security program for any changes in the College's operations or the results of risk assessments. Additionally, the College's policy does not include performing annual penetration tests or biannual vulnerability assessments, as required by the Gramm Leach Bliley Act. Cause. The College does not have a review process in place to ensure all safeguard policies set forth in the Gramm Leach Bliley Act are met in the written security policy. Effect. As a result of this condition, the College isn't meeting the safeguard requirements necessary to comply with the FTC. In addition, the lack of safeguard controls creates an increased risk to highly sensitive data that is possessed by the College. Questioned Costs. No costs were required to be questioned as a result of this finding inasmuch as our testing did not reveal any unallowed costs. Recommendation. We recommend that the College implement procedures to ensure that all Gramm Leach Bliley policies are met and confirmed by a second individual. View of Responsible Officials. Management agrees with this finding and has prepared a Corrective Action Plan.