Audit 25226

2022 ? 002: GLBA Risk Assessment Requirements Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: The institution is required to perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other system failures. In addition, each institution has to document a safeguard for each risk identified from the criteria noted. Condition: As of June 30, 2022, the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. This was noted from our review of the information technology policies and procedures. Cause: The University is working with an outside service provider to formally document the risk assessment and required safeguards to ensure compliance with the stated criteria. That process had not been completed as of June 30, 2022. Effect: The University was not in compliance with the statement criteria as of June 30, 2022. Repeat Finding: No Recommendation: We recommend that the University continue to work with the outside service provider to ensure compliance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 003: Late Submission of the FISAP Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.038 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: Federal regulations state that if you spent Campus-Based program funds or have a Perkins Loan Fund, you must submit a Fiscal Operations Report. The regulatory and statutory citations are as follows: (Perkins Loan (34 CFR 674.19), FWS (34 CFR 675.19), and FSEOG (34 CFR 676.19). The submission of the FISAP is required to be filed by September 30th, 2022. Condition: The University Chief Executive Officer did not sign the filed Fiscal Operations Report and Application to Participate (FISAP) until October 7th, 2022, which is after the deadline date in the stated criteria. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not filed the FISAP by the required due date in the stated criteria. Cause: The University?s internal controls failed to detect that the FISAP was not filed by the due date in the stated criteria. Effect: The University was not in compliance with the requirement to file the FISAP by the due date in the stated criteria. Repeat Finding: No Recommendation: We recommend the University review its policies and procedures for the filing of the FISAP to ensure that there is sufficient time in the process to meet the due date in accordance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 008: Verification Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: An institution is required to establish written policies and procedures that incorporate the provisions of 34 CFR 668.51 through 668.61 for verifying applicant information for those applicants selected for verification by ED. The institution shall require each applicant whose application is selected by ED to verify the information required for the Verification Tracking Group to which the applicant is assigned. However, certain applicants are excluded from the verification process as listed in 34 CFR 668.54(b). A menu of potential verification items for each award year is published in the Federal Register, and the items to verify for a given application are selected by ED from that menu and indicated on the student?s output documents. Verification tracking groups and verification items for each award year can also be found in the annual FSA Handbook, Application and Verification Guide, Chapter 4. The institution shall also require applicants to verify any information used to calculate an applicant?s EFC that the institution has reason to believe is inaccurate and provide an accurate code for the individual?s verification status in the Common Origination and Disbursement (COD) system. (34 CFR 668.54(a); FSA Handbook Application and Verification Guide, Chapter 4). Condition: The University has not maintained the required support for verification of a V4 code for a student where verification was requested by the U.S. Department of Education. Questioned costs: There are no questioned costs. Context: We noted seven (7) out of forty (45) students selected for eligibility testing, specific for verification, where the required identity and educational purpose and government issued photo identification was not maintained. Cause: The University?s internal controls failed to detect the missing verification information as required in the stated criteria. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to the maintenance of the required verification support. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 002: GLBA Risk Assessment Requirements Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: The institution is required to perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other system failures. In addition, each institution has to document a safeguard for each risk identified from the criteria noted. Condition: As of June 30, 2022, the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. This was noted from our review of the information technology policies and procedures. Cause: The University is working with an outside service provider to formally document the risk assessment and required safeguards to ensure compliance with the stated criteria. That process had not been completed as of June 30, 2022. Effect: The University was not in compliance with the statement criteria as of June 30, 2022. Repeat Finding: No Recommendation: We recommend that the University continue to work with the outside service provider to ensure compliance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 003: Late Submission of the FISAP Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.038 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: Federal regulations state that if you spent Campus-Based program funds or have a Perkins Loan Fund, you must submit a Fiscal Operations Report. The regulatory and statutory citations are as follows: (Perkins Loan (34 CFR 674.19), FWS (34 CFR 675.19), and FSEOG (34 CFR 676.19). The submission of the FISAP is required to be filed by September 30th, 2022. Condition: The University Chief Executive Officer did not sign the filed Fiscal Operations Report and Application to Participate (FISAP) until October 7th, 2022, which is after the deadline date in the stated criteria. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not filed the FISAP by the required due date in the stated criteria. Cause: The University?s internal controls failed to detect that the FISAP was not filed by the due date in the stated criteria. Effect: The University was not in compliance with the requirement to file the FISAP by the due date in the stated criteria. Repeat Finding: No Recommendation: We recommend the University review its policies and procedures for the filing of the FISAP to ensure that there is sufficient time in the process to meet the due date in accordance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 008: Verification Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: An institution is required to establish written policies and procedures that incorporate the provisions of 34 CFR 668.51 through 668.61 for verifying applicant information for those applicants selected for verification by ED. The institution shall require each applicant whose application is selected by ED to verify the information required for the Verification Tracking Group to which the applicant is assigned. However, certain applicants are excluded from the verification process as listed in 34 CFR 668.54(b). A menu of potential verification items for each award year is published in the Federal Register, and the items to verify for a given application are selected by ED from that menu and indicated on the student?s output documents. Verification tracking groups and verification items for each award year can also be found in the annual FSA Handbook, Application and Verification Guide, Chapter 4. The institution shall also require applicants to verify any information used to calculate an applicant?s EFC that the institution has reason to believe is inaccurate and provide an accurate code for the individual?s verification status in the Common Origination and Disbursement (COD) system. (34 CFR 668.54(a); FSA Handbook Application and Verification Guide, Chapter 4). Condition: The University has not maintained the required support for verification of a V4 code for a student where verification was requested by the U.S. Department of Education. Questioned costs: There are no questioned costs. Context: We noted seven (7) out of forty (45) students selected for eligibility testing, specific for verification, where the required identity and educational purpose and government issued photo identification was not maintained. Cause: The University?s internal controls failed to detect the missing verification information as required in the stated criteria. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to the maintenance of the required verification support. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 003: Late Submission of the FISAP Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.038 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: Federal regulations state that if you spent Campus-Based program funds or have a Perkins Loan Fund, you must submit a Fiscal Operations Report. The regulatory and statutory citations are as follows: (Perkins Loan (34 CFR 674.19), FWS (34 CFR 675.19), and FSEOG (34 CFR 676.19). The submission of the FISAP is required to be filed by September 30th, 2022. Condition: The University Chief Executive Officer did not sign the filed Fiscal Operations Report and Application to Participate (FISAP) until October 7th, 2022, which is after the deadline date in the stated criteria. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not filed the FISAP by the required due date in the stated criteria. Cause: The University?s internal controls failed to detect that the FISAP was not filed by the due date in the stated criteria. Effect: The University was not in compliance with the requirement to file the FISAP by the due date in the stated criteria. Repeat Finding: No Recommendation: We recommend the University review its policies and procedures for the filing of the FISAP to ensure that there is sufficient time in the process to meet the due date in accordance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 002: GLBA Risk Assessment Requirements Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: The institution is required to perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other system failures. In addition, each institution has to document a safeguard for each risk identified from the criteria noted. Condition: As of June 30, 2022, the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. This was noted from our review of the information technology policies and procedures. Cause: The University is working with an outside service provider to formally document the risk assessment and required safeguards to ensure compliance with the stated criteria. That process had not been completed as of June 30, 2022. Effect: The University was not in compliance with the statement criteria as of June 30, 2022. Repeat Finding: No Recommendation: We recommend that the University continue to work with the outside service provider to ensure compliance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 008: Verification Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: An institution is required to establish written policies and procedures that incorporate the provisions of 34 CFR 668.51 through 668.61 for verifying applicant information for those applicants selected for verification by ED. The institution shall require each applicant whose application is selected by ED to verify the information required for the Verification Tracking Group to which the applicant is assigned. However, certain applicants are excluded from the verification process as listed in 34 CFR 668.54(b). A menu of potential verification items for each award year is published in the Federal Register, and the items to verify for a given application are selected by ED from that menu and indicated on the student?s output documents. Verification tracking groups and verification items for each award year can also be found in the annual FSA Handbook, Application and Verification Guide, Chapter 4. The institution shall also require applicants to verify any information used to calculate an applicant?s EFC that the institution has reason to believe is inaccurate and provide an accurate code for the individual?s verification status in the Common Origination and Disbursement (COD) system. (34 CFR 668.54(a); FSA Handbook Application and Verification Guide, Chapter 4). Condition: The University has not maintained the required support for verification of a V4 code for a student where verification was requested by the U.S. Department of Education. Questioned costs: There are no questioned costs. Context: We noted seven (7) out of forty (45) students selected for eligibility testing, specific for verification, where the required identity and educational purpose and government issued photo identification was not maintained. Cause: The University?s internal controls failed to detect the missing verification information as required in the stated criteria. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to the maintenance of the required verification support. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 010: NSLDS Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number and Year: P063P212439-2022, P268K222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Material Weakness in Internal Control over Compliance ? Material Noncompliance (Modified Opinion) Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct and FFEL loan programs via the NSLDS (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the SFA Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. The data on the institution?s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, ?Campus Level? and ?Program Level,? both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Condition: The University failed to reconcile the enrollment effective date per the institution records and the enrollment effective date per NSLDS. Questioned costs: There are no questioned costs. Context: We noted ten (10) out of forty (40) students selected for testing, where the enrollment effective date per the institution records and the enrollment effective date per NSLDS do not agree. We noted two (2) of forty (40) students where the institutional enrollment effective date does not align to the NSLDS enrollment effective date. We noted eight (8) of forty (40) students where NSLDS was not updated timely for the change of status as identified by institution. We noted one (1) of forty (40) students where no determination date was documented. We noted one (1) of forty (40) students where the program begin date per NSLDS did not agree to the institutional records. Cause: The University?s internal controls failed to detect that the data reported and posted to NSLDS that do not agree to the University?s records. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to reviewing the information posted to NSLDS to ensure the accuracy of the data. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 011: Common Origination and Disbursement Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number and Year: P063P212439-2022, P268K222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Material Weakness in Internal Control over Compliance ? Material Noncompliance (Modified Opinion) Criteria or specific requirement: Institutions submit Direct Loan, Pell Grant, TEACH Grant, and IASG origination records and disbursement records to the Common Origination and Disbursement (COD) system. Origination records can be sent well in advance of any disbursements, as early as the institution chooses to submit them for any student the institution reasonably believes will be eligible for a payment. An institution follows up with a disbursement record for that student no earlier than (1) seven calendar days prior to the disbursement date under the Advance or Heightened Cash Monitoring 1 payment methods, or (2) the date of the disbursement under the Reimbursement or Heightened Cash Monitoring 2 Payment Method (see Federal Register, Volume 85, Number 134, July 14, 2020). The disbursement record reports the actual disbursement date and the amount of the disbursement. ED processes origination and/or disbursement records and returns acknowledgments to the institution. The acknowledgments identify the processing status of each record: Rejected, Accepted with Corrections, or Accepted. In testing the origination and disbursement data, the auditor should be most concerned with the data ED has categorized as accepted or accepted with corrections. Institutions must report student disbursement data within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data. Institutions may do this by reporting once every 15 calendar days, bi-weekly or weekly, or may set up their own system to ensure that changes are reported in a timely manner. Condition: The University failed to comply with the reporting requirements of Common Origination and Disbursement (COD) in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: We noted eight (8) out of forty (40) students selected for testing, where there were discrepancies between the institutional records and the information included in COD. We noted four (4) exceptions where the disbursement date per the student account and the applied date at ED Per COD was greater than 15 days. We noted three (3) exceptions where the disbursement date per the student account did not agree to the disbursement date per COD. We noted one (1) exception where the amount per COD did not agree to the amount per the student account. Cause: The University?s internal controls failed to detect that the date being submitted to COD did not comply with the stated criteria. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to reviewing the information submitted to COD to ensure compliance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 002: GLBA Risk Assessment Requirements Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: The institution is required to perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other system failures. In addition, each institution has to document a safeguard for each risk identified from the criteria noted. Condition: As of June 30, 2022, the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. This was noted from our review of the information technology policies and procedures. Cause: The University is working with an outside service provider to formally document the risk assessment and required safeguards to ensure compliance with the stated criteria. That process had not been completed as of June 30, 2022. Effect: The University was not in compliance with the statement criteria as of June 30, 2022. Repeat Finding: No Recommendation: We recommend that the University continue to work with the outside service provider to ensure compliance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 005: Over Awarding of Need Based Aid Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.268 Federal Award Identification Number and Year: P268K222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: In determining loan amounts for Direct Subsidized Loans, the financial aid administrator subtracts from the COA, the EFC, and the estimated financial assistance for the period of enrollment that the student (or parent on behalf of the student) will receive from federal, state, institutional or other sources. Condition: The University provided Direct Subsidized loans in excess of the allowable amount to students who had scholarships from eligible local sources that should have reduced the amount awarded. Questioned costs: The finding resulted in known questioned costs of $6,537. Context: We noted two (2) out of forty (40) students selected for testing where the individuals were over awarded Direct Subsidized Loans due to the exclusion of scholarships from local sources as identified in the stated criteria. Cause: The University?s internal controls failed to detect the exclusion of scholarships from local sources in the calculation of the Direct Subsidized Loan amount awarded to eligible students. Effect: The University over awarded students who received Direct Subsidized Loans based on the stated criteria. Repeat Finding: No Recommendation: We recommend the University update its awarding process for Direct Subsidized Loans. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 006: Student Notification of Disbursement Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number:84.268, 84.379 Federal Award Identification Number and Year: P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Material Weakness in Internal Control over Compliance ? Material Noncompliance (Modified Opinion) Criteria or specific requirement: The institution must notify the student, or parent, in writing of (1) the date and amount of the disbursement; (2) the student?s right, or parent?s right, to cancel all or a portion of that loan or loan disbursement and have the loan proceeds returned to the holder of that loan or the TEACH Grant payments returned to ED; and (3)the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan, TEACH Grant, or TEACH Grant disbursement. The notification requirement for loan funds applies only if the funds are disbursed by EFT payment or master check (34 CFR 668.165). Condition: The University did not send required notifications of disbursements to students who received Direct Subsidized Loans and Direct Unsubsidized Loans in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: We noted thirty (30) out of forty (40) students selected for testing where the individual students did not receive the required notifications in accordance with the stated criteria. Cause: The University?s internal controls failed to detect that the notifications had not been sent to the students. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University review its policies and procedures and make updates to them to mitigate the risk that the notifications will not be sent in accordance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 007: Students Not Properly Classified by Grade Level Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.268 Federal Award Identification Number and Year: P268K222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: Direct Subsidized Loans and Direct Unsubsidized Loans have annual loan limits that vary based on the student's grade level and (for Direct Unsubsidized Loans) dependency status (34 CFR 685.203). The annual loan limit is the maximum amount that a student may receive for an academic year. Condition: The University misclassified the students grade level resulting in the maximum annual loan limit being incorrectly applied. Questioned costs: There are no questioned costs. Context: We noted four (4) out of forty (40) students selected for testing where the inappropriate grade level was used to determine the maximum annual loan limit in accordance with the stated criteria. Cause: The University?s internal controls failed to detect the misclassification of students in the appropriate grade level in accordance with the stated criteria. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University review its processes and procedures related to determining the grade level of the student for determining the Subsidized Direct Loans and Unsubsidized Direct Loan amounts. Views of responsible officials: There is no disagreement with the audit finding..

2022 ? 008: Verification Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: An institution is required to establish written policies and procedures that incorporate the provisions of 34 CFR 668.51 through 668.61 for verifying applicant information for those applicants selected for verification by ED. The institution shall require each applicant whose application is selected by ED to verify the information required for the Verification Tracking Group to which the applicant is assigned. However, certain applicants are excluded from the verification process as listed in 34 CFR 668.54(b). A menu of potential verification items for each award year is published in the Federal Register, and the items to verify for a given application are selected by ED from that menu and indicated on the student?s output documents. Verification tracking groups and verification items for each award year can also be found in the annual FSA Handbook, Application and Verification Guide, Chapter 4. The institution shall also require applicants to verify any information used to calculate an applicant?s EFC that the institution has reason to believe is inaccurate and provide an accurate code for the individual?s verification status in the Common Origination and Disbursement (COD) system. (34 CFR 668.54(a); FSA Handbook Application and Verification Guide, Chapter 4). Condition: The University has not maintained the required support for verification of a V4 code for a student where verification was requested by the U.S. Department of Education. Questioned costs: There are no questioned costs. Context: We noted seven (7) out of forty (45) students selected for eligibility testing, specific for verification, where the required identity and educational purpose and government issued photo identification was not maintained. Cause: The University?s internal controls failed to detect the missing verification information as required in the stated criteria. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to the maintenance of the required verification support. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 009: Pell Disbursement Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.268 Federal Award Identification Number and Year: P268K222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: To disburse Pell funds, the institution must have received a valid ISIR from the central processor by the earlier of the student?s last date of enrollment or the deadline date established by the secretary in a notice published in the Federal Register (the deadline date is normally in the month of September following the end of the award year). Late disbursements of Pell for students that are now ineligible (e.g., no longer enrolled) are allowed if, before the date the student became ineligible, an ISIR or SAR was processed that contained an official EFC. The institution has discretion in disbursing funds within a payment period, but generally must disburse the full amount before the end of the payment period. When making a late disbursement or retroactive payment of Pell for a completed period, an institution determines a student?s enrollment status for the completed period based only on the hours completed by the student for that period (34 CFR 690.76(b)). Condition: The University awarded Pell to an eligible student that did not receive the disbursement during the fiscal year. Questioned costs: There are no questioned costs. Context: We noted one (1) out of forty (40) students selected for eligibility testing, where a student was eligible and awarded a Pell award. The University failed to disburse the award during the fiscal year. Cause: The University?s internal controls failed to detect the Pell awarded and not disbursed. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to reviewing Pell awarded and not disbursed. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 010: NSLDS Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number and Year: P063P212439-2022, P268K222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Material Weakness in Internal Control over Compliance ? Material Noncompliance (Modified Opinion) Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct and FFEL loan programs via the NSLDS (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the SFA Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. The data on the institution?s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, ?Campus Level? and ?Program Level,? both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Condition: The University failed to reconcile the enrollment effective date per the institution records and the enrollment effective date per NSLDS. Questioned costs: There are no questioned costs. Context: We noted ten (10) out of forty (40) students selected for testing, where the enrollment effective date per the institution records and the enrollment effective date per NSLDS do not agree. We noted two (2) of forty (40) students where the institutional enrollment effective date does not align to the NSLDS enrollment effective date. We noted eight (8) of forty (40) students where NSLDS was not updated timely for the change of status as identified by institution. We noted one (1) of forty (40) students where no determination date was documented. We noted one (1) of forty (40) students where the program begin date per NSLDS did not agree to the institutional records. Cause: The University?s internal controls failed to detect that the data reported and posted to NSLDS that do not agree to the University?s records. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to reviewing the information posted to NSLDS to ensure the accuracy of the data. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 011: Common Origination and Disbursement Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number and Year: P063P212439-2022, P268K222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Material Weakness in Internal Control over Compliance ? Material Noncompliance (Modified Opinion) Criteria or specific requirement: Institutions submit Direct Loan, Pell Grant, TEACH Grant, and IASG origination records and disbursement records to the Common Origination and Disbursement (COD) system. Origination records can be sent well in advance of any disbursements, as early as the institution chooses to submit them for any student the institution reasonably believes will be eligible for a payment. An institution follows up with a disbursement record for that student no earlier than (1) seven calendar days prior to the disbursement date under the Advance or Heightened Cash Monitoring 1 payment methods, or (2) the date of the disbursement under the Reimbursement or Heightened Cash Monitoring 2 Payment Method (see Federal Register, Volume 85, Number 134, July 14, 2020). The disbursement record reports the actual disbursement date and the amount of the disbursement. ED processes origination and/or disbursement records and returns acknowledgments to the institution. The acknowledgments identify the processing status of each record: Rejected, Accepted with Corrections, or Accepted. In testing the origination and disbursement data, the auditor should be most concerned with the data ED has categorized as accepted or accepted with corrections. Institutions must report student disbursement data within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data. Institutions may do this by reporting once every 15 calendar days, bi-weekly or weekly, or may set up their own system to ensure that changes are reported in a timely manner. Condition: The University failed to comply with the reporting requirements of Common Origination and Disbursement (COD) in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: We noted eight (8) out of forty (40) students selected for testing, where there were discrepancies between the institutional records and the information included in COD. We noted four (4) exceptions where the disbursement date per the student account and the applied date at ED Per COD was greater than 15 days. We noted three (3) exceptions where the disbursement date per the student account did not agree to the disbursement date per COD. We noted one (1) exception where the amount per COD did not agree to the amount per the student account. Cause: The University?s internal controls failed to detect that the date being submitted to COD did not comply with the stated criteria. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to reviewing the information submitted to COD to ensure compliance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 002: GLBA Risk Assessment Requirements Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: The institution is required to perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other system failures. In addition, each institution has to document a safeguard for each risk identified from the criteria noted. Condition: As of June 30, 2022, the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. This was noted from our review of the information technology policies and procedures. Cause: The University is working with an outside service provider to formally document the risk assessment and required safeguards to ensure compliance with the stated criteria. That process had not been completed as of June 30, 2022. Effect: The University was not in compliance with the statement criteria as of June 30, 2022. Repeat Finding: No Recommendation: We recommend that the University continue to work with the outside service provider to ensure compliance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 006: Student Notification of Disbursement Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number:84.268, 84.379 Federal Award Identification Number and Year: P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Material Weakness in Internal Control over Compliance ? Material Noncompliance (Modified Opinion) Criteria or specific requirement: The institution must notify the student, or parent, in writing of (1) the date and amount of the disbursement; (2) the student?s right, or parent?s right, to cancel all or a portion of that loan or loan disbursement and have the loan proceeds returned to the holder of that loan or the TEACH Grant payments returned to ED; and (3)the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan, TEACH Grant, or TEACH Grant disbursement. The notification requirement for loan funds applies only if the funds are disbursed by EFT payment or master check (34 CFR 668.165). Condition: The University did not send required notifications of disbursements to students who received Direct Subsidized Loans and Direct Unsubsidized Loans in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: We noted thirty (30) out of forty (40) students selected for testing where the individual students did not receive the required notifications in accordance with the stated criteria. Cause: The University?s internal controls failed to detect that the notifications had not been sent to the students. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University review its policies and procedures and make updates to them to mitigate the risk that the notifications will not be sent in accordance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 008: Verification Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: An institution is required to establish written policies and procedures that incorporate the provisions of 34 CFR 668.51 through 668.61 for verifying applicant information for those applicants selected for verification by ED. The institution shall require each applicant whose application is selected by ED to verify the information required for the Verification Tracking Group to which the applicant is assigned. However, certain applicants are excluded from the verification process as listed in 34 CFR 668.54(b). A menu of potential verification items for each award year is published in the Federal Register, and the items to verify for a given application are selected by ED from that menu and indicated on the student?s output documents. Verification tracking groups and verification items for each award year can also be found in the annual FSA Handbook, Application and Verification Guide, Chapter 4. The institution shall also require applicants to verify any information used to calculate an applicant?s EFC that the institution has reason to believe is inaccurate and provide an accurate code for the individual?s verification status in the Common Origination and Disbursement (COD) system. (34 CFR 668.54(a); FSA Handbook Application and Verification Guide, Chapter 4). Condition: The University has not maintained the required support for verification of a V4 code for a student where verification was requested by the U.S. Department of Education. Questioned costs: There are no questioned costs. Context: We noted seven (7) out of forty (45) students selected for eligibility testing, specific for verification, where the required identity and educational purpose and government issued photo identification was not maintained. Cause: The University?s internal controls failed to detect the missing verification information as required in the stated criteria. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to the maintenance of the required verification support. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 004: HEERF Reporting Federal Agency: U.S. Department of Education Federal Program Name: (COVID-19) Higher Education Emergency Relief Fund Assistance Listing Number: 84.425F, 84.425M Federal Award Identification Number and Year: P425E204430-2020, P425M201006-20A-2020 Award Period: 84.425F ? May 14, 2020 to June 30, 2023 / 84.425M ? August 5, 2020 to June 30, 2023 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: There are three components to reporting for HEERF: 1) public reporting on the (a)(1) Student Aid Portion; 2) public reporting on the (a)(1) Institutional Portion (a)(2) and (a)(3) subprograms (Quarterly Reporting Form), as applicable; and 3) the annual report. The CARES Act 18004(e) and the CRRSAA 314(e) requires an institution receiving funds under HEERF I and HEERF II to submit a report to the secretary, at such time in such a manner as the secretary may require. While ARP does not explicitly identify procedures by which institutions must report on their uses of HEERF grant funds, ED exercises this reporting authority under 2 CFR section 200.328 and 2 CFR section 200.329. Condition: The University filed the annual report on May 12th, 2022, which was two (2) days later than the requirement to complete by May 10th, 2022. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not filed the annual report, with the appropriate supporting documentation, in accordance with the stated criteria. Cause: The University?s internal controls failed to detect that the annual report was not filed by the due date in the stated criteria. Effect: The University was not in compliance with the requirement to file the annual report by the due date in the stated criteria. Repeat Finding: No Recommendation: We recommend the University review its policies and procedures for the filing of the HEERF to ensure that there is sufficient time in the process to meet the due date in accordance with the stated criteria. The evidence of submission should include the original supporting documentation for the information published. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 004: HEERF Reporting Federal Agency: U.S. Department of Education Federal Program Name: (COVID-19) Higher Education Emergency Relief Fund Assistance Listing Number: 84.425F, 84.425M Federal Award Identification Number and Year: P425E204430-2020, P425M201006-20A-2020 Award Period: 84.425F ? May 14, 2020 to June 30, 2023 / 84.425M ? August 5, 2020 to June 30, 2023 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: There are three components to reporting for HEERF: 1) public reporting on the (a)(1) Student Aid Portion; 2) public reporting on the (a)(1) Institutional Portion (a)(2) and (a)(3) subprograms (Quarterly Reporting Form), as applicable; and 3) the annual report. The CARES Act 18004(e) and the CRRSAA 314(e) requires an institution receiving funds under HEERF I and HEERF II to submit a report to the secretary, at such time in such a manner as the secretary may require. While ARP does not explicitly identify procedures by which institutions must report on their uses of HEERF grant funds, ED exercises this reporting authority under 2 CFR section 200.328 and 2 CFR section 200.329. Condition: The University filed the annual report on May 12th, 2022, which was two (2) days later than the requirement to complete by May 10th, 2022. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not filed the annual report, with the appropriate supporting documentation, in accordance with the stated criteria. Cause: The University?s internal controls failed to detect that the annual report was not filed by the due date in the stated criteria. Effect: The University was not in compliance with the requirement to file the annual report by the due date in the stated criteria. Repeat Finding: No Recommendation: We recommend the University review its policies and procedures for the filing of the HEERF to ensure that there is sufficient time in the process to meet the due date in accordance with the stated criteria. The evidence of submission should include the original supporting documentation for the information published. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 002: GLBA Risk Assessment Requirements Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: The institution is required to perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other system failures. In addition, each institution has to document a safeguard for each risk identified from the criteria noted. Condition: As of June 30, 2022, the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. This was noted from our review of the information technology policies and procedures. Cause: The University is working with an outside service provider to formally document the risk assessment and required safeguards to ensure compliance with the stated criteria. That process had not been completed as of June 30, 2022. Effect: The University was not in compliance with the statement criteria as of June 30, 2022. Repeat Finding: No Recommendation: We recommend that the University continue to work with the outside service provider to ensure compliance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 003: Late Submission of the FISAP Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.038 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: Federal regulations state that if you spent Campus-Based program funds or have a Perkins Loan Fund, you must submit a Fiscal Operations Report. The regulatory and statutory citations are as follows: (Perkins Loan (34 CFR 674.19), FWS (34 CFR 675.19), and FSEOG (34 CFR 676.19). The submission of the FISAP is required to be filed by September 30th, 2022. Condition: The University Chief Executive Officer did not sign the filed Fiscal Operations Report and Application to Participate (FISAP) until October 7th, 2022, which is after the deadline date in the stated criteria. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not filed the FISAP by the required due date in the stated criteria. Cause: The University?s internal controls failed to detect that the FISAP was not filed by the due date in the stated criteria. Effect: The University was not in compliance with the requirement to file the FISAP by the due date in the stated criteria. Repeat Finding: No Recommendation: We recommend the University review its policies and procedures for the filing of the FISAP to ensure that there is sufficient time in the process to meet the due date in accordance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 008: Verification Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: An institution is required to establish written policies and procedures that incorporate the provisions of 34 CFR 668.51 through 668.61 for verifying applicant information for those applicants selected for verification by ED. The institution shall require each applicant whose application is selected by ED to verify the information required for the Verification Tracking Group to which the applicant is assigned. However, certain applicants are excluded from the verification process as listed in 34 CFR 668.54(b). A menu of potential verification items for each award year is published in the Federal Register, and the items to verify for a given application are selected by ED from that menu and indicated on the student?s output documents. Verification tracking groups and verification items for each award year can also be found in the annual FSA Handbook, Application and Verification Guide, Chapter 4. The institution shall also require applicants to verify any information used to calculate an applicant?s EFC that the institution has reason to believe is inaccurate and provide an accurate code for the individual?s verification status in the Common Origination and Disbursement (COD) system. (34 CFR 668.54(a); FSA Handbook Application and Verification Guide, Chapter 4). Condition: The University has not maintained the required support for verification of a V4 code for a student where verification was requested by the U.S. Department of Education. Questioned costs: There are no questioned costs. Context: We noted seven (7) out of forty (45) students selected for eligibility testing, specific for verification, where the required identity and educational purpose and government issued photo identification was not maintained. Cause: The University?s internal controls failed to detect the missing verification information as required in the stated criteria. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to the maintenance of the required verification support. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 002: GLBA Risk Assessment Requirements Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: The institution is required to perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other system failures. In addition, each institution has to document a safeguard for each risk identified from the criteria noted. Condition: As of June 30, 2022, the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. This was noted from our review of the information technology policies and procedures. Cause: The University is working with an outside service provider to formally document the risk assessment and required safeguards to ensure compliance with the stated criteria. That process had not been completed as of June 30, 2022. Effect: The University was not in compliance with the statement criteria as of June 30, 2022. Repeat Finding: No Recommendation: We recommend that the University continue to work with the outside service provider to ensure compliance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 003: Late Submission of the FISAP Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.038 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: Federal regulations state that if you spent Campus-Based program funds or have a Perkins Loan Fund, you must submit a Fiscal Operations Report. The regulatory and statutory citations are as follows: (Perkins Loan (34 CFR 674.19), FWS (34 CFR 675.19), and FSEOG (34 CFR 676.19). The submission of the FISAP is required to be filed by September 30th, 2022. Condition: The University Chief Executive Officer did not sign the filed Fiscal Operations Report and Application to Participate (FISAP) until October 7th, 2022, which is after the deadline date in the stated criteria. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not filed the FISAP by the required due date in the stated criteria. Cause: The University?s internal controls failed to detect that the FISAP was not filed by the due date in the stated criteria. Effect: The University was not in compliance with the requirement to file the FISAP by the due date in the stated criteria. Repeat Finding: No Recommendation: We recommend the University review its policies and procedures for the filing of the FISAP to ensure that there is sufficient time in the process to meet the due date in accordance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 008: Verification Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: An institution is required to establish written policies and procedures that incorporate the provisions of 34 CFR 668.51 through 668.61 for verifying applicant information for those applicants selected for verification by ED. The institution shall require each applicant whose application is selected by ED to verify the information required for the Verification Tracking Group to which the applicant is assigned. However, certain applicants are excluded from the verification process as listed in 34 CFR 668.54(b). A menu of potential verification items for each award year is published in the Federal Register, and the items to verify for a given application are selected by ED from that menu and indicated on the student?s output documents. Verification tracking groups and verification items for each award year can also be found in the annual FSA Handbook, Application and Verification Guide, Chapter 4. The institution shall also require applicants to verify any information used to calculate an applicant?s EFC that the institution has reason to believe is inaccurate and provide an accurate code for the individual?s verification status in the Common Origination and Disbursement (COD) system. (34 CFR 668.54(a); FSA Handbook Application and Verification Guide, Chapter 4). Condition: The University has not maintained the required support for verification of a V4 code for a student where verification was requested by the U.S. Department of Education. Questioned costs: There are no questioned costs. Context: We noted seven (7) out of forty (45) students selected for eligibility testing, specific for verification, where the required identity and educational purpose and government issued photo identification was not maintained. Cause: The University?s internal controls failed to detect the missing verification information as required in the stated criteria. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to the maintenance of the required verification support. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 003: Late Submission of the FISAP Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.038 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: Federal regulations state that if you spent Campus-Based program funds or have a Perkins Loan Fund, you must submit a Fiscal Operations Report. The regulatory and statutory citations are as follows: (Perkins Loan (34 CFR 674.19), FWS (34 CFR 675.19), and FSEOG (34 CFR 676.19). The submission of the FISAP is required to be filed by September 30th, 2022. Condition: The University Chief Executive Officer did not sign the filed Fiscal Operations Report and Application to Participate (FISAP) until October 7th, 2022, which is after the deadline date in the stated criteria. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not filed the FISAP by the required due date in the stated criteria. Cause: The University?s internal controls failed to detect that the FISAP was not filed by the due date in the stated criteria. Effect: The University was not in compliance with the requirement to file the FISAP by the due date in the stated criteria. Repeat Finding: No Recommendation: We recommend the University review its policies and procedures for the filing of the FISAP to ensure that there is sufficient time in the process to meet the due date in accordance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 002: GLBA Risk Assessment Requirements Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: The institution is required to perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other system failures. In addition, each institution has to document a safeguard for each risk identified from the criteria noted. Condition: As of June 30, 2022, the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. This was noted from our review of the information technology policies and procedures. Cause: The University is working with an outside service provider to formally document the risk assessment and required safeguards to ensure compliance with the stated criteria. That process had not been completed as of June 30, 2022. Effect: The University was not in compliance with the statement criteria as of June 30, 2022. Repeat Finding: No Recommendation: We recommend that the University continue to work with the outside service provider to ensure compliance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 008: Verification Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: An institution is required to establish written policies and procedures that incorporate the provisions of 34 CFR 668.51 through 668.61 for verifying applicant information for those applicants selected for verification by ED. The institution shall require each applicant whose application is selected by ED to verify the information required for the Verification Tracking Group to which the applicant is assigned. However, certain applicants are excluded from the verification process as listed in 34 CFR 668.54(b). A menu of potential verification items for each award year is published in the Federal Register, and the items to verify for a given application are selected by ED from that menu and indicated on the student?s output documents. Verification tracking groups and verification items for each award year can also be found in the annual FSA Handbook, Application and Verification Guide, Chapter 4. The institution shall also require applicants to verify any information used to calculate an applicant?s EFC that the institution has reason to believe is inaccurate and provide an accurate code for the individual?s verification status in the Common Origination and Disbursement (COD) system. (34 CFR 668.54(a); FSA Handbook Application and Verification Guide, Chapter 4). Condition: The University has not maintained the required support for verification of a V4 code for a student where verification was requested by the U.S. Department of Education. Questioned costs: There are no questioned costs. Context: We noted seven (7) out of forty (45) students selected for eligibility testing, specific for verification, where the required identity and educational purpose and government issued photo identification was not maintained. Cause: The University?s internal controls failed to detect the missing verification information as required in the stated criteria. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to the maintenance of the required verification support. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 010: NSLDS Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number and Year: P063P212439-2022, P268K222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Material Weakness in Internal Control over Compliance ? Material Noncompliance (Modified Opinion) Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct and FFEL loan programs via the NSLDS (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the SFA Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. The data on the institution?s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, ?Campus Level? and ?Program Level,? both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Condition: The University failed to reconcile the enrollment effective date per the institution records and the enrollment effective date per NSLDS. Questioned costs: There are no questioned costs. Context: We noted ten (10) out of forty (40) students selected for testing, where the enrollment effective date per the institution records and the enrollment effective date per NSLDS do not agree. We noted two (2) of forty (40) students where the institutional enrollment effective date does not align to the NSLDS enrollment effective date. We noted eight (8) of forty (40) students where NSLDS was not updated timely for the change of status as identified by institution. We noted one (1) of forty (40) students where no determination date was documented. We noted one (1) of forty (40) students where the program begin date per NSLDS did not agree to the institutional records. Cause: The University?s internal controls failed to detect that the data reported and posted to NSLDS that do not agree to the University?s records. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to reviewing the information posted to NSLDS to ensure the accuracy of the data. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 011: Common Origination and Disbursement Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number and Year: P063P212439-2022, P268K222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Material Weakness in Internal Control over Compliance ? Material Noncompliance (Modified Opinion) Criteria or specific requirement: Institutions submit Direct Loan, Pell Grant, TEACH Grant, and IASG origination records and disbursement records to the Common Origination and Disbursement (COD) system. Origination records can be sent well in advance of any disbursements, as early as the institution chooses to submit them for any student the institution reasonably believes will be eligible for a payment. An institution follows up with a disbursement record for that student no earlier than (1) seven calendar days prior to the disbursement date under the Advance or Heightened Cash Monitoring 1 payment methods, or (2) the date of the disbursement under the Reimbursement or Heightened Cash Monitoring 2 Payment Method (see Federal Register, Volume 85, Number 134, July 14, 2020). The disbursement record reports the actual disbursement date and the amount of the disbursement. ED processes origination and/or disbursement records and returns acknowledgments to the institution. The acknowledgments identify the processing status of each record: Rejected, Accepted with Corrections, or Accepted. In testing the origination and disbursement data, the auditor should be most concerned with the data ED has categorized as accepted or accepted with corrections. Institutions must report student disbursement data within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data. Institutions may do this by reporting once every 15 calendar days, bi-weekly or weekly, or may set up their own system to ensure that changes are reported in a timely manner. Condition: The University failed to comply with the reporting requirements of Common Origination and Disbursement (COD) in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: We noted eight (8) out of forty (40) students selected for testing, where there were discrepancies between the institutional records and the information included in COD. We noted four (4) exceptions where the disbursement date per the student account and the applied date at ED Per COD was greater than 15 days. We noted three (3) exceptions where the disbursement date per the student account did not agree to the disbursement date per COD. We noted one (1) exception where the amount per COD did not agree to the amount per the student account. Cause: The University?s internal controls failed to detect that the date being submitted to COD did not comply with the stated criteria. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to reviewing the information submitted to COD to ensure compliance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 002: GLBA Risk Assessment Requirements Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: The institution is required to perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other system failures. In addition, each institution has to document a safeguard for each risk identified from the criteria noted. Condition: As of June 30, 2022, the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. This was noted from our review of the information technology policies and procedures. Cause: The University is working with an outside service provider to formally document the risk assessment and required safeguards to ensure compliance with the stated criteria. That process had not been completed as of June 30, 2022. Effect: The University was not in compliance with the statement criteria as of June 30, 2022. Repeat Finding: No Recommendation: We recommend that the University continue to work with the outside service provider to ensure compliance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 005: Over Awarding of Need Based Aid Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.268 Federal Award Identification Number and Year: P268K222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: In determining loan amounts for Direct Subsidized Loans, the financial aid administrator subtracts from the COA, the EFC, and the estimated financial assistance for the period of enrollment that the student (or parent on behalf of the student) will receive from federal, state, institutional or other sources. Condition: The University provided Direct Subsidized loans in excess of the allowable amount to students who had scholarships from eligible local sources that should have reduced the amount awarded. Questioned costs: The finding resulted in known questioned costs of $6,537. Context: We noted two (2) out of forty (40) students selected for testing where the individuals were over awarded Direct Subsidized Loans due to the exclusion of scholarships from local sources as identified in the stated criteria. Cause: The University?s internal controls failed to detect the exclusion of scholarships from local sources in the calculation of the Direct Subsidized Loan amount awarded to eligible students. Effect: The University over awarded students who received Direct Subsidized Loans based on the stated criteria. Repeat Finding: No Recommendation: We recommend the University update its awarding process for Direct Subsidized Loans. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 006: Student Notification of Disbursement Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number:84.268, 84.379 Federal Award Identification Number and Year: P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Material Weakness in Internal Control over Compliance ? Material Noncompliance (Modified Opinion) Criteria or specific requirement: The institution must notify the student, or parent, in writing of (1) the date and amount of the disbursement; (2) the student?s right, or parent?s right, to cancel all or a portion of that loan or loan disbursement and have the loan proceeds returned to the holder of that loan or the TEACH Grant payments returned to ED; and (3)the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan, TEACH Grant, or TEACH Grant disbursement. The notification requirement for loan funds applies only if the funds are disbursed by EFT payment or master check (34 CFR 668.165). Condition: The University did not send required notifications of disbursements to students who received Direct Subsidized Loans and Direct Unsubsidized Loans in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: We noted thirty (30) out of forty (40) students selected for testing where the individual students did not receive the required notifications in accordance with the stated criteria. Cause: The University?s internal controls failed to detect that the notifications had not been sent to the students. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University review its policies and procedures and make updates to them to mitigate the risk that the notifications will not be sent in accordance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 007: Students Not Properly Classified by Grade Level Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.268 Federal Award Identification Number and Year: P268K222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: Direct Subsidized Loans and Direct Unsubsidized Loans have annual loan limits that vary based on the student's grade level and (for Direct Unsubsidized Loans) dependency status (34 CFR 685.203). The annual loan limit is the maximum amount that a student may receive for an academic year. Condition: The University misclassified the students grade level resulting in the maximum annual loan limit being incorrectly applied. Questioned costs: There are no questioned costs. Context: We noted four (4) out of forty (40) students selected for testing where the inappropriate grade level was used to determine the maximum annual loan limit in accordance with the stated criteria. Cause: The University?s internal controls failed to detect the misclassification of students in the appropriate grade level in accordance with the stated criteria. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University review its processes and procedures related to determining the grade level of the student for determining the Subsidized Direct Loans and Unsubsidized Direct Loan amounts. Views of responsible officials: There is no disagreement with the audit finding..

2022 ? 008: Verification Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: An institution is required to establish written policies and procedures that incorporate the provisions of 34 CFR 668.51 through 668.61 for verifying applicant information for those applicants selected for verification by ED. The institution shall require each applicant whose application is selected by ED to verify the information required for the Verification Tracking Group to which the applicant is assigned. However, certain applicants are excluded from the verification process as listed in 34 CFR 668.54(b). A menu of potential verification items for each award year is published in the Federal Register, and the items to verify for a given application are selected by ED from that menu and indicated on the student?s output documents. Verification tracking groups and verification items for each award year can also be found in the annual FSA Handbook, Application and Verification Guide, Chapter 4. The institution shall also require applicants to verify any information used to calculate an applicant?s EFC that the institution has reason to believe is inaccurate and provide an accurate code for the individual?s verification status in the Common Origination and Disbursement (COD) system. (34 CFR 668.54(a); FSA Handbook Application and Verification Guide, Chapter 4). Condition: The University has not maintained the required support for verification of a V4 code for a student where verification was requested by the U.S. Department of Education. Questioned costs: There are no questioned costs. Context: We noted seven (7) out of forty (45) students selected for eligibility testing, specific for verification, where the required identity and educational purpose and government issued photo identification was not maintained. Cause: The University?s internal controls failed to detect the missing verification information as required in the stated criteria. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to the maintenance of the required verification support. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 009: Pell Disbursement Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.268 Federal Award Identification Number and Year: P268K222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: To disburse Pell funds, the institution must have received a valid ISIR from the central processor by the earlier of the student?s last date of enrollment or the deadline date established by the secretary in a notice published in the Federal Register (the deadline date is normally in the month of September following the end of the award year). Late disbursements of Pell for students that are now ineligible (e.g., no longer enrolled) are allowed if, before the date the student became ineligible, an ISIR or SAR was processed that contained an official EFC. The institution has discretion in disbursing funds within a payment period, but generally must disburse the full amount before the end of the payment period. When making a late disbursement or retroactive payment of Pell for a completed period, an institution determines a student?s enrollment status for the completed period based only on the hours completed by the student for that period (34 CFR 690.76(b)). Condition: The University awarded Pell to an eligible student that did not receive the disbursement during the fiscal year. Questioned costs: There are no questioned costs. Context: We noted one (1) out of forty (40) students selected for eligibility testing, where a student was eligible and awarded a Pell award. The University failed to disburse the award during the fiscal year. Cause: The University?s internal controls failed to detect the Pell awarded and not disbursed. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to reviewing Pell awarded and not disbursed. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 010: NSLDS Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number and Year: P063P212439-2022, P268K222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Material Weakness in Internal Control over Compliance ? Material Noncompliance (Modified Opinion) Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct and FFEL loan programs via the NSLDS (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the SFA Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. The data on the institution?s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, ?Campus Level? and ?Program Level,? both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Condition: The University failed to reconcile the enrollment effective date per the institution records and the enrollment effective date per NSLDS. Questioned costs: There are no questioned costs. Context: We noted ten (10) out of forty (40) students selected for testing, where the enrollment effective date per the institution records and the enrollment effective date per NSLDS do not agree. We noted two (2) of forty (40) students where the institutional enrollment effective date does not align to the NSLDS enrollment effective date. We noted eight (8) of forty (40) students where NSLDS was not updated timely for the change of status as identified by institution. We noted one (1) of forty (40) students where no determination date was documented. We noted one (1) of forty (40) students where the program begin date per NSLDS did not agree to the institutional records. Cause: The University?s internal controls failed to detect that the data reported and posted to NSLDS that do not agree to the University?s records. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to reviewing the information posted to NSLDS to ensure the accuracy of the data. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 011: Common Origination and Disbursement Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number and Year: P063P212439-2022, P268K222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Material Weakness in Internal Control over Compliance ? Material Noncompliance (Modified Opinion) Criteria or specific requirement: Institutions submit Direct Loan, Pell Grant, TEACH Grant, and IASG origination records and disbursement records to the Common Origination and Disbursement (COD) system. Origination records can be sent well in advance of any disbursements, as early as the institution chooses to submit them for any student the institution reasonably believes will be eligible for a payment. An institution follows up with a disbursement record for that student no earlier than (1) seven calendar days prior to the disbursement date under the Advance or Heightened Cash Monitoring 1 payment methods, or (2) the date of the disbursement under the Reimbursement or Heightened Cash Monitoring 2 Payment Method (see Federal Register, Volume 85, Number 134, July 14, 2020). The disbursement record reports the actual disbursement date and the amount of the disbursement. ED processes origination and/or disbursement records and returns acknowledgments to the institution. The acknowledgments identify the processing status of each record: Rejected, Accepted with Corrections, or Accepted. In testing the origination and disbursement data, the auditor should be most concerned with the data ED has categorized as accepted or accepted with corrections. Institutions must report student disbursement data within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data. Institutions may do this by reporting once every 15 calendar days, bi-weekly or weekly, or may set up their own system to ensure that changes are reported in a timely manner. Condition: The University failed to comply with the reporting requirements of Common Origination and Disbursement (COD) in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: We noted eight (8) out of forty (40) students selected for testing, where there were discrepancies between the institutional records and the information included in COD. We noted four (4) exceptions where the disbursement date per the student account and the applied date at ED Per COD was greater than 15 days. We noted three (3) exceptions where the disbursement date per the student account did not agree to the disbursement date per COD. We noted one (1) exception where the amount per COD did not agree to the amount per the student account. Cause: The University?s internal controls failed to detect that the date being submitted to COD did not comply with the stated criteria. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to reviewing the information submitted to COD to ensure compliance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 002: GLBA Risk Assessment Requirements Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: The institution is required to perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other system failures. In addition, each institution has to document a safeguard for each risk identified from the criteria noted. Condition: As of June 30, 2022, the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not formally documented the risk assessment and required safeguards in accordance with the stated criteria. This was noted from our review of the information technology policies and procedures. Cause: The University is working with an outside service provider to formally document the risk assessment and required safeguards to ensure compliance with the stated criteria. That process had not been completed as of June 30, 2022. Effect: The University was not in compliance with the statement criteria as of June 30, 2022. Repeat Finding: No Recommendation: We recommend that the University continue to work with the outside service provider to ensure compliance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 006: Student Notification of Disbursement Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number:84.268, 84.379 Federal Award Identification Number and Year: P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Material Weakness in Internal Control over Compliance ? Material Noncompliance (Modified Opinion) Criteria or specific requirement: The institution must notify the student, or parent, in writing of (1) the date and amount of the disbursement; (2) the student?s right, or parent?s right, to cancel all or a portion of that loan or loan disbursement and have the loan proceeds returned to the holder of that loan or the TEACH Grant payments returned to ED; and (3)the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan, TEACH Grant, or TEACH Grant disbursement. The notification requirement for loan funds applies only if the funds are disbursed by EFT payment or master check (34 CFR 668.165). Condition: The University did not send required notifications of disbursements to students who received Direct Subsidized Loans and Direct Unsubsidized Loans in accordance with the stated criteria. Questioned costs: There are no questioned costs. Context: We noted thirty (30) out of forty (40) students selected for testing where the individual students did not receive the required notifications in accordance with the stated criteria. Cause: The University?s internal controls failed to detect that the notifications had not been sent to the students. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University review its policies and procedures and make updates to them to mitigate the risk that the notifications will not be sent in accordance with the stated criteria. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 008: Verification Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268, 84.379 Federal Award Identification Number and Year: P007A214513-2022, P033A214513-2022, P063P212439-2022, P268K222439-2022, P379T222439-2022 Award Period: July 1, 2021 to June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: An institution is required to establish written policies and procedures that incorporate the provisions of 34 CFR 668.51 through 668.61 for verifying applicant information for those applicants selected for verification by ED. The institution shall require each applicant whose application is selected by ED to verify the information required for the Verification Tracking Group to which the applicant is assigned. However, certain applicants are excluded from the verification process as listed in 34 CFR 668.54(b). A menu of potential verification items for each award year is published in the Federal Register, and the items to verify for a given application are selected by ED from that menu and indicated on the student?s output documents. Verification tracking groups and verification items for each award year can also be found in the annual FSA Handbook, Application and Verification Guide, Chapter 4. The institution shall also require applicants to verify any information used to calculate an applicant?s EFC that the institution has reason to believe is inaccurate and provide an accurate code for the individual?s verification status in the Common Origination and Disbursement (COD) system. (34 CFR 668.54(a); FSA Handbook Application and Verification Guide, Chapter 4). Condition: The University has not maintained the required support for verification of a V4 code for a student where verification was requested by the U.S. Department of Education. Questioned costs: There are no questioned costs. Context: We noted seven (7) out of forty (45) students selected for eligibility testing, specific for verification, where the required identity and educational purpose and government issued photo identification was not maintained. Cause: The University?s internal controls failed to detect the missing verification information as required in the stated criteria. Effect: The University failed to comply with the stated criteria. Repeat Finding: No Recommendation: We recommend that the University update its processes and procedures related to the maintenance of the required verification support. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 004: HEERF Reporting Federal Agency: U.S. Department of Education Federal Program Name: (COVID-19) Higher Education Emergency Relief Fund Assistance Listing Number: 84.425F, 84.425M Federal Award Identification Number and Year: P425E204430-2020, P425M201006-20A-2020 Award Period: 84.425F ? May 14, 2020 to June 30, 2023 / 84.425M ? August 5, 2020 to June 30, 2023 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: There are three components to reporting for HEERF: 1) public reporting on the (a)(1) Student Aid Portion; 2) public reporting on the (a)(1) Institutional Portion (a)(2) and (a)(3) subprograms (Quarterly Reporting Form), as applicable; and 3) the annual report. The CARES Act 18004(e) and the CRRSAA 314(e) requires an institution receiving funds under HEERF I and HEERF II to submit a report to the secretary, at such time in such a manner as the secretary may require. While ARP does not explicitly identify procedures by which institutions must report on their uses of HEERF grant funds, ED exercises this reporting authority under 2 CFR section 200.328 and 2 CFR section 200.329. Condition: The University filed the annual report on May 12th, 2022, which was two (2) days later than the requirement to complete by May 10th, 2022. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not filed the annual report, with the appropriate supporting documentation, in accordance with the stated criteria. Cause: The University?s internal controls failed to detect that the annual report was not filed by the due date in the stated criteria. Effect: The University was not in compliance with the requirement to file the annual report by the due date in the stated criteria. Repeat Finding: No Recommendation: We recommend the University review its policies and procedures for the filing of the HEERF to ensure that there is sufficient time in the process to meet the due date in accordance with the stated criteria. The evidence of submission should include the original supporting documentation for the information published. Views of responsible officials: There is no disagreement with the audit finding.

2022 ? 004: HEERF Reporting Federal Agency: U.S. Department of Education Federal Program Name: (COVID-19) Higher Education Emergency Relief Fund Assistance Listing Number: 84.425F, 84.425M Federal Award Identification Number and Year: P425E204430-2020, P425M201006-20A-2020 Award Period: 84.425F ? May 14, 2020 to June 30, 2023 / 84.425M ? August 5, 2020 to June 30, 2023 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: There are three components to reporting for HEERF: 1) public reporting on the (a)(1) Student Aid Portion; 2) public reporting on the (a)(1) Institutional Portion (a)(2) and (a)(3) subprograms (Quarterly Reporting Form), as applicable; and 3) the annual report. The CARES Act 18004(e) and the CRRSAA 314(e) requires an institution receiving funds under HEERF I and HEERF II to submit a report to the secretary, at such time in such a manner as the secretary may require. While ARP does not explicitly identify procedures by which institutions must report on their uses of HEERF grant funds, ED exercises this reporting authority under 2 CFR section 200.328 and 2 CFR section 200.329. Condition: The University filed the annual report on May 12th, 2022, which was two (2) days later than the requirement to complete by May 10th, 2022. Questioned costs: There are no questioned costs. Context: In performing our audit, we noted that the University had not filed the annual report, with the appropriate supporting documentation, in accordance with the stated criteria. Cause: The University?s internal controls failed to detect that the annual report was not filed by the due date in the stated criteria. Effect: The University was not in compliance with the requirement to file the annual report by the due date in the stated criteria. Repeat Finding: No Recommendation: We recommend the University review its policies and procedures for the filing of the HEERF to ensure that there is sufficient time in the process to meet the due date in accordance with the stated criteria. The evidence of submission should include the original supporting documentation for the information published. Views of responsible officials: There is no disagreement with the audit finding.