Audit 290458

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: Fifteen exceptions were observed during Enrollment Reporting testing. The fifteen exceptions were reported beyond the sixty-day allowable timeframe. Context: 15 of the 40 enrollment changes were reported to NSLDS greater than 60 days from change. Questioned costs: N/A Cause: The Student Financial Aid Office does not have a process in place to ensure all enrollment changes are reported within 60 days to NSLDS. Effect: Student could have inaccurate loan status if their enrollment status is not changed timely. Repeat finding: No Recommendation: CLA recommends implementing a formal review process that involves footing the report to verify clerical accuracy and detect errors during the preparation of the report. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: Fifteen exceptions were observed during Enrollment Reporting testing. The fifteen exceptions were reported beyond the sixty-day allowable timeframe. Context: 15 of the 40 enrollment changes were reported to NSLDS greater than 60 days from change. Questioned costs: N/A Cause: The Student Financial Aid Office does not have a process in place to ensure all enrollment changes are reported within 60 days to NSLDS. Effect: Student could have inaccurate loan status if their enrollment status is not changed timely. Repeat finding: No Recommendation: CLA recommends implementing a formal review process that involves footing the report to verify clerical accuracy and detect errors during the preparation of the report. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: Fifteen exceptions were observed during Enrollment Reporting testing. The fifteen exceptions were reported beyond the sixty-day allowable timeframe. Context: 15 of the 40 enrollment changes were reported to NSLDS greater than 60 days from change. Questioned costs: N/A Cause: The Student Financial Aid Office does not have a process in place to ensure all enrollment changes are reported within 60 days to NSLDS. Effect: Student could have inaccurate loan status if their enrollment status is not changed timely. Repeat finding: No Recommendation: CLA recommends implementing a formal review process that involves footing the report to verify clerical accuracy and detect errors during the preparation of the report. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: Fifteen exceptions were observed during Enrollment Reporting testing. The fifteen exceptions were reported beyond the sixty-day allowable timeframe. Context: 15 of the 40 enrollment changes were reported to NSLDS greater than 60 days from change. Questioned costs: N/A Cause: The Student Financial Aid Office does not have a process in place to ensure all enrollment changes are reported within 60 days to NSLDS. Effect: Student could have inaccurate loan status if their enrollment status is not changed timely. Repeat finding: No Recommendation: CLA recommends implementing a formal review process that involves footing the report to verify clerical accuracy and detect errors during the preparation of the report. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: We noted 1 out of 40 COD disbursements tested, were not reported within the required 15 days to COD. Context: 1 of the 40 COD disbursements had applied dates greater than 15 days from the disbursement dates. Questioned costs: N/A Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat finding: No Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: We noted 1 out of 40 COD disbursements tested, were not reported within the required 15 days to COD. Context: 1 of the 40 COD disbursements had applied dates greater than 15 days from the disbursement dates. Questioned costs: N/A Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat finding: No Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: We noted 1 out of 40 COD disbursements tested, were not reported within the required 15 days to COD. Context: 1 of the 40 COD disbursements had applied dates greater than 15 days from the disbursement dates. Questioned costs: N/A Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat finding: No Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: We noted 1 out of 40 COD disbursements tested, were not reported within the required 15 days to COD. Context: 1 of the 40 COD disbursements had applied dates greater than 15 days from the disbursement dates. Questioned costs: N/A Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat finding: No Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: Connors State College had 7 instance of Title IV refund checks to students that were outstanding longer than 240 days as of June 30, 2023. Context: During the testing of the outstanding Title IV student check listing CLA observed seven instances of stale checks at Connors that were aged greater than 240 days. Questioned costs: N/A Cause: Connors State College had controls in place to catch stale checks and reissue, but financial personnel was not catching reissues over 240 days. Effect: Funds are not returned to the Department of Education in a timely manner Repeat finding: No Recommendation: We recommend that the College start to reconcile stale checks to student disbursement info by check number. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: Connors State College had 7 instance of Title IV refund checks to students that were outstanding longer than 240 days as of June 30, 2023. Context: During the testing of the outstanding Title IV student check listing CLA observed seven instances of stale checks at Connors that were aged greater than 240 days. Questioned costs: N/A Cause: Connors State College had controls in place to catch stale checks and reissue, but financial personnel was not catching reissues over 240 days. Effect: Funds are not returned to the Department of Education in a timely manner Repeat finding: No Recommendation: We recommend that the College start to reconcile stale checks to student disbursement info by check number. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: Connors State College had 7 instance of Title IV refund checks to students that were outstanding longer than 240 days as of June 30, 2023. Context: During the testing of the outstanding Title IV student check listing CLA observed seven instances of stale checks at Connors that were aged greater than 240 days. Questioned costs: N/A Cause: Connors State College had controls in place to catch stale checks and reissue, but financial personnel was not catching reissues over 240 days. Effect: Funds are not returned to the Department of Education in a timely manner Repeat finding: No Recommendation: We recommend that the College start to reconcile stale checks to student disbursement info by check number. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: Connors State College had 7 instance of Title IV refund checks to students that were outstanding longer than 240 days as of June 30, 2023. Context: During the testing of the outstanding Title IV student check listing CLA observed seven instances of stale checks at Connors that were aged greater than 240 days. Questioned costs: N/A Cause: Connors State College had controls in place to catch stale checks and reissue, but financial personnel was not catching reissues over 240 days. Effect: Funds are not returned to the Department of Education in a timely manner Repeat finding: No Recommendation: We recommend that the College start to reconcile stale checks to student disbursement info by check number. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program.(16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: The college was missing all of the requirements from the Gramm-Leach-Bliley Act except for having a Written Information Security Program and secure disposal of customer information. Context: The institution has been in compliance with previous iterations of GLBA regulations. The Written Information Security Program (WISP) which was required as of June 9, 2023 had missing elements but a Qualified Individual was designated for overseeing and implementing the WISP. Some controls were in place whereas others were not. They did, however, have a WISP as of the deadline but it was missing some required information. Questioned costs: N/A Cause: These new GLBA requirements were applicable beginning on June 9, 2023, and there were multiple elements missing from their Written Information Security Program. Effect: Student personal information could be vulnerable Repeat finding: No Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements.Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program.(16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: The college was missing all of the requirements from the Gramm-Leach-Bliley Act except for having a Written Information Security Program and secure disposal of customer information. Context: The institution has been in compliance with previous iterations of GLBA regulations. The Written Information Security Program (WISP) which was required as of June 9, 2023 had missing elements but a Qualified Individual was designated for overseeing and implementing the WISP. Some controls were in place whereas others were not. They did, however, have a WISP as of the deadline but it was missing some required information. Questioned costs: N/A Cause: These new GLBA requirements were applicable beginning on June 9, 2023, and there were multiple elements missing from their Written Information Security Program. Effect: Student personal information could be vulnerable Repeat finding: No Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements.Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program.(16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: The college was missing all of the requirements from the Gramm-Leach-Bliley Act except for having a Written Information Security Program and secure disposal of customer information. Context: The institution has been in compliance with previous iterations of GLBA regulations. The Written Information Security Program (WISP) which was required as of June 9, 2023 had missing elements but a Qualified Individual was designated for overseeing and implementing the WISP. Some controls were in place whereas others were not. They did, however, have a WISP as of the deadline but it was missing some required information. Questioned costs: N/A Cause: These new GLBA requirements were applicable beginning on June 9, 2023, and there were multiple elements missing from their Written Information Security Program. Effect: Student personal information could be vulnerable Repeat finding: No Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements.Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program.(16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: The college was missing all of the requirements from the Gramm-Leach-Bliley Act except for having a Written Information Security Program and secure disposal of customer information. Context: The institution has been in compliance with previous iterations of GLBA regulations. The Written Information Security Program (WISP) which was required as of June 9, 2023 had missing elements but a Qualified Individual was designated for overseeing and implementing the WISP. Some controls were in place whereas others were not. They did, however, have a WISP as of the deadline but it was missing some required information. Questioned costs: N/A Cause: These new GLBA requirements were applicable beginning on June 9, 2023, and there were multiple elements missing from their Written Information Security Program. Effect: Student personal information could be vulnerable Repeat finding: No Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements.Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: Fifteen exceptions were observed during Enrollment Reporting testing. The fifteen exceptions were reported beyond the sixty-day allowable timeframe. Context: 15 of the 40 enrollment changes were reported to NSLDS greater than 60 days from change. Questioned costs: N/A Cause: The Student Financial Aid Office does not have a process in place to ensure all enrollment changes are reported within 60 days to NSLDS. Effect: Student could have inaccurate loan status if their enrollment status is not changed timely. Repeat finding: No Recommendation: CLA recommends implementing a formal review process that involves footing the report to verify clerical accuracy and detect errors during the preparation of the report. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: Fifteen exceptions were observed during Enrollment Reporting testing. The fifteen exceptions were reported beyond the sixty-day allowable timeframe. Context: 15 of the 40 enrollment changes were reported to NSLDS greater than 60 days from change. Questioned costs: N/A Cause: The Student Financial Aid Office does not have a process in place to ensure all enrollment changes are reported within 60 days to NSLDS. Effect: Student could have inaccurate loan status if their enrollment status is not changed timely. Repeat finding: No Recommendation: CLA recommends implementing a formal review process that involves footing the report to verify clerical accuracy and detect errors during the preparation of the report. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: Fifteen exceptions were observed during Enrollment Reporting testing. The fifteen exceptions were reported beyond the sixty-day allowable timeframe. Context: 15 of the 40 enrollment changes were reported to NSLDS greater than 60 days from change. Questioned costs: N/A Cause: The Student Financial Aid Office does not have a process in place to ensure all enrollment changes are reported within 60 days to NSLDS. Effect: Student could have inaccurate loan status if their enrollment status is not changed timely. Repeat finding: No Recommendation: CLA recommends implementing a formal review process that involves footing the report to verify clerical accuracy and detect errors during the preparation of the report. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: Fifteen exceptions were observed during Enrollment Reporting testing. The fifteen exceptions were reported beyond the sixty-day allowable timeframe. Context: 15 of the 40 enrollment changes were reported to NSLDS greater than 60 days from change. Questioned costs: N/A Cause: The Student Financial Aid Office does not have a process in place to ensure all enrollment changes are reported within 60 days to NSLDS. Effect: Student could have inaccurate loan status if their enrollment status is not changed timely. Repeat finding: No Recommendation: CLA recommends implementing a formal review process that involves footing the report to verify clerical accuracy and detect errors during the preparation of the report. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: We noted 1 out of 40 COD disbursements tested, were not reported within the required 15 days to COD. Context: 1 of the 40 COD disbursements had applied dates greater than 15 days from the disbursement dates. Questioned costs: N/A Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat finding: No Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: We noted 1 out of 40 COD disbursements tested, were not reported within the required 15 days to COD. Context: 1 of the 40 COD disbursements had applied dates greater than 15 days from the disbursement dates. Questioned costs: N/A Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat finding: No Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: We noted 1 out of 40 COD disbursements tested, were not reported within the required 15 days to COD. Context: 1 of the 40 COD disbursements had applied dates greater than 15 days from the disbursement dates. Questioned costs: N/A Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat finding: No Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: We noted 1 out of 40 COD disbursements tested, were not reported within the required 15 days to COD. Context: 1 of the 40 COD disbursements had applied dates greater than 15 days from the disbursement dates. Questioned costs: N/A Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat finding: No Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: Connors State College had 7 instance of Title IV refund checks to students that were outstanding longer than 240 days as of June 30, 2023. Context: During the testing of the outstanding Title IV student check listing CLA observed seven instances of stale checks at Connors that were aged greater than 240 days. Questioned costs: N/A Cause: Connors State College had controls in place to catch stale checks and reissue, but financial personnel was not catching reissues over 240 days. Effect: Funds are not returned to the Department of Education in a timely manner Repeat finding: No Recommendation: We recommend that the College start to reconcile stale checks to student disbursement info by check number. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: Connors State College had 7 instance of Title IV refund checks to students that were outstanding longer than 240 days as of June 30, 2023. Context: During the testing of the outstanding Title IV student check listing CLA observed seven instances of stale checks at Connors that were aged greater than 240 days. Questioned costs: N/A Cause: Connors State College had controls in place to catch stale checks and reissue, but financial personnel was not catching reissues over 240 days. Effect: Funds are not returned to the Department of Education in a timely manner Repeat finding: No Recommendation: We recommend that the College start to reconcile stale checks to student disbursement info by check number. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: Connors State College had 7 instance of Title IV refund checks to students that were outstanding longer than 240 days as of June 30, 2023. Context: During the testing of the outstanding Title IV student check listing CLA observed seven instances of stale checks at Connors that were aged greater than 240 days. Questioned costs: N/A Cause: Connors State College had controls in place to catch stale checks and reissue, but financial personnel was not catching reissues over 240 days. Effect: Funds are not returned to the Department of Education in a timely manner Repeat finding: No Recommendation: We recommend that the College start to reconcile stale checks to student disbursement info by check number. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: Connors State College had 7 instance of Title IV refund checks to students that were outstanding longer than 240 days as of June 30, 2023. Context: During the testing of the outstanding Title IV student check listing CLA observed seven instances of stale checks at Connors that were aged greater than 240 days. Questioned costs: N/A Cause: Connors State College had controls in place to catch stale checks and reissue, but financial personnel was not catching reissues over 240 days. Effect: Funds are not returned to the Department of Education in a timely manner Repeat finding: No Recommendation: We recommend that the College start to reconcile stale checks to student disbursement info by check number. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program.(16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: The college was missing all of the requirements from the Gramm-Leach-Bliley Act except for having a Written Information Security Program and secure disposal of customer information. Context: The institution has been in compliance with previous iterations of GLBA regulations. The Written Information Security Program (WISP) which was required as of June 9, 2023 had missing elements but a Qualified Individual was designated for overseeing and implementing the WISP. Some controls were in place whereas others were not. They did, however, have a WISP as of the deadline but it was missing some required information. Questioned costs: N/A Cause: These new GLBA requirements were applicable beginning on June 9, 2023, and there were multiple elements missing from their Written Information Security Program. Effect: Student personal information could be vulnerable Repeat finding: No Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements.Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program.(16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: The college was missing all of the requirements from the Gramm-Leach-Bliley Act except for having a Written Information Security Program and secure disposal of customer information. Context: The institution has been in compliance with previous iterations of GLBA regulations. The Written Information Security Program (WISP) which was required as of June 9, 2023 had missing elements but a Qualified Individual was designated for overseeing and implementing the WISP. Some controls were in place whereas others were not. They did, however, have a WISP as of the deadline but it was missing some required information. Questioned costs: N/A Cause: These new GLBA requirements were applicable beginning on June 9, 2023, and there were multiple elements missing from their Written Information Security Program. Effect: Student personal information could be vulnerable Repeat finding: No Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements.Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program.(16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: The college was missing all of the requirements from the Gramm-Leach-Bliley Act except for having a Written Information Security Program and secure disposal of customer information. Context: The institution has been in compliance with previous iterations of GLBA regulations. The Written Information Security Program (WISP) which was required as of June 9, 2023 had missing elements but a Qualified Individual was designated for overseeing and implementing the WISP. Some controls were in place whereas others were not. They did, however, have a WISP as of the deadline but it was missing some required information. Questioned costs: N/A Cause: These new GLBA requirements were applicable beginning on June 9, 2023, and there were multiple elements missing from their Written Information Security Program. Effect: Student personal information could be vulnerable Repeat finding: No Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements.Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program.(16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). The Code of Federal Regulations, 2 CFR 200.303, required that entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal Award. Condition: The college was missing all of the requirements from the Gramm-Leach-Bliley Act except for having a Written Information Security Program and secure disposal of customer information. Context: The institution has been in compliance with previous iterations of GLBA regulations. The Written Information Security Program (WISP) which was required as of June 9, 2023 had missing elements but a Qualified Individual was designated for overseeing and implementing the WISP. Some controls were in place whereas others were not. They did, however, have a WISP as of the deadline but it was missing some required information. Questioned costs: N/A Cause: These new GLBA requirements were applicable beginning on June 9, 2023, and there were multiple elements missing from their Written Information Security Program. Effect: Student personal information could be vulnerable Repeat finding: No Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements.Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.