2023-002 – Gramm-Leach-Bliley Act (GLBA)
Federal Agency: U.S. Department of Education
Federal Program Title: Student Financial Assistance Cluster
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)).
Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protest student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs.
Questioned costs: None.
Context: During our testing of the University’s information technology, it was noted that the University does not have an active written information security program in place that addressed all seven elements as required by the Gramm-Leach-Bliley Act.
Cause: The University has continued to make progress in updating the Universities written security program to become compliance with all requirements; however, due to capacity and demands on the information technology individuals, this is still a work in process.
Effect: The student personal information could be vulnerable.
Repeat finding: No.
Recommendation: We recommend the University designate an individual to oversee the information security function and work to update the Universities written security program to ensure compliance with all the standards.
Views of responsible officials: Management agrees with the finding.
2023-004 – Tier One and Tier Two Arrangements
Federal Agency: U.S. Department of Education
Federal Program Title: Federal Pell Grant Program; Federal Direct Loan Program
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: Per U.S. Department of Education (ED) regulations 34 CFR 668.164(e) and (f), an institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of FSA credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. The regulation establishes two different types of arrangements between schools and financial account providers: Tier One or Tier Two. Under both arrangements, a school must provide to the Department of Education an up-to-date URL for the contract for publication in a centralized database accessible to the public. Unless the school has a Tier Two arrangement under the threshold, the URL must also include the contract data information.
Condition: Certain arrangement criteria’s were not reported to the Department o Education.
Questioned costs: None
Context: During testing, it was determined that the University has a Tier One contract with a third-party. Per review of the Federal Student Aid site, under "Cash Management Contracts”, it was determined that the University had not provided a URL to the Department of Education regarding its Tier One arrangement.
Cause: This requirement was new for the University during the year; however, due to capacity and demands on federal requirements, this is still a work in process.
Effect: Noncompliance can lead to the University potentially losing Title IV aid eligibility.
Repeat finding: No
Recommendation: We recommend the University review its policies and procedures on reporting requirements to the Department if Education in respects to these requirements.
Views of responsible officials: Management agrees with the finding.
2023-002 – Gramm-Leach-Bliley Act (GLBA)
Federal Agency: U.S. Department of Education
Federal Program Title: Student Financial Assistance Cluster
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)).
Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protest student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs.
Questioned costs: None.
Context: During our testing of the University’s information technology, it was noted that the University does not have an active written information security program in place that addressed all seven elements as required by the Gramm-Leach-Bliley Act.
Cause: The University has continued to make progress in updating the Universities written security program to become compliance with all requirements; however, due to capacity and demands on the information technology individuals, this is still a work in process.
Effect: The student personal information could be vulnerable.
Repeat finding: No.
Recommendation: We recommend the University designate an individual to oversee the information security function and work to update the Universities written security program to ensure compliance with all the standards.
Views of responsible officials: Management agrees with the finding.
2023-004 – Tier One and Tier Two Arrangements
Federal Agency: U.S. Department of Education
Federal Program Title: Federal Pell Grant Program; Federal Direct Loan Program
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: Per U.S. Department of Education (ED) regulations 34 CFR 668.164(e) and (f), an institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of FSA credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. The regulation establishes two different types of arrangements between schools and financial account providers: Tier One or Tier Two. Under both arrangements, a school must provide to the Department of Education an up-to-date URL for the contract for publication in a centralized database accessible to the public. Unless the school has a Tier Two arrangement under the threshold, the URL must also include the contract data information.
Condition: Certain arrangement criteria’s were not reported to the Department o Education.
Questioned costs: None
Context: During testing, it was determined that the University has a Tier One contract with a third-party. Per review of the Federal Student Aid site, under "Cash Management Contracts”, it was determined that the University had not provided a URL to the Department of Education regarding its Tier One arrangement.
Cause: This requirement was new for the University during the year; however, due to capacity and demands on federal requirements, this is still a work in process.
Effect: Noncompliance can lead to the University potentially losing Title IV aid eligibility.
Repeat finding: No
Recommendation: We recommend the University review its policies and procedures on reporting requirements to the Department if Education in respects to these requirements.
Views of responsible officials: Management agrees with the finding.
2023-001 – Perkins Loan Recordkeeping and Record Retention
Federal Agency: U.S. Department of Education
Federal Program Title: Federal Perkins Loan Program
Federal Assistance Listing Number: 84.038
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: An institution shall keep original promissory notes and repayment schedules until Perkins loans are satisfied. If required to release original documents in order to enforce the loan, the institution must retain certified true copies of those documents. An institution shall keep the original paper promissory note or original paper MPN and repayment schedules in a locked, fireproof container (34 CFR 674.19(e)(4)).
Condition: Original promissory notes were unable to be located.
Questioned costs: None.
Context: During our testing, we noted 6 instances out of 40 open Perkins loans tested where the University was unable to locate the original promissory note.
Cause: The University did not have the appropriate policies and procedures in place when Perkins loans were awarded to students in order to ensure that recordkeeping and retention regulations were being followed.
Effect: Open loan balances for these loans are not supported by an original promissory note.
Repeat finding: No.
Recommendation: We recommend the University evaluate its procedures and policies around recordkeeping and record retention.
Views of responsible officials: Management agrees with the finding.
2023-002 – Gramm-Leach-Bliley Act (GLBA)
Federal Agency: U.S. Department of Education
Federal Program Title: Student Financial Assistance Cluster
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)).
Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protest student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs.
Questioned costs: None.
Context: During our testing of the University’s information technology, it was noted that the University does not have an active written information security program in place that addressed all seven elements as required by the Gramm-Leach-Bliley Act.
Cause: The University has continued to make progress in updating the Universities written security program to become compliance with all requirements; however, due to capacity and demands on the information technology individuals, this is still a work in process.
Effect: The student personal information could be vulnerable.
Repeat finding: No.
Recommendation: We recommend the University designate an individual to oversee the information security function and work to update the Universities written security program to ensure compliance with all the standards.
Views of responsible officials: Management agrees with the finding.
2023-004 – Tier One and Tier Two Arrangements
Federal Agency: U.S. Department of Education
Federal Program Title: Federal Pell Grant Program; Federal Direct Loan Program
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: Per U.S. Department of Education (ED) regulations 34 CFR 668.164(e) and (f), an institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of FSA credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. The regulation establishes two different types of arrangements between schools and financial account providers: Tier One or Tier Two. Under both arrangements, a school must provide to the Department of Education an up-to-date URL for the contract for publication in a centralized database accessible to the public. Unless the school has a Tier Two arrangement under the threshold, the URL must also include the contract data information.
Condition: Certain arrangement criteria’s were not reported to the Department o Education.
Questioned costs: None
Context: During testing, it was determined that the University has a Tier One contract with a third-party. Per review of the Federal Student Aid site, under "Cash Management Contracts”, it was determined that the University had not provided a URL to the Department of Education regarding its Tier One arrangement.
Cause: This requirement was new for the University during the year; however, due to capacity and demands on federal requirements, this is still a work in process.
Effect: Noncompliance can lead to the University potentially losing Title IV aid eligibility.
Repeat finding: No
Recommendation: We recommend the University review its policies and procedures on reporting requirements to the Department if Education in respects to these requirements.
Views of responsible officials: Management agrees with the finding.
2023-002 – Gramm-Leach-Bliley Act (GLBA)
Federal Agency: U.S. Department of Education
Federal Program Title: Student Financial Assistance Cluster
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)).
Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protest student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs.
Questioned costs: None.
Context: During our testing of the University’s information technology, it was noted that the University does not have an active written information security program in place that addressed all seven elements as required by the Gramm-Leach-Bliley Act.
Cause: The University has continued to make progress in updating the Universities written security program to become compliance with all requirements; however, due to capacity and demands on the information technology individuals, this is still a work in process.
Effect: The student personal information could be vulnerable.
Repeat finding: No.
Recommendation: We recommend the University designate an individual to oversee the information security function and work to update the Universities written security program to ensure compliance with all the standards.
Views of responsible officials: Management agrees with the finding.
2023-003 – National Student Loan Data System (NSLDS) Reporting
Federal Agency: U.S. Department of Education
Federal Program Title: Federal Pell Grant Program; Federal Direct Loan Program
Federal Assistance Listing Number: 84.063 and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: Per U.S. Department of Education (ED) regulations, all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a roster file. The school is required to report enrollment status at both the school and program level. The school is required to report changes in the student’s enrollment status, the effective date of the status and an anticipated completion date. An academic program is defined as the combination of the school’s Office of Postsecondary Education Identification (OPEID) number and the program’s Classification of Instructional Program (CIP) code, credential level, and published program length. ED requires the University to report changes in enrollment status and indicate the date that the changes occurred (34 CFR 685.309).
Changes in enrollment status must be reported within 30 days. However, if a roster file is expected within 60 days, you may provide the date on that roster file. In addition, regulations require that an institution make necessary corrections and return the records within 10 days for any roster files that don’t pass the NSLDS enrollment reporting edits. ED requires the University to report changes in enrollment status within 30 or 60 days that the University determined the changes occurred (34 CFR 682.610).
Condition: Certain students’ enrollment information was not reported accurately or timely to the NSLDS.
Questioned costs: None.
Context: During our testing, we noted:
-One student out of a sample of 40 students tested was reported to the NSLDS with an enrollment status of Full-time but was never updated subsequently to an enrollment status of Graduated for graduating from the University. This effected both the campus-level and program-level records in the NSLDS.
-One student out of the sample of 40 students tested was reported to the NSLDS with the incorrect effective date on the campus-level and program-level in NSLDS.
-Three students out of a sample of 40 students tested were not reported to the campus-level record in the NSLDS in a timely manner.
Cause: The University's system for which the information is pulled and sent to the NSLDS was not updated for the proper enrollment information per the University's records that are outside of the system.
Effect: Inaccurate reporting to the NSLDS can result in incorrect determination of when the students’ grace period should begin.
Repeat finding: Yes, 2022-003.
Recommendation: We recommend the University review its policies and procedures on reporting enrollment information to the NSLDS to ensure that all relevant information is being captured accurately and reported timely in accordance with applicable regulations.
Views of responsible officials: Management agrees with the finding.
2023-004 – Tier One and Tier Two Arrangements
Federal Agency: U.S. Department of Education
Federal Program Title: Federal Pell Grant Program; Federal Direct Loan Program
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: Per U.S. Department of Education (ED) regulations 34 CFR 668.164(e) and (f), an institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of FSA credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. The regulation establishes two different types of arrangements between schools and financial account providers: Tier One or Tier Two. Under both arrangements, a school must provide to the Department of Education an up-to-date URL for the contract for publication in a centralized database accessible to the public. Unless the school has a Tier Two arrangement under the threshold, the URL must also include the contract data information.
Condition: Certain arrangement criteria’s were not reported to the Department o Education.
Questioned costs: None
Context: During testing, it was determined that the University has a Tier One contract with a third-party. Per review of the Federal Student Aid site, under "Cash Management Contracts”, it was determined that the University had not provided a URL to the Department of Education regarding its Tier One arrangement.
Cause: This requirement was new for the University during the year; however, due to capacity and demands on federal requirements, this is still a work in process.
Effect: Noncompliance can lead to the University potentially losing Title IV aid eligibility.
Repeat finding: No
Recommendation: We recommend the University review its policies and procedures on reporting requirements to the Department if Education in respects to these requirements.
Views of responsible officials: Management agrees with the finding.
2023-002 – Gramm-Leach-Bliley Act (GLBA)
Federal Agency: U.S. Department of Education
Federal Program Title: Student Financial Assistance Cluster
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)).
Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protest student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs.
Questioned costs: None.
Context: During our testing of the University’s information technology, it was noted that the University does not have an active written information security program in place that addressed all seven elements as required by the Gramm-Leach-Bliley Act.
Cause: The University has continued to make progress in updating the Universities written security program to become compliance with all requirements; however, due to capacity and demands on the information technology individuals, this is still a work in process.
Effect: The student personal information could be vulnerable.
Repeat finding: No.
Recommendation: We recommend the University designate an individual to oversee the information security function and work to update the Universities written security program to ensure compliance with all the standards.
Views of responsible officials: Management agrees with the finding.
2023-003 – National Student Loan Data System (NSLDS) Reporting
Federal Agency: U.S. Department of Education
Federal Program Title: Federal Pell Grant Program; Federal Direct Loan Program
Federal Assistance Listing Number: 84.063 and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: Per U.S. Department of Education (ED) regulations, all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a roster file. The school is required to report enrollment status at both the school and program level. The school is required to report changes in the student’s enrollment status, the effective date of the status and an anticipated completion date. An academic program is defined as the combination of the school’s Office of Postsecondary Education Identification (OPEID) number and the program’s Classification of Instructional Program (CIP) code, credential level, and published program length. ED requires the University to report changes in enrollment status and indicate the date that the changes occurred (34 CFR 685.309).
Changes in enrollment status must be reported within 30 days. However, if a roster file is expected within 60 days, you may provide the date on that roster file. In addition, regulations require that an institution make necessary corrections and return the records within 10 days for any roster files that don’t pass the NSLDS enrollment reporting edits. ED requires the University to report changes in enrollment status within 30 or 60 days that the University determined the changes occurred (34 CFR 682.610).
Condition: Certain students’ enrollment information was not reported accurately or timely to the NSLDS.
Questioned costs: None.
Context: During our testing, we noted:
-One student out of a sample of 40 students tested was reported to the NSLDS with an enrollment status of Full-time but was never updated subsequently to an enrollment status of Graduated for graduating from the University. This effected both the campus-level and program-level records in the NSLDS.
-One student out of the sample of 40 students tested was reported to the NSLDS with the incorrect effective date on the campus-level and program-level in NSLDS.
-Three students out of a sample of 40 students tested were not reported to the campus-level record in the NSLDS in a timely manner.
Cause: The University's system for which the information is pulled and sent to the NSLDS was not updated for the proper enrollment information per the University's records that are outside of the system.
Effect: Inaccurate reporting to the NSLDS can result in incorrect determination of when the students’ grace period should begin.
Repeat finding: Yes, 2022-003.
Recommendation: We recommend the University review its policies and procedures on reporting enrollment information to the NSLDS to ensure that all relevant information is being captured accurately and reported timely in accordance with applicable regulations.
Views of responsible officials: Management agrees with the finding.
2023-004 – Tier One and Tier Two Arrangements
Federal Agency: U.S. Department of Education
Federal Program Title: Federal Pell Grant Program; Federal Direct Loan Program
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: Per U.S. Department of Education (ED) regulations 34 CFR 668.164(e) and (f), an institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of FSA credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. The regulation establishes two different types of arrangements between schools and financial account providers: Tier One or Tier Two. Under both arrangements, a school must provide to the Department of Education an up-to-date URL for the contract for publication in a centralized database accessible to the public. Unless the school has a Tier Two arrangement under the threshold, the URL must also include the contract data information.
Condition: Certain arrangement criteria’s were not reported to the Department o Education.
Questioned costs: None
Context: During testing, it was determined that the University has a Tier One contract with a third-party. Per review of the Federal Student Aid site, under "Cash Management Contracts”, it was determined that the University had not provided a URL to the Department of Education regarding its Tier One arrangement.
Cause: This requirement was new for the University during the year; however, due to capacity and demands on federal requirements, this is still a work in process.
Effect: Noncompliance can lead to the University potentially losing Title IV aid eligibility.
Repeat finding: No
Recommendation: We recommend the University review its policies and procedures on reporting requirements to the Department if Education in respects to these requirements.
Views of responsible officials: Management agrees with the finding.
2023-002 – Gramm-Leach-Bliley Act (GLBA)
Federal Agency: U.S. Department of Education
Federal Program Title: Student Financial Assistance Cluster
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)).
Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protest student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs.
Questioned costs: None.
Context: During our testing of the University’s information technology, it was noted that the University does not have an active written information security program in place that addressed all seven elements as required by the Gramm-Leach-Bliley Act.
Cause: The University has continued to make progress in updating the Universities written security program to become compliance with all requirements; however, due to capacity and demands on the information technology individuals, this is still a work in process.
Effect: The student personal information could be vulnerable.
Repeat finding: No.
Recommendation: We recommend the University designate an individual to oversee the information security function and work to update the Universities written security program to ensure compliance with all the standards.
Views of responsible officials: Management agrees with the finding.
2023-004 – Tier One and Tier Two Arrangements
Federal Agency: U.S. Department of Education
Federal Program Title: Federal Pell Grant Program; Federal Direct Loan Program
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: Per U.S. Department of Education (ED) regulations 34 CFR 668.164(e) and (f), an institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of FSA credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. The regulation establishes two different types of arrangements between schools and financial account providers: Tier One or Tier Two. Under both arrangements, a school must provide to the Department of Education an up-to-date URL for the contract for publication in a centralized database accessible to the public. Unless the school has a Tier Two arrangement under the threshold, the URL must also include the contract data information.
Condition: Certain arrangement criteria’s were not reported to the Department o Education.
Questioned costs: None
Context: During testing, it was determined that the University has a Tier One contract with a third-party. Per review of the Federal Student Aid site, under "Cash Management Contracts”, it was determined that the University had not provided a URL to the Department of Education regarding its Tier One arrangement.
Cause: This requirement was new for the University during the year; however, due to capacity and demands on federal requirements, this is still a work in process.
Effect: Noncompliance can lead to the University potentially losing Title IV aid eligibility.
Repeat finding: No
Recommendation: We recommend the University review its policies and procedures on reporting requirements to the Department if Education in respects to these requirements.
Views of responsible officials: Management agrees with the finding.
2023-002 – Gramm-Leach-Bliley Act (GLBA)
Federal Agency: U.S. Department of Education
Federal Program Title: Student Financial Assistance Cluster
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)).
Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protest student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs.
Questioned costs: None.
Context: During our testing of the University’s information technology, it was noted that the University does not have an active written information security program in place that addressed all seven elements as required by the Gramm-Leach-Bliley Act.
Cause: The University has continued to make progress in updating the Universities written security program to become compliance with all requirements; however, due to capacity and demands on the information technology individuals, this is still a work in process.
Effect: The student personal information could be vulnerable.
Repeat finding: No.
Recommendation: We recommend the University designate an individual to oversee the information security function and work to update the Universities written security program to ensure compliance with all the standards.
Views of responsible officials: Management agrees with the finding.
2023-004 – Tier One and Tier Two Arrangements
Federal Agency: U.S. Department of Education
Federal Program Title: Federal Pell Grant Program; Federal Direct Loan Program
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: Per U.S. Department of Education (ED) regulations 34 CFR 668.164(e) and (f), an institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of FSA credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. The regulation establishes two different types of arrangements between schools and financial account providers: Tier One or Tier Two. Under both arrangements, a school must provide to the Department of Education an up-to-date URL for the contract for publication in a centralized database accessible to the public. Unless the school has a Tier Two arrangement under the threshold, the URL must also include the contract data information.
Condition: Certain arrangement criteria’s were not reported to the Department o Education.
Questioned costs: None
Context: During testing, it was determined that the University has a Tier One contract with a third-party. Per review of the Federal Student Aid site, under "Cash Management Contracts”, it was determined that the University had not provided a URL to the Department of Education regarding its Tier One arrangement.
Cause: This requirement was new for the University during the year; however, due to capacity and demands on federal requirements, this is still a work in process.
Effect: Noncompliance can lead to the University potentially losing Title IV aid eligibility.
Repeat finding: No
Recommendation: We recommend the University review its policies and procedures on reporting requirements to the Department if Education in respects to these requirements.
Views of responsible officials: Management agrees with the finding.
2023-001 – Perkins Loan Recordkeeping and Record Retention
Federal Agency: U.S. Department of Education
Federal Program Title: Federal Perkins Loan Program
Federal Assistance Listing Number: 84.038
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: An institution shall keep original promissory notes and repayment schedules until Perkins loans are satisfied. If required to release original documents in order to enforce the loan, the institution must retain certified true copies of those documents. An institution shall keep the original paper promissory note or original paper MPN and repayment schedules in a locked, fireproof container (34 CFR 674.19(e)(4)).
Condition: Original promissory notes were unable to be located.
Questioned costs: None.
Context: During our testing, we noted 6 instances out of 40 open Perkins loans tested where the University was unable to locate the original promissory note.
Cause: The University did not have the appropriate policies and procedures in place when Perkins loans were awarded to students in order to ensure that recordkeeping and retention regulations were being followed.
Effect: Open loan balances for these loans are not supported by an original promissory note.
Repeat finding: No.
Recommendation: We recommend the University evaluate its procedures and policies around recordkeeping and record retention.
Views of responsible officials: Management agrees with the finding.
2023-002 – Gramm-Leach-Bliley Act (GLBA)
Federal Agency: U.S. Department of Education
Federal Program Title: Student Financial Assistance Cluster
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)).
Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protest student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs.
Questioned costs: None.
Context: During our testing of the University’s information technology, it was noted that the University does not have an active written information security program in place that addressed all seven elements as required by the Gramm-Leach-Bliley Act.
Cause: The University has continued to make progress in updating the Universities written security program to become compliance with all requirements; however, due to capacity and demands on the information technology individuals, this is still a work in process.
Effect: The student personal information could be vulnerable.
Repeat finding: No.
Recommendation: We recommend the University designate an individual to oversee the information security function and work to update the Universities written security program to ensure compliance with all the standards.
Views of responsible officials: Management agrees with the finding.
2023-004 – Tier One and Tier Two Arrangements
Federal Agency: U.S. Department of Education
Federal Program Title: Federal Pell Grant Program; Federal Direct Loan Program
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: Per U.S. Department of Education (ED) regulations 34 CFR 668.164(e) and (f), an institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of FSA credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. The regulation establishes two different types of arrangements between schools and financial account providers: Tier One or Tier Two. Under both arrangements, a school must provide to the Department of Education an up-to-date URL for the contract for publication in a centralized database accessible to the public. Unless the school has a Tier Two arrangement under the threshold, the URL must also include the contract data information.
Condition: Certain arrangement criteria’s were not reported to the Department o Education.
Questioned costs: None
Context: During testing, it was determined that the University has a Tier One contract with a third-party. Per review of the Federal Student Aid site, under "Cash Management Contracts”, it was determined that the University had not provided a URL to the Department of Education regarding its Tier One arrangement.
Cause: This requirement was new for the University during the year; however, due to capacity and demands on federal requirements, this is still a work in process.
Effect: Noncompliance can lead to the University potentially losing Title IV aid eligibility.
Repeat finding: No
Recommendation: We recommend the University review its policies and procedures on reporting requirements to the Department if Education in respects to these requirements.
Views of responsible officials: Management agrees with the finding.
2023-002 – Gramm-Leach-Bliley Act (GLBA)
Federal Agency: U.S. Department of Education
Federal Program Title: Student Financial Assistance Cluster
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)).
Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protest student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs.
Questioned costs: None.
Context: During our testing of the University’s information technology, it was noted that the University does not have an active written information security program in place that addressed all seven elements as required by the Gramm-Leach-Bliley Act.
Cause: The University has continued to make progress in updating the Universities written security program to become compliance with all requirements; however, due to capacity and demands on the information technology individuals, this is still a work in process.
Effect: The student personal information could be vulnerable.
Repeat finding: No.
Recommendation: We recommend the University designate an individual to oversee the information security function and work to update the Universities written security program to ensure compliance with all the standards.
Views of responsible officials: Management agrees with the finding.
2023-003 – National Student Loan Data System (NSLDS) Reporting
Federal Agency: U.S. Department of Education
Federal Program Title: Federal Pell Grant Program; Federal Direct Loan Program
Federal Assistance Listing Number: 84.063 and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: Per U.S. Department of Education (ED) regulations, all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a roster file. The school is required to report enrollment status at both the school and program level. The school is required to report changes in the student’s enrollment status, the effective date of the status and an anticipated completion date. An academic program is defined as the combination of the school’s Office of Postsecondary Education Identification (OPEID) number and the program’s Classification of Instructional Program (CIP) code, credential level, and published program length. ED requires the University to report changes in enrollment status and indicate the date that the changes occurred (34 CFR 685.309).
Changes in enrollment status must be reported within 30 days. However, if a roster file is expected within 60 days, you may provide the date on that roster file. In addition, regulations require that an institution make necessary corrections and return the records within 10 days for any roster files that don’t pass the NSLDS enrollment reporting edits. ED requires the University to report changes in enrollment status within 30 or 60 days that the University determined the changes occurred (34 CFR 682.610).
Condition: Certain students’ enrollment information was not reported accurately or timely to the NSLDS.
Questioned costs: None.
Context: During our testing, we noted:
-One student out of a sample of 40 students tested was reported to the NSLDS with an enrollment status of Full-time but was never updated subsequently to an enrollment status of Graduated for graduating from the University. This effected both the campus-level and program-level records in the NSLDS.
-One student out of the sample of 40 students tested was reported to the NSLDS with the incorrect effective date on the campus-level and program-level in NSLDS.
-Three students out of a sample of 40 students tested were not reported to the campus-level record in the NSLDS in a timely manner.
Cause: The University's system for which the information is pulled and sent to the NSLDS was not updated for the proper enrollment information per the University's records that are outside of the system.
Effect: Inaccurate reporting to the NSLDS can result in incorrect determination of when the students’ grace period should begin.
Repeat finding: Yes, 2022-003.
Recommendation: We recommend the University review its policies and procedures on reporting enrollment information to the NSLDS to ensure that all relevant information is being captured accurately and reported timely in accordance with applicable regulations.
Views of responsible officials: Management agrees with the finding.
2023-004 – Tier One and Tier Two Arrangements
Federal Agency: U.S. Department of Education
Federal Program Title: Federal Pell Grant Program; Federal Direct Loan Program
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: Per U.S. Department of Education (ED) regulations 34 CFR 668.164(e) and (f), an institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of FSA credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. The regulation establishes two different types of arrangements between schools and financial account providers: Tier One or Tier Two. Under both arrangements, a school must provide to the Department of Education an up-to-date URL for the contract for publication in a centralized database accessible to the public. Unless the school has a Tier Two arrangement under the threshold, the URL must also include the contract data information.
Condition: Certain arrangement criteria’s were not reported to the Department o Education.
Questioned costs: None
Context: During testing, it was determined that the University has a Tier One contract with a third-party. Per review of the Federal Student Aid site, under "Cash Management Contracts”, it was determined that the University had not provided a URL to the Department of Education regarding its Tier One arrangement.
Cause: This requirement was new for the University during the year; however, due to capacity and demands on federal requirements, this is still a work in process.
Effect: Noncompliance can lead to the University potentially losing Title IV aid eligibility.
Repeat finding: No
Recommendation: We recommend the University review its policies and procedures on reporting requirements to the Department if Education in respects to these requirements.
Views of responsible officials: Management agrees with the finding.
2023-002 – Gramm-Leach-Bliley Act (GLBA)
Federal Agency: U.S. Department of Education
Federal Program Title: Student Financial Assistance Cluster
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)).
Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protest student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs.
Questioned costs: None.
Context: During our testing of the University’s information technology, it was noted that the University does not have an active written information security program in place that addressed all seven elements as required by the Gramm-Leach-Bliley Act.
Cause: The University has continued to make progress in updating the Universities written security program to become compliance with all requirements; however, due to capacity and demands on the information technology individuals, this is still a work in process.
Effect: The student personal information could be vulnerable.
Repeat finding: No.
Recommendation: We recommend the University designate an individual to oversee the information security function and work to update the Universities written security program to ensure compliance with all the standards.
Views of responsible officials: Management agrees with the finding.
2023-003 – National Student Loan Data System (NSLDS) Reporting
Federal Agency: U.S. Department of Education
Federal Program Title: Federal Pell Grant Program; Federal Direct Loan Program
Federal Assistance Listing Number: 84.063 and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: Per U.S. Department of Education (ED) regulations, all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a roster file. The school is required to report enrollment status at both the school and program level. The school is required to report changes in the student’s enrollment status, the effective date of the status and an anticipated completion date. An academic program is defined as the combination of the school’s Office of Postsecondary Education Identification (OPEID) number and the program’s Classification of Instructional Program (CIP) code, credential level, and published program length. ED requires the University to report changes in enrollment status and indicate the date that the changes occurred (34 CFR 685.309).
Changes in enrollment status must be reported within 30 days. However, if a roster file is expected within 60 days, you may provide the date on that roster file. In addition, regulations require that an institution make necessary corrections and return the records within 10 days for any roster files that don’t pass the NSLDS enrollment reporting edits. ED requires the University to report changes in enrollment status within 30 or 60 days that the University determined the changes occurred (34 CFR 682.610).
Condition: Certain students’ enrollment information was not reported accurately or timely to the NSLDS.
Questioned costs: None.
Context: During our testing, we noted:
-One student out of a sample of 40 students tested was reported to the NSLDS with an enrollment status of Full-time but was never updated subsequently to an enrollment status of Graduated for graduating from the University. This effected both the campus-level and program-level records in the NSLDS.
-One student out of the sample of 40 students tested was reported to the NSLDS with the incorrect effective date on the campus-level and program-level in NSLDS.
-Three students out of a sample of 40 students tested were not reported to the campus-level record in the NSLDS in a timely manner.
Cause: The University's system for which the information is pulled and sent to the NSLDS was not updated for the proper enrollment information per the University's records that are outside of the system.
Effect: Inaccurate reporting to the NSLDS can result in incorrect determination of when the students’ grace period should begin.
Repeat finding: Yes, 2022-003.
Recommendation: We recommend the University review its policies and procedures on reporting enrollment information to the NSLDS to ensure that all relevant information is being captured accurately and reported timely in accordance with applicable regulations.
Views of responsible officials: Management agrees with the finding.
2023-004 – Tier One and Tier Two Arrangements
Federal Agency: U.S. Department of Education
Federal Program Title: Federal Pell Grant Program; Federal Direct Loan Program
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: Per U.S. Department of Education (ED) regulations 34 CFR 668.164(e) and (f), an institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of FSA credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. The regulation establishes two different types of arrangements between schools and financial account providers: Tier One or Tier Two. Under both arrangements, a school must provide to the Department of Education an up-to-date URL for the contract for publication in a centralized database accessible to the public. Unless the school has a Tier Two arrangement under the threshold, the URL must also include the contract data information.
Condition: Certain arrangement criteria’s were not reported to the Department o Education.
Questioned costs: None
Context: During testing, it was determined that the University has a Tier One contract with a third-party. Per review of the Federal Student Aid site, under "Cash Management Contracts”, it was determined that the University had not provided a URL to the Department of Education regarding its Tier One arrangement.
Cause: This requirement was new for the University during the year; however, due to capacity and demands on federal requirements, this is still a work in process.
Effect: Noncompliance can lead to the University potentially losing Title IV aid eligibility.
Repeat finding: No
Recommendation: We recommend the University review its policies and procedures on reporting requirements to the Department if Education in respects to these requirements.
Views of responsible officials: Management agrees with the finding.