Inaccurate Return of Title IV Funds Calculations Significant Deficiency
DEPARTMENT OF EDUCATION
ALN #: 84.268 and 84.063
Federal Award Identification #: 2022-2023 Financial Aid Year
Condition: There were 2 incorrect calculations of returned funds for students that withdrew during the term.
Criteria: 34 CFR 668.22
Questioned Costs: $0
Context: Out of 7 students, 2 students who withdrew during the audit period tested had funds returned incorrectly. One student was a modular student and had met an exemption, and the other student had an incorrect calculation. Additionally, 1 student had funds returned 87 days late. Additionally, one student had funds returned on the student account but the returns were not reflected in Common Origination and Disbursement (COD).
Cause: These were oversights by the University in conjunction with the third-party administrator who assists in processing return calculations.
Effect: The incorrect amount of Title IV funds was returned.
Identification as repeat finding, if applicable: Yes, 2022-001
Recommendation: We recommend the University and the third-party processor work together to determine how to best complete return calculations.
Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. See corrective action plan.
Inaccurate Return of Title IV Funds Calculations Significant Deficiency
DEPARTMENT OF EDUCATION
ALN #: 84.268 and 84.063
Federal Award Identification #: 2022-2023 Financial Aid Year
Condition: There were 2 incorrect calculations of returned funds for students that withdrew during the term.
Criteria: 34 CFR 668.22
Questioned Costs: $0
Context: Out of 7 students, 2 students who withdrew during the audit period tested had funds returned incorrectly. One student was a modular student and had met an exemption, and the other student had an incorrect calculation. Additionally, 1 student had funds returned 87 days late. Additionally, one student had funds returned on the student account but the returns were not reflected in Common Origination and Disbursement (COD).
Cause: These were oversights by the University in conjunction with the third-party administrator who assists in processing return calculations.
Effect: The incorrect amount of Title IV funds was returned.
Identification as repeat finding, if applicable: Yes, 2022-001
Recommendation: We recommend the University and the third-party processor work together to determine how to best complete return calculations.
Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. See corrective action plan.
Incorrect Pell Calculations Significant Deficiency
DEPARTMENT OF EDUCATION
ALN #: 84.063
Federal Award Identification #: 2022-2023 Financial Aid Year
Condition: 2 students out of 31 were not properly awarded Pell based on enrollment status.
Criteria: 34 CFR 690.63(b)
Questioned Costs: $1,187
Context: One student was inadvertently awarded and paid Pell when they were officially less than half time for summer 2023 term under year round Pell, resulting in an over award of $1,187. This was corrected during the audit. Additionally, one student added a class and was not paid their Pell eligibility of $861 for that class. This student was also corrected during the audit.
Cause: These were oversights.
Effect: There was an incorrect amount of Pell paid to these two students.
Identification as repeat finding, if applicable: Not applicable.
Recommendation: We recommend a process be used to adjust Pell to be paid in alignment with enrollment status.
Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. See corrective action plan.
Gramm-Leach-Bliley Act (GLBA) Compliance Significant Deficiency
DEPARTMENT OF EDUCATION
ALN #: 84.268, 84.063, 84.007, and 84.033 - Student Financial Assistance Cluster
Federal Award Identification #: 2022-2023 Financial Aid Year
Condition: The University did not sufficiently comply with all the requirements of GLBA.
Criteria: 16 CFR 314.3, 16 CFR 314.4
Questioned Costs: $0
Context: The University has not:
• fully updated its written information security program in compliance with the revised regulations and with organizational practices
• sufficiently documented its security risk assessment and safeguards
• implemented multi-factor authentication on all systems containing personally identifiable information (PII)
• implemented continuous monitoring, such as penetration testing and vulnerability scanning
• implemented sufficient vendor management policies and reviews
• provided a written, annual report to the board.
Cause: The University shares information technology resources with another organization and is in the process of determining which pieces are fully addressed with that organization and which pieces the University will need to address and document compliance with the requirements of GLBA.
Effect: The University has not adequately addressed the requirements of GLBA, which may lead to unintended exposure of student information to security risks.
Identification as repeat finding, if applicable: Not applicable.
Recommendation: We recommend the University allocate sufficient resources to address all requirements of GLBA.
Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. See corrective action plan.
Gramm-Leach-Bliley Act (GLBA) Compliance Significant Deficiency
DEPARTMENT OF EDUCATION
ALN #: 84.268, 84.063, 84.007, and 84.033 - Student Financial Assistance Cluster
Federal Award Identification #: 2022-2023 Financial Aid Year
Condition: The University did not sufficiently comply with all the requirements of GLBA.
Criteria: 16 CFR 314.3, 16 CFR 314.4
Questioned Costs: $0
Context: The University has not:
• fully updated its written information security program in compliance with the revised regulations and with organizational practices
• sufficiently documented its security risk assessment and safeguards
• implemented multi-factor authentication on all systems containing personally identifiable information (PII)
• implemented continuous monitoring, such as penetration testing and vulnerability scanning
• implemented sufficient vendor management policies and reviews
• provided a written, annual report to the board.
Cause: The University shares information technology resources with another organization and is in the process of determining which pieces are fully addressed with that organization and which pieces the University will need to address and document compliance with the requirements of GLBA.
Effect: The University has not adequately addressed the requirements of GLBA, which may lead to unintended exposure of student information to security risks.
Identification as repeat finding, if applicable: Not applicable.
Recommendation: We recommend the University allocate sufficient resources to address all requirements of GLBA.
Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. See corrective action plan.
Gramm-Leach-Bliley Act (GLBA) Compliance Significant Deficiency
DEPARTMENT OF EDUCATION
ALN #: 84.268, 84.063, 84.007, and 84.033 - Student Financial Assistance Cluster
Federal Award Identification #: 2022-2023 Financial Aid Year
Condition: The University did not sufficiently comply with all the requirements of GLBA.
Criteria: 16 CFR 314.3, 16 CFR 314.4
Questioned Costs: $0
Context: The University has not:
• fully updated its written information security program in compliance with the revised regulations and with organizational practices
• sufficiently documented its security risk assessment and safeguards
• implemented multi-factor authentication on all systems containing personally identifiable information (PII)
• implemented continuous monitoring, such as penetration testing and vulnerability scanning
• implemented sufficient vendor management policies and reviews
• provided a written, annual report to the board.
Cause: The University shares information technology resources with another organization and is in the process of determining which pieces are fully addressed with that organization and which pieces the University will need to address and document compliance with the requirements of GLBA.
Effect: The University has not adequately addressed the requirements of GLBA, which may lead to unintended exposure of student information to security risks.
Identification as repeat finding, if applicable: Not applicable.
Recommendation: We recommend the University allocate sufficient resources to address all requirements of GLBA.
Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. See corrective action plan.
Gramm-Leach-Bliley Act (GLBA) Compliance Significant Deficiency
DEPARTMENT OF EDUCATION
ALN #: 84.268, 84.063, 84.007, and 84.033 - Student Financial Assistance Cluster
Federal Award Identification #: 2022-2023 Financial Aid Year
Condition: The University did not sufficiently comply with all the requirements of GLBA.
Criteria: 16 CFR 314.3, 16 CFR 314.4
Questioned Costs: $0
Context: The University has not:
• fully updated its written information security program in compliance with the revised regulations and with organizational practices
• sufficiently documented its security risk assessment and safeguards
• implemented multi-factor authentication on all systems containing personally identifiable information (PII)
• implemented continuous monitoring, such as penetration testing and vulnerability scanning
• implemented sufficient vendor management policies and reviews
• provided a written, annual report to the board.
Cause: The University shares information technology resources with another organization and is in the process of determining which pieces are fully addressed with that organization and which pieces the University will need to address and document compliance with the requirements of GLBA.
Effect: The University has not adequately addressed the requirements of GLBA, which may lead to unintended exposure of student information to security risks.
Identification as repeat finding, if applicable: Not applicable.
Recommendation: We recommend the University allocate sufficient resources to address all requirements of GLBA.
Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. See corrective action plan.
Inaccurate Return of Title IV Funds Calculations Significant Deficiency
DEPARTMENT OF EDUCATION
ALN #: 84.268 and 84.063
Federal Award Identification #: 2022-2023 Financial Aid Year
Condition: There were 2 incorrect calculations of returned funds for students that withdrew during the term.
Criteria: 34 CFR 668.22
Questioned Costs: $0
Context: Out of 7 students, 2 students who withdrew during the audit period tested had funds returned incorrectly. One student was a modular student and had met an exemption, and the other student had an incorrect calculation. Additionally, 1 student had funds returned 87 days late. Additionally, one student had funds returned on the student account but the returns were not reflected in Common Origination and Disbursement (COD).
Cause: These were oversights by the University in conjunction with the third-party administrator who assists in processing return calculations.
Effect: The incorrect amount of Title IV funds was returned.
Identification as repeat finding, if applicable: Yes, 2022-001
Recommendation: We recommend the University and the third-party processor work together to determine how to best complete return calculations.
Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. See corrective action plan.
Inaccurate Return of Title IV Funds Calculations Significant Deficiency
DEPARTMENT OF EDUCATION
ALN #: 84.268 and 84.063
Federal Award Identification #: 2022-2023 Financial Aid Year
Condition: There were 2 incorrect calculations of returned funds for students that withdrew during the term.
Criteria: 34 CFR 668.22
Questioned Costs: $0
Context: Out of 7 students, 2 students who withdrew during the audit period tested had funds returned incorrectly. One student was a modular student and had met an exemption, and the other student had an incorrect calculation. Additionally, 1 student had funds returned 87 days late. Additionally, one student had funds returned on the student account but the returns were not reflected in Common Origination and Disbursement (COD).
Cause: These were oversights by the University in conjunction with the third-party administrator who assists in processing return calculations.
Effect: The incorrect amount of Title IV funds was returned.
Identification as repeat finding, if applicable: Yes, 2022-001
Recommendation: We recommend the University and the third-party processor work together to determine how to best complete return calculations.
Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. See corrective action plan.
Incorrect Pell Calculations Significant Deficiency
DEPARTMENT OF EDUCATION
ALN #: 84.063
Federal Award Identification #: 2022-2023 Financial Aid Year
Condition: 2 students out of 31 were not properly awarded Pell based on enrollment status.
Criteria: 34 CFR 690.63(b)
Questioned Costs: $1,187
Context: One student was inadvertently awarded and paid Pell when they were officially less than half time for summer 2023 term under year round Pell, resulting in an over award of $1,187. This was corrected during the audit. Additionally, one student added a class and was not paid their Pell eligibility of $861 for that class. This student was also corrected during the audit.
Cause: These were oversights.
Effect: There was an incorrect amount of Pell paid to these two students.
Identification as repeat finding, if applicable: Not applicable.
Recommendation: We recommend a process be used to adjust Pell to be paid in alignment with enrollment status.
Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. See corrective action plan.
Gramm-Leach-Bliley Act (GLBA) Compliance Significant Deficiency
DEPARTMENT OF EDUCATION
ALN #: 84.268, 84.063, 84.007, and 84.033 - Student Financial Assistance Cluster
Federal Award Identification #: 2022-2023 Financial Aid Year
Condition: The University did not sufficiently comply with all the requirements of GLBA.
Criteria: 16 CFR 314.3, 16 CFR 314.4
Questioned Costs: $0
Context: The University has not:
• fully updated its written information security program in compliance with the revised regulations and with organizational practices
• sufficiently documented its security risk assessment and safeguards
• implemented multi-factor authentication on all systems containing personally identifiable information (PII)
• implemented continuous monitoring, such as penetration testing and vulnerability scanning
• implemented sufficient vendor management policies and reviews
• provided a written, annual report to the board.
Cause: The University shares information technology resources with another organization and is in the process of determining which pieces are fully addressed with that organization and which pieces the University will need to address and document compliance with the requirements of GLBA.
Effect: The University has not adequately addressed the requirements of GLBA, which may lead to unintended exposure of student information to security risks.
Identification as repeat finding, if applicable: Not applicable.
Recommendation: We recommend the University allocate sufficient resources to address all requirements of GLBA.
Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. See corrective action plan.
Gramm-Leach-Bliley Act (GLBA) Compliance Significant Deficiency
DEPARTMENT OF EDUCATION
ALN #: 84.268, 84.063, 84.007, and 84.033 - Student Financial Assistance Cluster
Federal Award Identification #: 2022-2023 Financial Aid Year
Condition: The University did not sufficiently comply with all the requirements of GLBA.
Criteria: 16 CFR 314.3, 16 CFR 314.4
Questioned Costs: $0
Context: The University has not:
• fully updated its written information security program in compliance with the revised regulations and with organizational practices
• sufficiently documented its security risk assessment and safeguards
• implemented multi-factor authentication on all systems containing personally identifiable information (PII)
• implemented continuous monitoring, such as penetration testing and vulnerability scanning
• implemented sufficient vendor management policies and reviews
• provided a written, annual report to the board.
Cause: The University shares information technology resources with another organization and is in the process of determining which pieces are fully addressed with that organization and which pieces the University will need to address and document compliance with the requirements of GLBA.
Effect: The University has not adequately addressed the requirements of GLBA, which may lead to unintended exposure of student information to security risks.
Identification as repeat finding, if applicable: Not applicable.
Recommendation: We recommend the University allocate sufficient resources to address all requirements of GLBA.
Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. See corrective action plan.
Gramm-Leach-Bliley Act (GLBA) Compliance Significant Deficiency
DEPARTMENT OF EDUCATION
ALN #: 84.268, 84.063, 84.007, and 84.033 - Student Financial Assistance Cluster
Federal Award Identification #: 2022-2023 Financial Aid Year
Condition: The University did not sufficiently comply with all the requirements of GLBA.
Criteria: 16 CFR 314.3, 16 CFR 314.4
Questioned Costs: $0
Context: The University has not:
• fully updated its written information security program in compliance with the revised regulations and with organizational practices
• sufficiently documented its security risk assessment and safeguards
• implemented multi-factor authentication on all systems containing personally identifiable information (PII)
• implemented continuous monitoring, such as penetration testing and vulnerability scanning
• implemented sufficient vendor management policies and reviews
• provided a written, annual report to the board.
Cause: The University shares information technology resources with another organization and is in the process of determining which pieces are fully addressed with that organization and which pieces the University will need to address and document compliance with the requirements of GLBA.
Effect: The University has not adequately addressed the requirements of GLBA, which may lead to unintended exposure of student information to security risks.
Identification as repeat finding, if applicable: Not applicable.
Recommendation: We recommend the University allocate sufficient resources to address all requirements of GLBA.
Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. See corrective action plan.
Gramm-Leach-Bliley Act (GLBA) Compliance Significant Deficiency
DEPARTMENT OF EDUCATION
ALN #: 84.268, 84.063, 84.007, and 84.033 - Student Financial Assistance Cluster
Federal Award Identification #: 2022-2023 Financial Aid Year
Condition: The University did not sufficiently comply with all the requirements of GLBA.
Criteria: 16 CFR 314.3, 16 CFR 314.4
Questioned Costs: $0
Context: The University has not:
• fully updated its written information security program in compliance with the revised regulations and with organizational practices
• sufficiently documented its security risk assessment and safeguards
• implemented multi-factor authentication on all systems containing personally identifiable information (PII)
• implemented continuous monitoring, such as penetration testing and vulnerability scanning
• implemented sufficient vendor management policies and reviews
• provided a written, annual report to the board.
Cause: The University shares information technology resources with another organization and is in the process of determining which pieces are fully addressed with that organization and which pieces the University will need to address and document compliance with the requirements of GLBA.
Effect: The University has not adequately addressed the requirements of GLBA, which may lead to unintended exposure of student information to security risks.
Identification as repeat finding, if applicable: Not applicable.
Recommendation: We recommend the University allocate sufficient resources to address all requirements of GLBA.
Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. See corrective action plan.