Federal agency: Department of Education
Federal program title: Student Financial Assistance Cluster
Assistance Listing Numbers: 84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
Award Period: July 1, 2022, to June 30, 2023
Type of Finding: Other Matters Finding related to Compliance within Uniform Guidance and Significant Deficiency in Internal Controls over Compliance.
Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct loan programs via the National Student Loan Data System (NSLDS) (OMB No. 1845-0035) (Pell, 34 CFR 690.83(b)(2); Direct Loan, 34 CFR 685.309). Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. There are two categories of enrollment information with separate record types; “Campus Level” and “Program Level,” both of which need to be reported accurately and timely. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Institutions must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that roster file.
Condition: During our testing of the Direct Loan and Pell Grant programs, we selected 24 enrollment changes to test for timeliness and accurate reporting of student status changes to the National Student Loan Data System (NSLDS). 3 of 24 enrollment changes tested did not have the correctly reported Program Begin Date within the current program level reporting.
Questioned costs Known: None.
Context: Out of our sample of 24 students who had a reduction or increase in attendance levels, graduated, withdrew, dropped out, or enrolled but never attended during the audit period, we noted 3 whom exhibited one instance of noncompliance in the student’s NSLDS Program-Level enrollment data elements that the Department of Education considers high risk. Cause: Lack of appropriate policy and procedure coupled with multiple transitions within the registrar department led to enrollment reporting deficiencies.
Effect: The NSLDS system is potentially not updated with correct student information which could cause over subsequent awarding issues or repayment term discrepancies.
Repeat Finding: No.
Recommendation: We recommend that the College continue to enhance its policies and procedures regarding enrollment reporting including additional monitoring over the third-party service provider to ensure that reporting is completed accurately and timely.
Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.
Federal agency: Department of Education
Federal program title: Student Financial Assistance Cluster
Assistance Listing Numbers: 84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.007 – Supplemental Educational Opportunity Grant
84.033 – College Work study Program
84.379 – Teacher Education Assistance for College and Higher Education Grant
84.038 – Federal Perkins Loans Program
Award Period: July 1, 2022, to June 30, 2023
Type of Finding: Other Matters Finding related to Compliance within Uniform Guidance and Significant Deficiency in Internal Controls over Compliance.
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers (16 CFR 313.3(k)(2)(vi)). Institutions agree to comply with GLBA in their Program Participation Agreement with ED. Institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the Federal student financial aid programs (16 CFR 314.3; HEA 483(a)(3)(E) and HEA 485B(d)(2)). ED provides additional information about cybersecurity requirements at https://studentprivacy.ed.gov/security. ED also issued an Electronic Announcement on GLBA compliance that can be found at https://fsapartners.ed.gov/knowledge-center/library/electronicannouncements/2023-02-09/updates-gramm-leach-bliley-act-cybersecurity-requirements.
Condition: CLA identified that the college fails to meet one of the compliance requirements outlined in the GLBA Safeguards Rule within 16 CFR 314.
Questioned costs Known: None.
Context: During our testing, we noted the College failed to meet one of the compliance requirements outlined in the GLBA Safeguards Rule. The College has been continuously drafting and implementing policies as part of their written information security program, however as of June 30, 2023, one requirement was not met.
Cause: The College is currently drafting the necessary policy which was not formally in place.
Effect: Failure to have a complete written information security program in place causes the College to not be GLBA compliant and potentially put institutional and student data at risk.
Repeat Finding: No.
Recommendation: We recommend the College finalize its written information security program to ensure its compliant with the GLBA Safeguards Rule along with appropriately managing its information technology and cybersecurity risks.
Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.
Federal agency: Department of Education
Federal program title: Student Financial Assistance Cluster
Assistance Listing Numbers: 84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.007 – Supplemental Educational Opportunity Grant
84.033 – College Work study Program
84.379 – Teacher Education Assistance for College and Higher Education Grant
84.038 – Federal Perkins Loans Program
Award Period: July 1, 2022, to June 30, 2023
Type of Finding: Other Matters Finding related to Compliance within Uniform Guidance and Significant Deficiency in Internal Controls over Compliance.
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers (16 CFR 313.3(k)(2)(vi)). Institutions agree to comply with GLBA in their Program Participation Agreement with ED. Institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the Federal student financial aid programs (16 CFR 314.3; HEA 483(a)(3)(E) and HEA 485B(d)(2)). ED provides additional information about cybersecurity requirements at https://studentprivacy.ed.gov/security. ED also issued an Electronic Announcement on GLBA compliance that can be found at https://fsapartners.ed.gov/knowledge-center/library/electronicannouncements/2023-02-09/updates-gramm-leach-bliley-act-cybersecurity-requirements.
Condition: CLA identified that the college fails to meet one of the compliance requirements outlined in the GLBA Safeguards Rule within 16 CFR 314.
Questioned costs Known: None.
Context: During our testing, we noted the College failed to meet one of the compliance requirements outlined in the GLBA Safeguards Rule. The College has been continuously drafting and implementing policies as part of their written information security program, however as of June 30, 2023, one requirement was not met.
Cause: The College is currently drafting the necessary policy which was not formally in place.
Effect: Failure to have a complete written information security program in place causes the College to not be GLBA compliant and potentially put institutional and student data at risk.
Repeat Finding: No.
Recommendation: We recommend the College finalize its written information security program to ensure its compliant with the GLBA Safeguards Rule along with appropriately managing its information technology and cybersecurity risks.
Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.
Federal agency: Department of Education
Federal program title: Student Financial Assistance Cluster
Assistance Listing Numbers: 84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.007 – Supplemental Educational Opportunity Grant
84.033 – College Work study Program
84.379 – Teacher Education Assistance for College and Higher Education Grant
84.038 – Federal Perkins Loans Program
Award Period: July 1, 2022, to June 30, 2023
Type of Finding: Other Matters Finding related to Compliance within Uniform Guidance and Significant Deficiency in Internal Controls over Compliance.
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers (16 CFR 313.3(k)(2)(vi)). Institutions agree to comply with GLBA in their Program Participation Agreement with ED. Institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the Federal student financial aid programs (16 CFR 314.3; HEA 483(a)(3)(E) and HEA 485B(d)(2)). ED provides additional information about cybersecurity requirements at https://studentprivacy.ed.gov/security. ED also issued an Electronic Announcement on GLBA compliance that can be found at https://fsapartners.ed.gov/knowledge-center/library/electronicannouncements/2023-02-09/updates-gramm-leach-bliley-act-cybersecurity-requirements.
Condition: CLA identified that the college fails to meet one of the compliance requirements outlined in the GLBA Safeguards Rule within 16 CFR 314.
Questioned costs Known: None.
Context: During our testing, we noted the College failed to meet one of the compliance requirements outlined in the GLBA Safeguards Rule. The College has been continuously drafting and implementing policies as part of their written information security program, however as of June 30, 2023, one requirement was not met.
Cause: The College is currently drafting the necessary policy which was not formally in place.
Effect: Failure to have a complete written information security program in place causes the College to not be GLBA compliant and potentially put institutional and student data at risk.
Repeat Finding: No.
Recommendation: We recommend the College finalize its written information security program to ensure its compliant with the GLBA Safeguards Rule along with appropriately managing its information technology and cybersecurity risks.
Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.
Federal agency: Department of Education
Federal program title: Student Financial Assistance Cluster
Assistance Listing Numbers: 84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.007 – Supplemental Educational Opportunity Grant
84.033 – College Work study Program
84.379 – Teacher Education Assistance for College and Higher Education Grant
84.038 – Federal Perkins Loans Program
Award Period: July 1, 2022, to June 30, 2023
Type of Finding: Other Matters Finding related to Compliance within Uniform Guidance and Significant Deficiency in Internal Controls over Compliance.
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers (16 CFR 313.3(k)(2)(vi)). Institutions agree to comply with GLBA in their Program Participation Agreement with ED. Institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the Federal student financial aid programs (16 CFR 314.3; HEA 483(a)(3)(E) and HEA 485B(d)(2)). ED provides additional information about cybersecurity requirements at https://studentprivacy.ed.gov/security. ED also issued an Electronic Announcement on GLBA compliance that can be found at https://fsapartners.ed.gov/knowledge-center/library/electronicannouncements/2023-02-09/updates-gramm-leach-bliley-act-cybersecurity-requirements.
Condition: CLA identified that the college fails to meet one of the compliance requirements outlined in the GLBA Safeguards Rule within 16 CFR 314.
Questioned costs Known: None.
Context: During our testing, we noted the College failed to meet one of the compliance requirements outlined in the GLBA Safeguards Rule. The College has been continuously drafting and implementing policies as part of their written information security program, however as of June 30, 2023, one requirement was not met.
Cause: The College is currently drafting the necessary policy which was not formally in place.
Effect: Failure to have a complete written information security program in place causes the College to not be GLBA compliant and potentially put institutional and student data at risk.
Repeat Finding: No.
Recommendation: We recommend the College finalize its written information security program to ensure its compliant with the GLBA Safeguards Rule along with appropriately managing its information technology and cybersecurity risks.
Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.
Federal agency: Department of Education
Federal program title: Student Financial Assistance Cluster
Assistance Listing Numbers: 84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.007 – Supplemental Educational Opportunity Grant
84.033 – College Work study Program
84.379 – Teacher Education Assistance for College and Higher Education Grant
84.038 – Federal Perkins Loans Program
Award Period: July 1, 2022, to June 30, 2023
Type of Finding: Other Matters Finding related to Compliance within Uniform Guidance and Significant Deficiency in Internal Controls over Compliance.
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers (16 CFR 313.3(k)(2)(vi)). Institutions agree to comply with GLBA in their Program Participation Agreement with ED. Institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the Federal student financial aid programs (16 CFR 314.3; HEA 483(a)(3)(E) and HEA 485B(d)(2)). ED provides additional information about cybersecurity requirements at https://studentprivacy.ed.gov/security. ED also issued an Electronic Announcement on GLBA compliance that can be found at https://fsapartners.ed.gov/knowledge-center/library/electronicannouncements/2023-02-09/updates-gramm-leach-bliley-act-cybersecurity-requirements.
Condition: CLA identified that the college fails to meet one of the compliance requirements outlined in the GLBA Safeguards Rule within 16 CFR 314.
Questioned costs Known: None.
Context: During our testing, we noted the College failed to meet one of the compliance requirements outlined in the GLBA Safeguards Rule. The College has been continuously drafting and implementing policies as part of their written information security program, however as of June 30, 2023, one requirement was not met.
Cause: The College is currently drafting the necessary policy which was not formally in place.
Effect: Failure to have a complete written information security program in place causes the College to not be GLBA compliant and potentially put institutional and student data at risk.
Repeat Finding: No.
Recommendation: We recommend the College finalize its written information security program to ensure its compliant with the GLBA Safeguards Rule along with appropriately managing its information technology and cybersecurity risks.
Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.
Federal agency: Department of Education
Federal program title: Student Financial Assistance Cluster
Assistance Listing Numbers: 84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
Award Period: July 1, 2022, to June 30, 2023
Type of Finding: Other Matters Finding related to Compliance within Uniform Guidance and Significant Deficiency in Internal Controls over Compliance.
Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct loan programs via the National Student Loan Data System (NSLDS) (OMB No. 1845-0035) (Pell, 34 CFR 690.83(b)(2); Direct Loan, 34 CFR 685.309). Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. There are two categories of enrollment information with separate record types; “Campus Level” and “Program Level,” both of which need to be reported accurately and timely. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Institutions must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that roster file.
Condition: During our testing of the Direct Loan and Pell Grant programs, we selected 24 enrollment changes to test for timeliness and accurate reporting of student status changes to the National Student Loan Data System (NSLDS). 3 of 24 enrollment changes tested did not have the correctly reported Program Begin Date within the current program level reporting.
Questioned costs Known: None.
Context: Out of our sample of 24 students who had a reduction or increase in attendance levels, graduated, withdrew, dropped out, or enrolled but never attended during the audit period, we noted 3 whom exhibited one instance of noncompliance in the student’s NSLDS Program-Level enrollment data elements that the Department of Education considers high risk. Cause: Lack of appropriate policy and procedure coupled with multiple transitions within the registrar department led to enrollment reporting deficiencies.
Effect: The NSLDS system is potentially not updated with correct student information which could cause over subsequent awarding issues or repayment term discrepancies.
Repeat Finding: No.
Recommendation: We recommend that the College continue to enhance its policies and procedures regarding enrollment reporting including additional monitoring over the third-party service provider to ensure that reporting is completed accurately and timely.
Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.
Federal agency: Department of Education
Federal program title: Student Financial Assistance Cluster
Assistance Listing Numbers: 84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.007 – Supplemental Educational Opportunity Grant
84.033 – College Work study Program
84.379 – Teacher Education Assistance for College and Higher Education Grant
84.038 – Federal Perkins Loans Program
Award Period: July 1, 2022, to June 30, 2023
Type of Finding: Other Matters Finding related to Compliance within Uniform Guidance and Significant Deficiency in Internal Controls over Compliance.
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers (16 CFR 313.3(k)(2)(vi)). Institutions agree to comply with GLBA in their Program Participation Agreement with ED. Institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the Federal student financial aid programs (16 CFR 314.3; HEA 483(a)(3)(E) and HEA 485B(d)(2)). ED provides additional information about cybersecurity requirements at https://studentprivacy.ed.gov/security. ED also issued an Electronic Announcement on GLBA compliance that can be found at https://fsapartners.ed.gov/knowledge-center/library/electronicannouncements/2023-02-09/updates-gramm-leach-bliley-act-cybersecurity-requirements.
Condition: CLA identified that the college fails to meet one of the compliance requirements outlined in the GLBA Safeguards Rule within 16 CFR 314.
Questioned costs Known: None.
Context: During our testing, we noted the College failed to meet one of the compliance requirements outlined in the GLBA Safeguards Rule. The College has been continuously drafting and implementing policies as part of their written information security program, however as of June 30, 2023, one requirement was not met.
Cause: The College is currently drafting the necessary policy which was not formally in place.
Effect: Failure to have a complete written information security program in place causes the College to not be GLBA compliant and potentially put institutional and student data at risk.
Repeat Finding: No.
Recommendation: We recommend the College finalize its written information security program to ensure its compliant with the GLBA Safeguards Rule along with appropriately managing its information technology and cybersecurity risks.
Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.
Federal agency: Department of Education
Federal program title: Student Financial Assistance Cluster
Assistance Listing Numbers: 84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
Award Period: July 1, 2022, to June 30, 2023
Type of Finding: Other Matters Finding related to Compliance within Uniform Guidance and Significant Deficiency in Internal Controls over Compliance.
Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct loan programs via the National Student Loan Data System (NSLDS) (OMB No. 1845-0035) (Pell, 34 CFR 690.83(b)(2); Direct Loan, 34 CFR 685.309). Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. There are two categories of enrollment information with separate record types; “Campus Level” and “Program Level,” both of which need to be reported accurately and timely. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Institutions must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that roster file.
Condition: During our testing of the Direct Loan and Pell Grant programs, we selected 24 enrollment changes to test for timeliness and accurate reporting of student status changes to the National Student Loan Data System (NSLDS). 3 of 24 enrollment changes tested did not have the correctly reported Program Begin Date within the current program level reporting.
Questioned costs Known: None.
Context: Out of our sample of 24 students who had a reduction or increase in attendance levels, graduated, withdrew, dropped out, or enrolled but never attended during the audit period, we noted 3 whom exhibited one instance of noncompliance in the student’s NSLDS Program-Level enrollment data elements that the Department of Education considers high risk. Cause: Lack of appropriate policy and procedure coupled with multiple transitions within the registrar department led to enrollment reporting deficiencies.
Effect: The NSLDS system is potentially not updated with correct student information which could cause over subsequent awarding issues or repayment term discrepancies.
Repeat Finding: No.
Recommendation: We recommend that the College continue to enhance its policies and procedures regarding enrollment reporting including additional monitoring over the third-party service provider to ensure that reporting is completed accurately and timely.
Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.
Federal agency: Department of Education
Federal program title: Student Financial Assistance Cluster
Assistance Listing Numbers: 84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.007 – Supplemental Educational Opportunity Grant
84.033 – College Work study Program
84.379 – Teacher Education Assistance for College and Higher Education Grant
84.038 – Federal Perkins Loans Program
Award Period: July 1, 2022, to June 30, 2023
Type of Finding: Other Matters Finding related to Compliance within Uniform Guidance and Significant Deficiency in Internal Controls over Compliance.
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers (16 CFR 313.3(k)(2)(vi)). Institutions agree to comply with GLBA in their Program Participation Agreement with ED. Institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the Federal student financial aid programs (16 CFR 314.3; HEA 483(a)(3)(E) and HEA 485B(d)(2)). ED provides additional information about cybersecurity requirements at https://studentprivacy.ed.gov/security. ED also issued an Electronic Announcement on GLBA compliance that can be found at https://fsapartners.ed.gov/knowledge-center/library/electronicannouncements/2023-02-09/updates-gramm-leach-bliley-act-cybersecurity-requirements.
Condition: CLA identified that the college fails to meet one of the compliance requirements outlined in the GLBA Safeguards Rule within 16 CFR 314.
Questioned costs Known: None.
Context: During our testing, we noted the College failed to meet one of the compliance requirements outlined in the GLBA Safeguards Rule. The College has been continuously drafting and implementing policies as part of their written information security program, however as of June 30, 2023, one requirement was not met.
Cause: The College is currently drafting the necessary policy which was not formally in place.
Effect: Failure to have a complete written information security program in place causes the College to not be GLBA compliant and potentially put institutional and student data at risk.
Repeat Finding: No.
Recommendation: We recommend the College finalize its written information security program to ensure its compliant with the GLBA Safeguards Rule along with appropriately managing its information technology and cybersecurity risks.
Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.
Federal agency: Department of Education
Federal program title: Student Financial Assistance Cluster
Assistance Listing Numbers: 84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.007 – Supplemental Educational Opportunity Grant
84.033 – College Work study Program
84.379 – Teacher Education Assistance for College and Higher Education Grant
84.038 – Federal Perkins Loans Program
Award Period: July 1, 2022, to June 30, 2023
Type of Finding: Other Matters Finding related to Compliance within Uniform Guidance and Significant Deficiency in Internal Controls over Compliance.
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers (16 CFR 313.3(k)(2)(vi)). Institutions agree to comply with GLBA in their Program Participation Agreement with ED. Institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the Federal student financial aid programs (16 CFR 314.3; HEA 483(a)(3)(E) and HEA 485B(d)(2)). ED provides additional information about cybersecurity requirements at https://studentprivacy.ed.gov/security. ED also issued an Electronic Announcement on GLBA compliance that can be found at https://fsapartners.ed.gov/knowledge-center/library/electronicannouncements/2023-02-09/updates-gramm-leach-bliley-act-cybersecurity-requirements.
Condition: CLA identified that the college fails to meet one of the compliance requirements outlined in the GLBA Safeguards Rule within 16 CFR 314.
Questioned costs Known: None.
Context: During our testing, we noted the College failed to meet one of the compliance requirements outlined in the GLBA Safeguards Rule. The College has been continuously drafting and implementing policies as part of their written information security program, however as of June 30, 2023, one requirement was not met.
Cause: The College is currently drafting the necessary policy which was not formally in place.
Effect: Failure to have a complete written information security program in place causes the College to not be GLBA compliant and potentially put institutional and student data at risk.
Repeat Finding: No.
Recommendation: We recommend the College finalize its written information security program to ensure its compliant with the GLBA Safeguards Rule along with appropriately managing its information technology and cybersecurity risks.
Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.
Federal agency: Department of Education
Federal program title: Student Financial Assistance Cluster
Assistance Listing Numbers: 84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.007 – Supplemental Educational Opportunity Grant
84.033 – College Work study Program
84.379 – Teacher Education Assistance for College and Higher Education Grant
84.038 – Federal Perkins Loans Program
Award Period: July 1, 2022, to June 30, 2023
Type of Finding: Other Matters Finding related to Compliance within Uniform Guidance and Significant Deficiency in Internal Controls over Compliance.
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers (16 CFR 313.3(k)(2)(vi)). Institutions agree to comply with GLBA in their Program Participation Agreement with ED. Institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the Federal student financial aid programs (16 CFR 314.3; HEA 483(a)(3)(E) and HEA 485B(d)(2)). ED provides additional information about cybersecurity requirements at https://studentprivacy.ed.gov/security. ED also issued an Electronic Announcement on GLBA compliance that can be found at https://fsapartners.ed.gov/knowledge-center/library/electronicannouncements/2023-02-09/updates-gramm-leach-bliley-act-cybersecurity-requirements.
Condition: CLA identified that the college fails to meet one of the compliance requirements outlined in the GLBA Safeguards Rule within 16 CFR 314.
Questioned costs Known: None.
Context: During our testing, we noted the College failed to meet one of the compliance requirements outlined in the GLBA Safeguards Rule. The College has been continuously drafting and implementing policies as part of their written information security program, however as of June 30, 2023, one requirement was not met.
Cause: The College is currently drafting the necessary policy which was not formally in place.
Effect: Failure to have a complete written information security program in place causes the College to not be GLBA compliant and potentially put institutional and student data at risk.
Repeat Finding: No.
Recommendation: We recommend the College finalize its written information security program to ensure its compliant with the GLBA Safeguards Rule along with appropriately managing its information technology and cybersecurity risks.
Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.
Federal agency: Department of Education
Federal program title: Student Financial Assistance Cluster
Assistance Listing Numbers: 84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.007 – Supplemental Educational Opportunity Grant
84.033 – College Work study Program
84.379 – Teacher Education Assistance for College and Higher Education Grant
84.038 – Federal Perkins Loans Program
Award Period: July 1, 2022, to June 30, 2023
Type of Finding: Other Matters Finding related to Compliance within Uniform Guidance and Significant Deficiency in Internal Controls over Compliance.
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers (16 CFR 313.3(k)(2)(vi)). Institutions agree to comply with GLBA in their Program Participation Agreement with ED. Institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the Federal student financial aid programs (16 CFR 314.3; HEA 483(a)(3)(E) and HEA 485B(d)(2)). ED provides additional information about cybersecurity requirements at https://studentprivacy.ed.gov/security. ED also issued an Electronic Announcement on GLBA compliance that can be found at https://fsapartners.ed.gov/knowledge-center/library/electronicannouncements/2023-02-09/updates-gramm-leach-bliley-act-cybersecurity-requirements.
Condition: CLA identified that the college fails to meet one of the compliance requirements outlined in the GLBA Safeguards Rule within 16 CFR 314.
Questioned costs Known: None.
Context: During our testing, we noted the College failed to meet one of the compliance requirements outlined in the GLBA Safeguards Rule. The College has been continuously drafting and implementing policies as part of their written information security program, however as of June 30, 2023, one requirement was not met.
Cause: The College is currently drafting the necessary policy which was not formally in place.
Effect: Failure to have a complete written information security program in place causes the College to not be GLBA compliant and potentially put institutional and student data at risk.
Repeat Finding: No.
Recommendation: We recommend the College finalize its written information security program to ensure its compliant with the GLBA Safeguards Rule along with appropriately managing its information technology and cybersecurity risks.
Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.
Federal agency: Department of Education
Federal program title: Student Financial Assistance Cluster
Assistance Listing Numbers: 84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.007 – Supplemental Educational Opportunity Grant
84.033 – College Work study Program
84.379 – Teacher Education Assistance for College and Higher Education Grant
84.038 – Federal Perkins Loans Program
Award Period: July 1, 2022, to June 30, 2023
Type of Finding: Other Matters Finding related to Compliance within Uniform Guidance and Significant Deficiency in Internal Controls over Compliance.
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers (16 CFR 313.3(k)(2)(vi)). Institutions agree to comply with GLBA in their Program Participation Agreement with ED. Institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the Federal student financial aid programs (16 CFR 314.3; HEA 483(a)(3)(E) and HEA 485B(d)(2)). ED provides additional information about cybersecurity requirements at https://studentprivacy.ed.gov/security. ED also issued an Electronic Announcement on GLBA compliance that can be found at https://fsapartners.ed.gov/knowledge-center/library/electronicannouncements/2023-02-09/updates-gramm-leach-bliley-act-cybersecurity-requirements.
Condition: CLA identified that the college fails to meet one of the compliance requirements outlined in the GLBA Safeguards Rule within 16 CFR 314.
Questioned costs Known: None.
Context: During our testing, we noted the College failed to meet one of the compliance requirements outlined in the GLBA Safeguards Rule. The College has been continuously drafting and implementing policies as part of their written information security program, however as of June 30, 2023, one requirement was not met.
Cause: The College is currently drafting the necessary policy which was not formally in place.
Effect: Failure to have a complete written information security program in place causes the College to not be GLBA compliant and potentially put institutional and student data at risk.
Repeat Finding: No.
Recommendation: We recommend the College finalize its written information security program to ensure its compliant with the GLBA Safeguards Rule along with appropriately managing its information technology and cybersecurity risks.
Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.
Federal agency: Department of Education
Federal program title: Student Financial Assistance Cluster
Assistance Listing Numbers: 84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
Award Period: July 1, 2022, to June 30, 2023
Type of Finding: Other Matters Finding related to Compliance within Uniform Guidance and Significant Deficiency in Internal Controls over Compliance.
Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct loan programs via the National Student Loan Data System (NSLDS) (OMB No. 1845-0035) (Pell, 34 CFR 690.83(b)(2); Direct Loan, 34 CFR 685.309). Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. There are two categories of enrollment information with separate record types; “Campus Level” and “Program Level,” both of which need to be reported accurately and timely. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Institutions must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that roster file.
Condition: During our testing of the Direct Loan and Pell Grant programs, we selected 24 enrollment changes to test for timeliness and accurate reporting of student status changes to the National Student Loan Data System (NSLDS). 3 of 24 enrollment changes tested did not have the correctly reported Program Begin Date within the current program level reporting.
Questioned costs Known: None.
Context: Out of our sample of 24 students who had a reduction or increase in attendance levels, graduated, withdrew, dropped out, or enrolled but never attended during the audit period, we noted 3 whom exhibited one instance of noncompliance in the student’s NSLDS Program-Level enrollment data elements that the Department of Education considers high risk. Cause: Lack of appropriate policy and procedure coupled with multiple transitions within the registrar department led to enrollment reporting deficiencies.
Effect: The NSLDS system is potentially not updated with correct student information which could cause over subsequent awarding issues or repayment term discrepancies.
Repeat Finding: No.
Recommendation: We recommend that the College continue to enhance its policies and procedures regarding enrollment reporting including additional monitoring over the third-party service provider to ensure that reporting is completed accurately and timely.
Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.
Federal agency: Department of Education
Federal program title: Student Financial Assistance Cluster
Assistance Listing Numbers: 84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.007 – Supplemental Educational Opportunity Grant
84.033 – College Work study Program
84.379 – Teacher Education Assistance for College and Higher Education Grant
84.038 – Federal Perkins Loans Program
Award Period: July 1, 2022, to June 30, 2023
Type of Finding: Other Matters Finding related to Compliance within Uniform Guidance and Significant Deficiency in Internal Controls over Compliance.
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers (16 CFR 313.3(k)(2)(vi)). Institutions agree to comply with GLBA in their Program Participation Agreement with ED. Institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the Federal student financial aid programs (16 CFR 314.3; HEA 483(a)(3)(E) and HEA 485B(d)(2)). ED provides additional information about cybersecurity requirements at https://studentprivacy.ed.gov/security. ED also issued an Electronic Announcement on GLBA compliance that can be found at https://fsapartners.ed.gov/knowledge-center/library/electronicannouncements/2023-02-09/updates-gramm-leach-bliley-act-cybersecurity-requirements.
Condition: CLA identified that the college fails to meet one of the compliance requirements outlined in the GLBA Safeguards Rule within 16 CFR 314.
Questioned costs Known: None.
Context: During our testing, we noted the College failed to meet one of the compliance requirements outlined in the GLBA Safeguards Rule. The College has been continuously drafting and implementing policies as part of their written information security program, however as of June 30, 2023, one requirement was not met.
Cause: The College is currently drafting the necessary policy which was not formally in place.
Effect: Failure to have a complete written information security program in place causes the College to not be GLBA compliant and potentially put institutional and student data at risk.
Repeat Finding: No.
Recommendation: We recommend the College finalize its written information security program to ensure its compliant with the GLBA Safeguards Rule along with appropriately managing its information technology and cybersecurity risks.
Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.