Audit 297439

Finding 2023-001—Gramm-Leach Bliley Act—Student Information Security Repeat Finding: No Federal Program Title—U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal TEACH Grants: 84.379 Federal Work-Study Program: 84.033 Federal Award Year 2022-2023 Condition While the Institute does have various policies addressing information security, the Institute did not have written policies to address the required safeguards for the eight required elements under the Gramm-Leach Bliley Act (GLBA) by June 9, 2023, the required date of compliance. Of the eight required elements under the GLBA, the Institute did have six written and formally documented safeguards, one is not applicable (assess apps developed by institution) and one had safeguards designed (dispose of customer information securely) but not a written policy in place. Criteria In accordance with 16 CFR 314.4(c), an institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). This includes the following: (1) implement and periodically review access controls, (2) conduct a periodic inventory of data, noting where it’s collected, stored or transmitted, (3) encrypt customer information on the institution’s system and when it’s in transit, (4) assess apps developed by the institution, (5) implement multi-factor authentication for anyone accessing customer information on the institution’s system, (6) dispose of customer information securely, (7) anticipate and evaluate changes to the information system or network, and (8) maintain a log of authorized users’ activity and keep an eye out for unauthorized users. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure that reviews are being completed over information security policies and that they are in compliance with GLBA requirements. Questioned Costs There were no questioned costs. Cause While security policies and practices addressed the safeguards identified in 16 CFR 314.4(c)(1) through (8), all were not formally documented due to an oversight. Of the eight required elements under the GLBA the Institute did have six written and formally documented safeguards, one is not applicable and one had safeguards designed (dispose of customer information securely) but did not have a written policy in place. A comprehensive formal Information Security Policy that addresses all required safeguards under the GLBA has been drafted and is in its final institutional review. Context The required elements were not combined into a single policy. Effect Failure to meet the minimum requirements of the GLBA act is noncompliance and increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other comprise of student information. Recommendation We recommend the Institute implement controls to ensure that GLBA requirements are reviewed and addressed in a formally documented policy. Views of Responsible Officials We agree with this finding. See corrective action plan.

Finding 2023-001—Gramm-Leach Bliley Act—Student Information Security Repeat Finding: No Federal Program Title—U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal TEACH Grants: 84.379 Federal Work-Study Program: 84.033 Federal Award Year 2022-2023 Condition While the Institute does have various policies addressing information security, the Institute did not have written policies to address the required safeguards for the eight required elements under the Gramm-Leach Bliley Act (GLBA) by June 9, 2023, the required date of compliance. Of the eight required elements under the GLBA, the Institute did have six written and formally documented safeguards, one is not applicable (assess apps developed by institution) and one had safeguards designed (dispose of customer information securely) but not a written policy in place. Criteria In accordance with 16 CFR 314.4(c), an institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). This includes the following: (1) implement and periodically review access controls, (2) conduct a periodic inventory of data, noting where it’s collected, stored or transmitted, (3) encrypt customer information on the institution’s system and when it’s in transit, (4) assess apps developed by the institution, (5) implement multi-factor authentication for anyone accessing customer information on the institution’s system, (6) dispose of customer information securely, (7) anticipate and evaluate changes to the information system or network, and (8) maintain a log of authorized users’ activity and keep an eye out for unauthorized users. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure that reviews are being completed over information security policies and that they are in compliance with GLBA requirements. Questioned Costs There were no questioned costs. Cause While security policies and practices addressed the safeguards identified in 16 CFR 314.4(c)(1) through (8), all were not formally documented due to an oversight. Of the eight required elements under the GLBA the Institute did have six written and formally documented safeguards, one is not applicable and one had safeguards designed (dispose of customer information securely) but did not have a written policy in place. A comprehensive formal Information Security Policy that addresses all required safeguards under the GLBA has been drafted and is in its final institutional review. Context The required elements were not combined into a single policy. Effect Failure to meet the minimum requirements of the GLBA act is noncompliance and increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other comprise of student information. Recommendation We recommend the Institute implement controls to ensure that GLBA requirements are reviewed and addressed in a formally documented policy. Views of Responsible Officials We agree with this finding. See corrective action plan.

Finding 2023-001—Gramm-Leach Bliley Act—Student Information Security Repeat Finding: No Federal Program Title—U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal TEACH Grants: 84.379 Federal Work-Study Program: 84.033 Federal Award Year 2022-2023 Condition While the Institute does have various policies addressing information security, the Institute did not have written policies to address the required safeguards for the eight required elements under the Gramm-Leach Bliley Act (GLBA) by June 9, 2023, the required date of compliance. Of the eight required elements under the GLBA, the Institute did have six written and formally documented safeguards, one is not applicable (assess apps developed by institution) and one had safeguards designed (dispose of customer information securely) but not a written policy in place. Criteria In accordance with 16 CFR 314.4(c), an institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). This includes the following: (1) implement and periodically review access controls, (2) conduct a periodic inventory of data, noting where it’s collected, stored or transmitted, (3) encrypt customer information on the institution’s system and when it’s in transit, (4) assess apps developed by the institution, (5) implement multi-factor authentication for anyone accessing customer information on the institution’s system, (6) dispose of customer information securely, (7) anticipate and evaluate changes to the information system or network, and (8) maintain a log of authorized users’ activity and keep an eye out for unauthorized users. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure that reviews are being completed over information security policies and that they are in compliance with GLBA requirements. Questioned Costs There were no questioned costs. Cause While security policies and practices addressed the safeguards identified in 16 CFR 314.4(c)(1) through (8), all were not formally documented due to an oversight. Of the eight required elements under the GLBA the Institute did have six written and formally documented safeguards, one is not applicable and one had safeguards designed (dispose of customer information securely) but did not have a written policy in place. A comprehensive formal Information Security Policy that addresses all required safeguards under the GLBA has been drafted and is in its final institutional review. Context The required elements were not combined into a single policy. Effect Failure to meet the minimum requirements of the GLBA act is noncompliance and increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other comprise of student information. Recommendation We recommend the Institute implement controls to ensure that GLBA requirements are reviewed and addressed in a formally documented policy. Views of Responsible Officials We agree with this finding. See corrective action plan.

Finding 2023-002—Enrollment Reporting Repeat Finding: Yes Federal Program Title—U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition For two out of four students tested (50%) who withdrew from the Institute, the students’ enrollment status reported to the National Student Loan Data System (NSLDS) did not match the institution’s records. Criteria CFR section 685.309 and 690.83(b)(2) requires the Institute to notify the NSLDS within 30 days of a change in student status or include the change in status in a response to an enrollment reporting roster within 60 days of the student’s date of determination of withdrawal. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure accurate reporting of enrollment status changes. Questioned Costs There were no questioned costs related to testing of enrollment reporting. Cause Between 2022 and 2023, the Registration & Records office at Erikson experienced significant staff turnover, which revealed underlying vulnerabilities. Initially, there was a reorganization of the entire enrollment management function. During this time, a key office member was out for extended periods of time under FMLA prior to resigning in spring 2023. This staffing shortage led to delays in registration functions related to reporting to the NSLDS that sit within this office, including reporting. Context Two out of four students selected for testing. Effect Failure to report status changes timely is noncompliance with Federal regulation and could result in loss of future funding. Recommendation We recommend the Institute improve internal controls in order to report any status changes to the NSLDS timely and accurately. Views of Responsible Officials We agree with this finding. See corrective action plan. Finding 2023-002—Enrollment Reporting Repeat Finding: Yes Federal Program Title—U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition For two out of four students tested (50%) who withdrew from the Institute, the students’ enrollment status reported to the National Student Loan Data System (NSLDS) did not match the institution’s records. Criteria CFR section 685.309 and 690.83(b)(2) requires the Institute to notify the NSLDS within 30 days of a change in student status or include the change in status in a response to an enrollment reporting roster within 60 days of the student’s date of determination of withdrawal. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure accurate reporting of enrollment status changes. Questioned Costs There were no questioned costs related to testing of enrollment reporting. Cause Between 2022 and 2023, the Registration & Records office at Erikson experienced significant staff turnover, which revealed underlying vulnerabilities. Initially, there was a reorganization of the entire enrollment management function. During this time, a key office member was out for extended periods of time under FMLA prior to resigning in spring 2023. This staffing shortage led to delays in registration functions related to reporting to the NSLDS that sit within this office, including reporting. Context Two out of four students selected for testing. Effect Failure to report status changes timely is noncompliance with Federal regulation and could result in loss of future funding. Recommendation We recommend the Institute improve internal controls in order to report any status changes to the NSLDS timely and accurately. Views of Responsible Officials We agree with this finding. See corrective action plan.

Finding 2023-003—Cash Management—Excess Cash Repeat Finding: No Federal Program Title—U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition During our cash management testing, we identified the following instances of excess cash: • The Institute had three instances of return of funds that resulted in excess cash for Federal Direct Student Loans ranging from $94 to $46,049 during the period of September 19, 2022 through November 29, 2022. In these situations, the excess cash amounts, being less than one percent of total prior year drawdowns, were not returned within a seven day tolerance period, as outlined below.   Criteria Uniform Grant Guidance (34 CFR 668.166) states the Secretary considers excess cash to be any amount of title IV, HEA program funds, other than Federal Perkins Loan program funds, that an institution does not disburse to students by the end of the third business day following the date the institution (1) received those funds from the Secretary; or (2) deposited or transferred to its depository account previously disbursed title IV, HEA program funds, such as those resulting from awards adjustments, recoveries, or cancellations. An institution may maintain for up to seven days an amount of excess cash that does not exceed one percent of the total amount of funds the institution drew down in the prior award year. The institution must return immediately to the Secretary any amount of excess cash over the one-percent tolerance and any amount of excess cash remaining in its account after the seven-day tolerance period. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure excess cash is properly handled. Questioned Costs There were no questioned costs related to testing of excess cash. Cause During this period of time, Erikson was without a Student Bursar due to a resignation in September 2022. The Student Bursar is responsible for requesting and monitoring the return of federal funds. With the staff transition there was a gap in monitoring cash management procedures. In December 2022 all excess cash was returned. A new Student Bursar was hired in November 2022 and onboarding included comprehensive federal funds cash management training with an outside consultant. Context Ranging from $94 - $46,049 during the period from Sept 19 – Nov 29. Effect Excess cash is noncompliance with Federal regulation and could result in the loss of future funding. Recommendation We recommend the Institute review current processes for monitoring cash management and implement procedures that eliminate excess cash. Views of Responsible Officials We agree with this finding. See corrective action plan.

Finding 2023-001—Gramm-Leach Bliley Act—Student Information Security Repeat Finding: No Federal Program Title—U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal TEACH Grants: 84.379 Federal Work-Study Program: 84.033 Federal Award Year 2022-2023 Condition While the Institute does have various policies addressing information security, the Institute did not have written policies to address the required safeguards for the eight required elements under the Gramm-Leach Bliley Act (GLBA) by June 9, 2023, the required date of compliance. Of the eight required elements under the GLBA, the Institute did have six written and formally documented safeguards, one is not applicable (assess apps developed by institution) and one had safeguards designed (dispose of customer information securely) but not a written policy in place. Criteria In accordance with 16 CFR 314.4(c), an institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). This includes the following: (1) implement and periodically review access controls, (2) conduct a periodic inventory of data, noting where it’s collected, stored or transmitted, (3) encrypt customer information on the institution’s system and when it’s in transit, (4) assess apps developed by the institution, (5) implement multi-factor authentication for anyone accessing customer information on the institution’s system, (6) dispose of customer information securely, (7) anticipate and evaluate changes to the information system or network, and (8) maintain a log of authorized users’ activity and keep an eye out for unauthorized users. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure that reviews are being completed over information security policies and that they are in compliance with GLBA requirements. Questioned Costs There were no questioned costs. Cause While security policies and practices addressed the safeguards identified in 16 CFR 314.4(c)(1) through (8), all were not formally documented due to an oversight. Of the eight required elements under the GLBA the Institute did have six written and formally documented safeguards, one is not applicable and one had safeguards designed (dispose of customer information securely) but did not have a written policy in place. A comprehensive formal Information Security Policy that addresses all required safeguards under the GLBA has been drafted and is in its final institutional review. Context The required elements were not combined into a single policy. Effect Failure to meet the minimum requirements of the GLBA act is noncompliance and increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other comprise of student information. Recommendation We recommend the Institute implement controls to ensure that GLBA requirements are reviewed and addressed in a formally documented policy. Views of Responsible Officials We agree with this finding. See corrective action plan.

Finding 2023-001—Gramm-Leach Bliley Act—Student Information Security Repeat Finding: No Federal Program Title—U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal TEACH Grants: 84.379 Federal Work-Study Program: 84.033 Federal Award Year 2022-2023 Condition While the Institute does have various policies addressing information security, the Institute did not have written policies to address the required safeguards for the eight required elements under the Gramm-Leach Bliley Act (GLBA) by June 9, 2023, the required date of compliance. Of the eight required elements under the GLBA, the Institute did have six written and formally documented safeguards, one is not applicable (assess apps developed by institution) and one had safeguards designed (dispose of customer information securely) but not a written policy in place. Criteria In accordance with 16 CFR 314.4(c), an institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). This includes the following: (1) implement and periodically review access controls, (2) conduct a periodic inventory of data, noting where it’s collected, stored or transmitted, (3) encrypt customer information on the institution’s system and when it’s in transit, (4) assess apps developed by the institution, (5) implement multi-factor authentication for anyone accessing customer information on the institution’s system, (6) dispose of customer information securely, (7) anticipate and evaluate changes to the information system or network, and (8) maintain a log of authorized users’ activity and keep an eye out for unauthorized users. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure that reviews are being completed over information security policies and that they are in compliance with GLBA requirements. Questioned Costs There were no questioned costs. Cause While security policies and practices addressed the safeguards identified in 16 CFR 314.4(c)(1) through (8), all were not formally documented due to an oversight. Of the eight required elements under the GLBA the Institute did have six written and formally documented safeguards, one is not applicable and one had safeguards designed (dispose of customer information securely) but did not have a written policy in place. A comprehensive formal Information Security Policy that addresses all required safeguards under the GLBA has been drafted and is in its final institutional review. Context The required elements were not combined into a single policy. Effect Failure to meet the minimum requirements of the GLBA act is noncompliance and increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other comprise of student information. Recommendation We recommend the Institute implement controls to ensure that GLBA requirements are reviewed and addressed in a formally documented policy. Views of Responsible Officials We agree with this finding. See corrective action plan.

Finding 2023-001—Gramm-Leach Bliley Act—Student Information Security Repeat Finding: No Federal Program Title—U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal TEACH Grants: 84.379 Federal Work-Study Program: 84.033 Federal Award Year 2022-2023 Condition While the Institute does have various policies addressing information security, the Institute did not have written policies to address the required safeguards for the eight required elements under the Gramm-Leach Bliley Act (GLBA) by June 9, 2023, the required date of compliance. Of the eight required elements under the GLBA, the Institute did have six written and formally documented safeguards, one is not applicable (assess apps developed by institution) and one had safeguards designed (dispose of customer information securely) but not a written policy in place. Criteria In accordance with 16 CFR 314.4(c), an institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). This includes the following: (1) implement and periodically review access controls, (2) conduct a periodic inventory of data, noting where it’s collected, stored or transmitted, (3) encrypt customer information on the institution’s system and when it’s in transit, (4) assess apps developed by the institution, (5) implement multi-factor authentication for anyone accessing customer information on the institution’s system, (6) dispose of customer information securely, (7) anticipate and evaluate changes to the information system or network, and (8) maintain a log of authorized users’ activity and keep an eye out for unauthorized users. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure that reviews are being completed over information security policies and that they are in compliance with GLBA requirements. Questioned Costs There were no questioned costs. Cause While security policies and practices addressed the safeguards identified in 16 CFR 314.4(c)(1) through (8), all were not formally documented due to an oversight. Of the eight required elements under the GLBA the Institute did have six written and formally documented safeguards, one is not applicable and one had safeguards designed (dispose of customer information securely) but did not have a written policy in place. A comprehensive formal Information Security Policy that addresses all required safeguards under the GLBA has been drafted and is in its final institutional review. Context The required elements were not combined into a single policy. Effect Failure to meet the minimum requirements of the GLBA act is noncompliance and increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other comprise of student information. Recommendation We recommend the Institute implement controls to ensure that GLBA requirements are reviewed and addressed in a formally documented policy. Views of Responsible Officials We agree with this finding. See corrective action plan.

Finding 2023-002—Enrollment Reporting Repeat Finding: Yes Federal Program Title—U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition For two out of four students tested (50%) who withdrew from the Institute, the students’ enrollment status reported to the National Student Loan Data System (NSLDS) did not match the institution’s records. Criteria CFR section 685.309 and 690.83(b)(2) requires the Institute to notify the NSLDS within 30 days of a change in student status or include the change in status in a response to an enrollment reporting roster within 60 days of the student’s date of determination of withdrawal. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure accurate reporting of enrollment status changes. Questioned Costs There were no questioned costs related to testing of enrollment reporting. Cause Between 2022 and 2023, the Registration & Records office at Erikson experienced significant staff turnover, which revealed underlying vulnerabilities. Initially, there was a reorganization of the entire enrollment management function. During this time, a key office member was out for extended periods of time under FMLA prior to resigning in spring 2023. This staffing shortage led to delays in registration functions related to reporting to the NSLDS that sit within this office, including reporting. Context Two out of four students selected for testing. Effect Failure to report status changes timely is noncompliance with Federal regulation and could result in loss of future funding. Recommendation We recommend the Institute improve internal controls in order to report any status changes to the NSLDS timely and accurately. Views of Responsible Officials We agree with this finding. See corrective action plan. Finding 2023-002—Enrollment Reporting Repeat Finding: Yes Federal Program Title—U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition For two out of four students tested (50%) who withdrew from the Institute, the students’ enrollment status reported to the National Student Loan Data System (NSLDS) did not match the institution’s records. Criteria CFR section 685.309 and 690.83(b)(2) requires the Institute to notify the NSLDS within 30 days of a change in student status or include the change in status in a response to an enrollment reporting roster within 60 days of the student’s date of determination of withdrawal. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure accurate reporting of enrollment status changes. Questioned Costs There were no questioned costs related to testing of enrollment reporting. Cause Between 2022 and 2023, the Registration & Records office at Erikson experienced significant staff turnover, which revealed underlying vulnerabilities. Initially, there was a reorganization of the entire enrollment management function. During this time, a key office member was out for extended periods of time under FMLA prior to resigning in spring 2023. This staffing shortage led to delays in registration functions related to reporting to the NSLDS that sit within this office, including reporting. Context Two out of four students selected for testing. Effect Failure to report status changes timely is noncompliance with Federal regulation and could result in loss of future funding. Recommendation We recommend the Institute improve internal controls in order to report any status changes to the NSLDS timely and accurately. Views of Responsible Officials We agree with this finding. See corrective action plan.

Finding 2023-003—Cash Management—Excess Cash Repeat Finding: No Federal Program Title—U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition During our cash management testing, we identified the following instances of excess cash: • The Institute had three instances of return of funds that resulted in excess cash for Federal Direct Student Loans ranging from $94 to $46,049 during the period of September 19, 2022 through November 29, 2022. In these situations, the excess cash amounts, being less than one percent of total prior year drawdowns, were not returned within a seven day tolerance period, as outlined below.   Criteria Uniform Grant Guidance (34 CFR 668.166) states the Secretary considers excess cash to be any amount of title IV, HEA program funds, other than Federal Perkins Loan program funds, that an institution does not disburse to students by the end of the third business day following the date the institution (1) received those funds from the Secretary; or (2) deposited or transferred to its depository account previously disbursed title IV, HEA program funds, such as those resulting from awards adjustments, recoveries, or cancellations. An institution may maintain for up to seven days an amount of excess cash that does not exceed one percent of the total amount of funds the institution drew down in the prior award year. The institution must return immediately to the Secretary any amount of excess cash over the one-percent tolerance and any amount of excess cash remaining in its account after the seven-day tolerance period. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure excess cash is properly handled. Questioned Costs There were no questioned costs related to testing of excess cash. Cause During this period of time, Erikson was without a Student Bursar due to a resignation in September 2022. The Student Bursar is responsible for requesting and monitoring the return of federal funds. With the staff transition there was a gap in monitoring cash management procedures. In December 2022 all excess cash was returned. A new Student Bursar was hired in November 2022 and onboarding included comprehensive federal funds cash management training with an outside consultant. Context Ranging from $94 - $46,049 during the period from Sept 19 – Nov 29. Effect Excess cash is noncompliance with Federal regulation and could result in the loss of future funding. Recommendation We recommend the Institute review current processes for monitoring cash management and implement procedures that eliminate excess cash. Views of Responsible Officials We agree with this finding. See corrective action plan.