Audit 297755

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The District is responsible for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The minimum safeguards include eight required written information security program. Condition: The District's written information security program address 6 of the 8 minimum safeguards identified in the related regulations. The District's policy did not include written documentation for the remaining two required minimum safeguards. Questioned costs: None Context: The District's written information security program is in process of continued review and updating. During the year under audit, the required safeguards were not fully updated in the written policies. Cause: The District's policy reviews for compliance with the noted requirements were not completed prior to the fiscal year. Effect: The District's polices and procedures may not comply with all applicable requirements. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District review and update as necessary the written information security program(s) to include aspects required by regulations. Views of responsible officials: There is no disagreement with the audit finding. While WCTC has implemented practices that ensure the safeguards are in place, the appropriate documentation had not yet been updated. WCTC has completed the recommended revisions as required by the standards.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The District is responsible for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The minimum safeguards include eight required written information security program. Condition: The District's written information security program address 6 of the 8 minimum safeguards identified in the related regulations. The District's policy did not include written documentation for the remaining two required minimum safeguards. Questioned costs: None Context: The District's written information security program is in process of continued review and updating. During the year under audit, the required safeguards were not fully updated in the written policies. Cause: The District's policy reviews for compliance with the noted requirements were not completed prior to the fiscal year. Effect: The District's polices and procedures may not comply with all applicable requirements. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District review and update as necessary the written information security program(s) to include aspects required by regulations. Views of responsible officials: There is no disagreement with the audit finding. While WCTC has implemented practices that ensure the safeguards are in place, the appropriate documentation had not yet been updated. WCTC has completed the recommended revisions as required by the standards.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The District is responsible for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The minimum safeguards include eight required written information security program. Condition: The District's written information security program address 6 of the 8 minimum safeguards identified in the related regulations. The District's policy did not include written documentation for the remaining two required minimum safeguards. Questioned costs: None Context: The District's written information security program is in process of continued review and updating. During the year under audit, the required safeguards were not fully updated in the written policies. Cause: The District's policy reviews for compliance with the noted requirements were not completed prior to the fiscal year. Effect: The District's polices and procedures may not comply with all applicable requirements. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District review and update as necessary the written information security program(s) to include aspects required by regulations. Views of responsible officials: There is no disagreement with the audit finding. While WCTC has implemented practices that ensure the safeguards are in place, the appropriate documentation had not yet been updated. WCTC has completed the recommended revisions as required by the standards.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The District is responsible for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The minimum safeguards include eight required written information security program. Condition: The District's written information security program address 6 of the 8 minimum safeguards identified in the related regulations. The District's policy did not include written documentation for the remaining two required minimum safeguards. Questioned costs: None Context: The District's written information security program is in process of continued review and updating. During the year under audit, the required safeguards were not fully updated in the written policies. Cause: The District's policy reviews for compliance with the noted requirements were not completed prior to the fiscal year. Effect: The District's polices and procedures may not comply with all applicable requirements. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District review and update as necessary the written information security program(s) to include aspects required by regulations. Views of responsible officials: There is no disagreement with the audit finding. While WCTC has implemented practices that ensure the safeguards are in place, the appropriate documentation had not yet been updated. WCTC has completed the recommended revisions as required by the standards.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The District is responsible for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The minimum safeguards include eight required written information security program. Condition: The District's written information security program address 6 of the 8 minimum safeguards identified in the related regulations. The District's policy did not include written documentation for the remaining two required minimum safeguards. Questioned costs: None Context: The District's written information security program is in process of continued review and updating. During the year under audit, the required safeguards were not fully updated in the written policies. Cause: The District's policy reviews for compliance with the noted requirements were not completed prior to the fiscal year. Effect: The District's polices and procedures may not comply with all applicable requirements. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District review and update as necessary the written information security program(s) to include aspects required by regulations. Views of responsible officials: There is no disagreement with the audit finding. While WCTC has implemented practices that ensure the safeguards are in place, the appropriate documentation had not yet been updated. WCTC has completed the recommended revisions as required by the standards.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The District is responsible for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The minimum safeguards include eight required written information security program. Condition: The District's written information security program address 6 of the 8 minimum safeguards identified in the related regulations. The District's policy did not include written documentation for the remaining two required minimum safeguards. Questioned costs: None Context: The District's written information security program is in process of continued review and updating. During the year under audit, the required safeguards were not fully updated in the written policies. Cause: The District's policy reviews for compliance with the noted requirements were not completed prior to the fiscal year. Effect: The District's polices and procedures may not comply with all applicable requirements. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District review and update as necessary the written information security program(s) to include aspects required by regulations. Views of responsible officials: There is no disagreement with the audit finding. While WCTC has implemented practices that ensure the safeguards are in place, the appropriate documentation had not yet been updated. WCTC has completed the recommended revisions as required by the standards.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The District is responsible for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The minimum safeguards include eight required written information security program. Condition: The District's written information security program address 6 of the 8 minimum safeguards identified in the related regulations. The District's policy did not include written documentation for the remaining two required minimum safeguards. Questioned costs: None Context: The District's written information security program is in process of continued review and updating. During the year under audit, the required safeguards were not fully updated in the written policies. Cause: The District's policy reviews for compliance with the noted requirements were not completed prior to the fiscal year. Effect: The District's polices and procedures may not comply with all applicable requirements. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District review and update as necessary the written information security program(s) to include aspects required by regulations. Views of responsible officials: There is no disagreement with the audit finding. While WCTC has implemented practices that ensure the safeguards are in place, the appropriate documentation had not yet been updated. WCTC has completed the recommended revisions as required by the standards.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Institutions must report student disbursement data to Common Organization and Disbursement (COD) system within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data (OMB N. 1845-0039). Condition: During testing we noted 2 instances of student disbursements were reported to COD more than 15 days after the date of disbursement. Questioned costs: None Context: A statistically valid sample of 40 student disbursement was selected for testing to ensure disbursements were reported to COD within 15 days of the date of disbursement. 2 of the selected payments were reported more than 15 days after the disbursement. Cause: Internal control process in effect at the time did not ensure that all disbursements were reported to COD with in the required 15-day time line. Effect: Some instances of student disbursements were not reported within the required timeline to COD. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District design and implement controls to ensure all student disbursements are reported to COD with in required timelines. Views of responsible officials: There is no disagreement with the audit finding. WCTC has added additional internal controls specific to the disbursement process in response to the audit. Implementing these various measures ensures timely COD disbursement reporting, including multi-layered file reviews and monthly reconciliations. These controls specifically targeted our audit findings, ensuring thorough file scrutiny and prompt rectification of discrepancies.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Institutions must report student disbursement data to Common Organization and Disbursement (COD) system within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data (OMB N. 1845-0039). Condition: During testing we noted 2 instances of student disbursements were reported to COD more than 15 days after the date of disbursement. Questioned costs: None Context: A statistically valid sample of 40 student disbursement was selected for testing to ensure disbursements were reported to COD within 15 days of the date of disbursement. 2 of the selected payments were reported more than 15 days after the disbursement. Cause: Internal control process in effect at the time did not ensure that all disbursements were reported to COD with in the required 15-day time line. Effect: Some instances of student disbursements were not reported within the required timeline to COD. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District design and implement controls to ensure all student disbursements are reported to COD with in required timelines. Views of responsible officials: There is no disagreement with the audit finding. WCTC has added additional internal controls specific to the disbursement process in response to the audit. Implementing these various measures ensures timely COD disbursement reporting, including multi-layered file reviews and monthly reconciliations. These controls specifically targeted our audit findings, ensuring thorough file scrutiny and prompt rectification of discrepancies.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Institutions must report student disbursement data to Common Organization and Disbursement (COD) system within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data (OMB N. 1845-0039). Condition: During testing we noted 2 instances of student disbursements were reported to COD more than 15 days after the date of disbursement. Questioned costs: None Context: A statistically valid sample of 40 student disbursement was selected for testing to ensure disbursements were reported to COD within 15 days of the date of disbursement. 2 of the selected payments were reported more than 15 days after the disbursement. Cause: Internal control process in effect at the time did not ensure that all disbursements were reported to COD with in the required 15-day time line. Effect: Some instances of student disbursements were not reported within the required timeline to COD. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District design and implement controls to ensure all student disbursements are reported to COD with in required timelines. Views of responsible officials: There is no disagreement with the audit finding. WCTC has added additional internal controls specific to the disbursement process in response to the audit. Implementing these various measures ensures timely COD disbursement reporting, including multi-layered file reviews and monthly reconciliations. These controls specifically targeted our audit findings, ensuring thorough file scrutiny and prompt rectification of discrepancies.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Institutions must report student disbursement data to Common Organization and Disbursement (COD) system within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data (OMB N. 1845-0039). Condition: During testing we noted 2 instances of student disbursements were reported to COD more than 15 days after the date of disbursement. Questioned costs: None Context: A statistically valid sample of 40 student disbursement was selected for testing to ensure disbursements were reported to COD within 15 days of the date of disbursement. 2 of the selected payments were reported more than 15 days after the disbursement. Cause: Internal control process in effect at the time did not ensure that all disbursements were reported to COD with in the required 15-day time line. Effect: Some instances of student disbursements were not reported within the required timeline to COD. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District design and implement controls to ensure all student disbursements are reported to COD with in required timelines. Views of responsible officials: There is no disagreement with the audit finding. WCTC has added additional internal controls specific to the disbursement process in response to the audit. Implementing these various measures ensures timely COD disbursement reporting, including multi-layered file reviews and monthly reconciliations. These controls specifically targeted our audit findings, ensuring thorough file scrutiny and prompt rectification of discrepancies.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Institutions must report student disbursement data to Common Organization and Disbursement (COD) system within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data (OMB N. 1845-0039). Condition: During testing we noted 2 instances of student disbursements were reported to COD more than 15 days after the date of disbursement. Questioned costs: None Context: A statistically valid sample of 40 student disbursement was selected for testing to ensure disbursements were reported to COD within 15 days of the date of disbursement. 2 of the selected payments were reported more than 15 days after the disbursement. Cause: Internal control process in effect at the time did not ensure that all disbursements were reported to COD with in the required 15-day time line. Effect: Some instances of student disbursements were not reported within the required timeline to COD. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District design and implement controls to ensure all student disbursements are reported to COD with in required timelines. Views of responsible officials: There is no disagreement with the audit finding. WCTC has added additional internal controls specific to the disbursement process in response to the audit. Implementing these various measures ensures timely COD disbursement reporting, including multi-layered file reviews and monthly reconciliations. These controls specifically targeted our audit findings, ensuring thorough file scrutiny and prompt rectification of discrepancies.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Institutions must report student disbursement data to Common Organization and Disbursement (COD) system within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data (OMB N. 1845-0039). Condition: During testing we noted 2 instances of student disbursements were reported to COD more than 15 days after the date of disbursement. Questioned costs: None Context: A statistically valid sample of 40 student disbursement was selected for testing to ensure disbursements were reported to COD within 15 days of the date of disbursement. 2 of the selected payments were reported more than 15 days after the disbursement. Cause: Internal control process in effect at the time did not ensure that all disbursements were reported to COD with in the required 15-day time line. Effect: Some instances of student disbursements were not reported within the required timeline to COD. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District design and implement controls to ensure all student disbursements are reported to COD with in required timelines. Views of responsible officials: There is no disagreement with the audit finding. WCTC has added additional internal controls specific to the disbursement process in response to the audit. Implementing these various measures ensures timely COD disbursement reporting, including multi-layered file reviews and monthly reconciliations. These controls specifically targeted our audit findings, ensuring thorough file scrutiny and prompt rectification of discrepancies.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Institutions must report student disbursement data to Common Organization and Disbursement (COD) system within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data (OMB N. 1845-0039). Condition: During testing we noted 2 instances of student disbursements were reported to COD more than 15 days after the date of disbursement. Questioned costs: None Context: A statistically valid sample of 40 student disbursement was selected for testing to ensure disbursements were reported to COD within 15 days of the date of disbursement. 2 of the selected payments were reported more than 15 days after the disbursement. Cause: Internal control process in effect at the time did not ensure that all disbursements were reported to COD with in the required 15-day time line. Effect: Some instances of student disbursements were not reported within the required timeline to COD. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District design and implement controls to ensure all student disbursements are reported to COD with in required timelines. Views of responsible officials: There is no disagreement with the audit finding. WCTC has added additional internal controls specific to the disbursement process in response to the audit. Implementing these various measures ensures timely COD disbursement reporting, including multi-layered file reviews and monthly reconciliations. These controls specifically targeted our audit findings, ensuring thorough file scrutiny and prompt rectification of discrepancies.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The District is responsible for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The minimum safeguards include eight required written information security program. Condition: The District's written information security program address 6 of the 8 minimum safeguards identified in the related regulations. The District's policy did not include written documentation for the remaining two required minimum safeguards. Questioned costs: None Context: The District's written information security program is in process of continued review and updating. During the year under audit, the required safeguards were not fully updated in the written policies. Cause: The District's policy reviews for compliance with the noted requirements were not completed prior to the fiscal year. Effect: The District's polices and procedures may not comply with all applicable requirements. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District review and update as necessary the written information security program(s) to include aspects required by regulations. Views of responsible officials: There is no disagreement with the audit finding. While WCTC has implemented practices that ensure the safeguards are in place, the appropriate documentation had not yet been updated. WCTC has completed the recommended revisions as required by the standards.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The District is responsible for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The minimum safeguards include eight required written information security program. Condition: The District's written information security program address 6 of the 8 minimum safeguards identified in the related regulations. The District's policy did not include written documentation for the remaining two required minimum safeguards. Questioned costs: None Context: The District's written information security program is in process of continued review and updating. During the year under audit, the required safeguards were not fully updated in the written policies. Cause: The District's policy reviews for compliance with the noted requirements were not completed prior to the fiscal year. Effect: The District's polices and procedures may not comply with all applicable requirements. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District review and update as necessary the written information security program(s) to include aspects required by regulations. Views of responsible officials: There is no disagreement with the audit finding. While WCTC has implemented practices that ensure the safeguards are in place, the appropriate documentation had not yet been updated. WCTC has completed the recommended revisions as required by the standards.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The District is responsible for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The minimum safeguards include eight required written information security program. Condition: The District's written information security program address 6 of the 8 minimum safeguards identified in the related regulations. The District's policy did not include written documentation for the remaining two required minimum safeguards. Questioned costs: None Context: The District's written information security program is in process of continued review and updating. During the year under audit, the required safeguards were not fully updated in the written policies. Cause: The District's policy reviews for compliance with the noted requirements were not completed prior to the fiscal year. Effect: The District's polices and procedures may not comply with all applicable requirements. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District review and update as necessary the written information security program(s) to include aspects required by regulations. Views of responsible officials: There is no disagreement with the audit finding. While WCTC has implemented practices that ensure the safeguards are in place, the appropriate documentation had not yet been updated. WCTC has completed the recommended revisions as required by the standards.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The District is responsible for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The minimum safeguards include eight required written information security program. Condition: The District's written information security program address 6 of the 8 minimum safeguards identified in the related regulations. The District's policy did not include written documentation for the remaining two required minimum safeguards. Questioned costs: None Context: The District's written information security program is in process of continued review and updating. During the year under audit, the required safeguards were not fully updated in the written policies. Cause: The District's policy reviews for compliance with the noted requirements were not completed prior to the fiscal year. Effect: The District's polices and procedures may not comply with all applicable requirements. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District review and update as necessary the written information security program(s) to include aspects required by regulations. Views of responsible officials: There is no disagreement with the audit finding. While WCTC has implemented practices that ensure the safeguards are in place, the appropriate documentation had not yet been updated. WCTC has completed the recommended revisions as required by the standards.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The District is responsible for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The minimum safeguards include eight required written information security program. Condition: The District's written information security program address 6 of the 8 minimum safeguards identified in the related regulations. The District's policy did not include written documentation for the remaining two required minimum safeguards. Questioned costs: None Context: The District's written information security program is in process of continued review and updating. During the year under audit, the required safeguards were not fully updated in the written policies. Cause: The District's policy reviews for compliance with the noted requirements were not completed prior to the fiscal year. Effect: The District's polices and procedures may not comply with all applicable requirements. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District review and update as necessary the written information security program(s) to include aspects required by regulations. Views of responsible officials: There is no disagreement with the audit finding. While WCTC has implemented practices that ensure the safeguards are in place, the appropriate documentation had not yet been updated. WCTC has completed the recommended revisions as required by the standards.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The District is responsible for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The minimum safeguards include eight required written information security program. Condition: The District's written information security program address 6 of the 8 minimum safeguards identified in the related regulations. The District's policy did not include written documentation for the remaining two required minimum safeguards. Questioned costs: None Context: The District's written information security program is in process of continued review and updating. During the year under audit, the required safeguards were not fully updated in the written policies. Cause: The District's policy reviews for compliance with the noted requirements were not completed prior to the fiscal year. Effect: The District's polices and procedures may not comply with all applicable requirements. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District review and update as necessary the written information security program(s) to include aspects required by regulations. Views of responsible officials: There is no disagreement with the audit finding. While WCTC has implemented practices that ensure the safeguards are in place, the appropriate documentation had not yet been updated. WCTC has completed the recommended revisions as required by the standards.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The District is responsible for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The minimum safeguards include eight required written information security program. Condition: The District's written information security program address 6 of the 8 minimum safeguards identified in the related regulations. The District's policy did not include written documentation for the remaining two required minimum safeguards. Questioned costs: None Context: The District's written information security program is in process of continued review and updating. During the year under audit, the required safeguards were not fully updated in the written policies. Cause: The District's policy reviews for compliance with the noted requirements were not completed prior to the fiscal year. Effect: The District's polices and procedures may not comply with all applicable requirements. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District review and update as necessary the written information security program(s) to include aspects required by regulations. Views of responsible officials: There is no disagreement with the audit finding. While WCTC has implemented practices that ensure the safeguards are in place, the appropriate documentation had not yet been updated. WCTC has completed the recommended revisions as required by the standards.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Institutions must report student disbursement data to Common Organization and Disbursement (COD) system within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data (OMB N. 1845-0039). Condition: During testing we noted 2 instances of student disbursements were reported to COD more than 15 days after the date of disbursement. Questioned costs: None Context: A statistically valid sample of 40 student disbursement was selected for testing to ensure disbursements were reported to COD within 15 days of the date of disbursement. 2 of the selected payments were reported more than 15 days after the disbursement. Cause: Internal control process in effect at the time did not ensure that all disbursements were reported to COD with in the required 15-day time line. Effect: Some instances of student disbursements were not reported within the required timeline to COD. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District design and implement controls to ensure all student disbursements are reported to COD with in required timelines. Views of responsible officials: There is no disagreement with the audit finding. WCTC has added additional internal controls specific to the disbursement process in response to the audit. Implementing these various measures ensures timely COD disbursement reporting, including multi-layered file reviews and monthly reconciliations. These controls specifically targeted our audit findings, ensuring thorough file scrutiny and prompt rectification of discrepancies.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Institutions must report student disbursement data to Common Organization and Disbursement (COD) system within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data (OMB N. 1845-0039). Condition: During testing we noted 2 instances of student disbursements were reported to COD more than 15 days after the date of disbursement. Questioned costs: None Context: A statistically valid sample of 40 student disbursement was selected for testing to ensure disbursements were reported to COD within 15 days of the date of disbursement. 2 of the selected payments were reported more than 15 days after the disbursement. Cause: Internal control process in effect at the time did not ensure that all disbursements were reported to COD with in the required 15-day time line. Effect: Some instances of student disbursements were not reported within the required timeline to COD. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District design and implement controls to ensure all student disbursements are reported to COD with in required timelines. Views of responsible officials: There is no disagreement with the audit finding. WCTC has added additional internal controls specific to the disbursement process in response to the audit. Implementing these various measures ensures timely COD disbursement reporting, including multi-layered file reviews and monthly reconciliations. These controls specifically targeted our audit findings, ensuring thorough file scrutiny and prompt rectification of discrepancies.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Institutions must report student disbursement data to Common Organization and Disbursement (COD) system within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data (OMB N. 1845-0039). Condition: During testing we noted 2 instances of student disbursements were reported to COD more than 15 days after the date of disbursement. Questioned costs: None Context: A statistically valid sample of 40 student disbursement was selected for testing to ensure disbursements were reported to COD within 15 days of the date of disbursement. 2 of the selected payments were reported more than 15 days after the disbursement. Cause: Internal control process in effect at the time did not ensure that all disbursements were reported to COD with in the required 15-day time line. Effect: Some instances of student disbursements were not reported within the required timeline to COD. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District design and implement controls to ensure all student disbursements are reported to COD with in required timelines. Views of responsible officials: There is no disagreement with the audit finding. WCTC has added additional internal controls specific to the disbursement process in response to the audit. Implementing these various measures ensures timely COD disbursement reporting, including multi-layered file reviews and monthly reconciliations. These controls specifically targeted our audit findings, ensuring thorough file scrutiny and prompt rectification of discrepancies.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Institutions must report student disbursement data to Common Organization and Disbursement (COD) system within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data (OMB N. 1845-0039). Condition: During testing we noted 2 instances of student disbursements were reported to COD more than 15 days after the date of disbursement. Questioned costs: None Context: A statistically valid sample of 40 student disbursement was selected for testing to ensure disbursements were reported to COD within 15 days of the date of disbursement. 2 of the selected payments were reported more than 15 days after the disbursement. Cause: Internal control process in effect at the time did not ensure that all disbursements were reported to COD with in the required 15-day time line. Effect: Some instances of student disbursements were not reported within the required timeline to COD. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District design and implement controls to ensure all student disbursements are reported to COD with in required timelines. Views of responsible officials: There is no disagreement with the audit finding. WCTC has added additional internal controls specific to the disbursement process in response to the audit. Implementing these various measures ensures timely COD disbursement reporting, including multi-layered file reviews and monthly reconciliations. These controls specifically targeted our audit findings, ensuring thorough file scrutiny and prompt rectification of discrepancies.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Institutions must report student disbursement data to Common Organization and Disbursement (COD) system within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data (OMB N. 1845-0039). Condition: During testing we noted 2 instances of student disbursements were reported to COD more than 15 days after the date of disbursement. Questioned costs: None Context: A statistically valid sample of 40 student disbursement was selected for testing to ensure disbursements were reported to COD within 15 days of the date of disbursement. 2 of the selected payments were reported more than 15 days after the disbursement. Cause: Internal control process in effect at the time did not ensure that all disbursements were reported to COD with in the required 15-day time line. Effect: Some instances of student disbursements were not reported within the required timeline to COD. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District design and implement controls to ensure all student disbursements are reported to COD with in required timelines. Views of responsible officials: There is no disagreement with the audit finding. WCTC has added additional internal controls specific to the disbursement process in response to the audit. Implementing these various measures ensures timely COD disbursement reporting, including multi-layered file reviews and monthly reconciliations. These controls specifically targeted our audit findings, ensuring thorough file scrutiny and prompt rectification of discrepancies.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Institutions must report student disbursement data to Common Organization and Disbursement (COD) system within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data (OMB N. 1845-0039). Condition: During testing we noted 2 instances of student disbursements were reported to COD more than 15 days after the date of disbursement. Questioned costs: None Context: A statistically valid sample of 40 student disbursement was selected for testing to ensure disbursements were reported to COD within 15 days of the date of disbursement. 2 of the selected payments were reported more than 15 days after the disbursement. Cause: Internal control process in effect at the time did not ensure that all disbursements were reported to COD with in the required 15-day time line. Effect: Some instances of student disbursements were not reported within the required timeline to COD. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District design and implement controls to ensure all student disbursements are reported to COD with in required timelines. Views of responsible officials: There is no disagreement with the audit finding. WCTC has added additional internal controls specific to the disbursement process in response to the audit. Implementing these various measures ensures timely COD disbursement reporting, including multi-layered file reviews and monthly reconciliations. These controls specifically targeted our audit findings, ensuring thorough file scrutiny and prompt rectification of discrepancies.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Institutions must report student disbursement data to Common Organization and Disbursement (COD) system within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data (OMB N. 1845-0039). Condition: During testing we noted 2 instances of student disbursements were reported to COD more than 15 days after the date of disbursement. Questioned costs: None Context: A statistically valid sample of 40 student disbursement was selected for testing to ensure disbursements were reported to COD within 15 days of the date of disbursement. 2 of the selected payments were reported more than 15 days after the disbursement. Cause: Internal control process in effect at the time did not ensure that all disbursements were reported to COD with in the required 15-day time line. Effect: Some instances of student disbursements were not reported within the required timeline to COD. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District design and implement controls to ensure all student disbursements are reported to COD with in required timelines. Views of responsible officials: There is no disagreement with the audit finding. WCTC has added additional internal controls specific to the disbursement process in response to the audit. Implementing these various measures ensures timely COD disbursement reporting, including multi-layered file reviews and monthly reconciliations. These controls specifically targeted our audit findings, ensuring thorough file scrutiny and prompt rectification of discrepancies.