Audit 298705

2023–002: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

2023-003: NSLDS Enrollment Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Assistance Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 2 instances where the student's enrollment status was not certified within 60 days, 5 instances where the effective date of a student status change was improperly reported at the program-level and campus-level record, and 2 instances where the student status was incorrectly reported. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: No Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

2023–004: 14 Day Credit Balances Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(e) states, "Whenever an institution disburses title IV, HEA program funds by crediting a student's account and the total amount of all title IV, HEA program funds credited exceeds the amount of tuition and fees, room and board, and other authorized charges the institution assessed the student, the institution must pay the resulting credit balance directly to the student or parent as soon as possible but— (1) No later than 14 days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (2) No later than 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition/Context: Through our testing of 18 students whose accounts had a credit balance resulting from federal funds during the year, we noted that 6 students did not have the credit balance refunded within the 14-day period. Questioned Costs: None Cause: The refunds for the students in question were not completed within the 14-day period for one of the following reasons – (1) the payment file was created timely but had an error that needed correction and caused payment delay and/or (2) payment was on or around a holiday and the University’s accounts payable personnel were out of office. Effect: The University did not refund students within 14 days for credit balances that arose from federal funds as required by U.S. Department of Education regulations. Repeat Finding: No Recommendation: We recommend that the University put a process in place to refund student credit balances that arose from federal funds within 14 days. We also recommend that postings to student accounts of institutional charges for each payment period be posted and dated prior to disbursing federal funds to limit the number of refund checks. Views of responsible officials: Please refer to the attached corrective action plan.

2023–002: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

2023-003: NSLDS Enrollment Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Assistance Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 2 instances where the student's enrollment status was not certified within 60 days, 5 instances where the effective date of a student status change was improperly reported at the program-level and campus-level record, and 2 instances where the student status was incorrectly reported. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: No Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

2023–004: 14 Day Credit Balances Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(e) states, "Whenever an institution disburses title IV, HEA program funds by crediting a student's account and the total amount of all title IV, HEA program funds credited exceeds the amount of tuition and fees, room and board, and other authorized charges the institution assessed the student, the institution must pay the resulting credit balance directly to the student or parent as soon as possible but— (1) No later than 14 days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (2) No later than 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition/Context: Through our testing of 18 students whose accounts had a credit balance resulting from federal funds during the year, we noted that 6 students did not have the credit balance refunded within the 14-day period. Questioned Costs: None Cause: The refunds for the students in question were not completed within the 14-day period for one of the following reasons – (1) the payment file was created timely but had an error that needed correction and caused payment delay and/or (2) payment was on or around a holiday and the University’s accounts payable personnel were out of office. Effect: The University did not refund students within 14 days for credit balances that arose from federal funds as required by U.S. Department of Education regulations. Repeat Finding: No Recommendation: We recommend that the University put a process in place to refund student credit balances that arose from federal funds within 14 days. We also recommend that postings to student accounts of institutional charges for each payment period be posted and dated prior to disbursing federal funds to limit the number of refund checks. Views of responsible officials: Please refer to the attached corrective action plan.

2023–005: Over-Award of Financial Aid Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Number: 84.268 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.203(a) outline the maximum subsidized loan amounts for students based on their dependency status, year of education, and other factors. Condition/Context: During our testing, we noted 1 instance out of 25 students tested where the subsidized Stafford loan awarded to the student was over the maximum amount they were eligible for. Questioned Costs: $1,000 Cause: The University did not appropriately determine the student's level of education when awarding the Subsidized Stafford Loan. Effect: Those students that were over-awarded subsidized loans were awarded incorrectly as they were not eligible for the specific awarded amount. Repeat Finding: No Recommendation: We recommend the University evaluate its procedures and a policy around how level of education is determined and verified when packaging and awarding students. Views of responsible officials: Please refer to the attached corrective action plan.

2023–002: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

2023-003: NSLDS Enrollment Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Assistance Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 2 instances where the student's enrollment status was not certified within 60 days, 5 instances where the effective date of a student status change was improperly reported at the program-level and campus-level record, and 2 instances where the student status was incorrectly reported. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: No Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

2023–004: 14 Day Credit Balances Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(e) states, "Whenever an institution disburses title IV, HEA program funds by crediting a student's account and the total amount of all title IV, HEA program funds credited exceeds the amount of tuition and fees, room and board, and other authorized charges the institution assessed the student, the institution must pay the resulting credit balance directly to the student or parent as soon as possible but— (1) No later than 14 days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (2) No later than 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition/Context: Through our testing of 18 students whose accounts had a credit balance resulting from federal funds during the year, we noted that 6 students did not have the credit balance refunded within the 14-day period. Questioned Costs: None Cause: The refunds for the students in question were not completed within the 14-day period for one of the following reasons – (1) the payment file was created timely but had an error that needed correction and caused payment delay and/or (2) payment was on or around a holiday and the University’s accounts payable personnel were out of office. Effect: The University did not refund students within 14 days for credit balances that arose from federal funds as required by U.S. Department of Education regulations. Repeat Finding: No Recommendation: We recommend that the University put a process in place to refund student credit balances that arose from federal funds within 14 days. We also recommend that postings to student accounts of institutional charges for each payment period be posted and dated prior to disbursing federal funds to limit the number of refund checks. Views of responsible officials: Please refer to the attached corrective action plan.

2023–002: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

2023-003: NSLDS Enrollment Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Assistance Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 2 instances where the student's enrollment status was not certified within 60 days, 5 instances where the effective date of a student status change was improperly reported at the program-level and campus-level record, and 2 instances where the student status was incorrectly reported. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: No Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

2023–004: 14 Day Credit Balances Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(e) states, "Whenever an institution disburses title IV, HEA program funds by crediting a student's account and the total amount of all title IV, HEA program funds credited exceeds the amount of tuition and fees, room and board, and other authorized charges the institution assessed the student, the institution must pay the resulting credit balance directly to the student or parent as soon as possible but— (1) No later than 14 days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (2) No later than 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition/Context: Through our testing of 18 students whose accounts had a credit balance resulting from federal funds during the year, we noted that 6 students did not have the credit balance refunded within the 14-day period. Questioned Costs: None Cause: The refunds for the students in question were not completed within the 14-day period for one of the following reasons – (1) the payment file was created timely but had an error that needed correction and caused payment delay and/or (2) payment was on or around a holiday and the University’s accounts payable personnel were out of office. Effect: The University did not refund students within 14 days for credit balances that arose from federal funds as required by U.S. Department of Education regulations. Repeat Finding: No Recommendation: We recommend that the University put a process in place to refund student credit balances that arose from federal funds within 14 days. We also recommend that postings to student accounts of institutional charges for each payment period be posted and dated prior to disbursing federal funds to limit the number of refund checks. Views of responsible officials: Please refer to the attached corrective action plan.

2023–002: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

2023-003: NSLDS Enrollment Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Assistance Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 2 instances where the student's enrollment status was not certified within 60 days, 5 instances where the effective date of a student status change was improperly reported at the program-level and campus-level record, and 2 instances where the student status was incorrectly reported. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: No Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

2023–004: 14 Day Credit Balances Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(e) states, "Whenever an institution disburses title IV, HEA program funds by crediting a student's account and the total amount of all title IV, HEA program funds credited exceeds the amount of tuition and fees, room and board, and other authorized charges the institution assessed the student, the institution must pay the resulting credit balance directly to the student or parent as soon as possible but— (1) No later than 14 days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (2) No later than 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition/Context: Through our testing of 18 students whose accounts had a credit balance resulting from federal funds during the year, we noted that 6 students did not have the credit balance refunded within the 14-day period. Questioned Costs: None Cause: The refunds for the students in question were not completed within the 14-day period for one of the following reasons – (1) the payment file was created timely but had an error that needed correction and caused payment delay and/or (2) payment was on or around a holiday and the University’s accounts payable personnel were out of office. Effect: The University did not refund students within 14 days for credit balances that arose from federal funds as required by U.S. Department of Education regulations. Repeat Finding: No Recommendation: We recommend that the University put a process in place to refund student credit balances that arose from federal funds within 14 days. We also recommend that postings to student accounts of institutional charges for each payment period be posted and dated prior to disbursing federal funds to limit the number of refund checks. Views of responsible officials: Please refer to the attached corrective action plan.

2023–002: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

2023-003: NSLDS Enrollment Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Assistance Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 2 instances where the student's enrollment status was not certified within 60 days, 5 instances where the effective date of a student status change was improperly reported at the program-level and campus-level record, and 2 instances where the student status was incorrectly reported. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: No Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

2023–004: 14 Day Credit Balances Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(e) states, "Whenever an institution disburses title IV, HEA program funds by crediting a student's account and the total amount of all title IV, HEA program funds credited exceeds the amount of tuition and fees, room and board, and other authorized charges the institution assessed the student, the institution must pay the resulting credit balance directly to the student or parent as soon as possible but— (1) No later than 14 days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (2) No later than 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition/Context: Through our testing of 18 students whose accounts had a credit balance resulting from federal funds during the year, we noted that 6 students did not have the credit balance refunded within the 14-day period. Questioned Costs: None Cause: The refunds for the students in question were not completed within the 14-day period for one of the following reasons – (1) the payment file was created timely but had an error that needed correction and caused payment delay and/or (2) payment was on or around a holiday and the University’s accounts payable personnel were out of office. Effect: The University did not refund students within 14 days for credit balances that arose from federal funds as required by U.S. Department of Education regulations. Repeat Finding: No Recommendation: We recommend that the University put a process in place to refund student credit balances that arose from federal funds within 14 days. We also recommend that postings to student accounts of institutional charges for each payment period be posted and dated prior to disbursing federal funds to limit the number of refund checks. Views of responsible officials: Please refer to the attached corrective action plan.

2023–002: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

2023-003: NSLDS Enrollment Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Assistance Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 2 instances where the student's enrollment status was not certified within 60 days, 5 instances where the effective date of a student status change was improperly reported at the program-level and campus-level record, and 2 instances where the student status was incorrectly reported. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: No Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

2023–004: 14 Day Credit Balances Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(e) states, "Whenever an institution disburses title IV, HEA program funds by crediting a student's account and the total amount of all title IV, HEA program funds credited exceeds the amount of tuition and fees, room and board, and other authorized charges the institution assessed the student, the institution must pay the resulting credit balance directly to the student or parent as soon as possible but— (1) No later than 14 days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (2) No later than 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition/Context: Through our testing of 18 students whose accounts had a credit balance resulting from federal funds during the year, we noted that 6 students did not have the credit balance refunded within the 14-day period. Questioned Costs: None Cause: The refunds for the students in question were not completed within the 14-day period for one of the following reasons – (1) the payment file was created timely but had an error that needed correction and caused payment delay and/or (2) payment was on or around a holiday and the University’s accounts payable personnel were out of office. Effect: The University did not refund students within 14 days for credit balances that arose from federal funds as required by U.S. Department of Education regulations. Repeat Finding: No Recommendation: We recommend that the University put a process in place to refund student credit balances that arose from federal funds within 14 days. We also recommend that postings to student accounts of institutional charges for each payment period be posted and dated prior to disbursing federal funds to limit the number of refund checks. Views of responsible officials: Please refer to the attached corrective action plan.

2023–005: Over-Award of Financial Aid Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Number: 84.268 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.203(a) outline the maximum subsidized loan amounts for students based on their dependency status, year of education, and other factors. Condition/Context: During our testing, we noted 1 instance out of 25 students tested where the subsidized Stafford loan awarded to the student was over the maximum amount they were eligible for. Questioned Costs: $1,000 Cause: The University did not appropriately determine the student's level of education when awarding the Subsidized Stafford Loan. Effect: Those students that were over-awarded subsidized loans were awarded incorrectly as they were not eligible for the specific awarded amount. Repeat Finding: No Recommendation: We recommend the University evaluate its procedures and a policy around how level of education is determined and verified when packaging and awarding students. Views of responsible officials: Please refer to the attached corrective action plan.

2023–002: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

2023-003: NSLDS Enrollment Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Assistance Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 2 instances where the student's enrollment status was not certified within 60 days, 5 instances where the effective date of a student status change was improperly reported at the program-level and campus-level record, and 2 instances where the student status was incorrectly reported. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: No Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

2023–004: 14 Day Credit Balances Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(e) states, "Whenever an institution disburses title IV, HEA program funds by crediting a student's account and the total amount of all title IV, HEA program funds credited exceeds the amount of tuition and fees, room and board, and other authorized charges the institution assessed the student, the institution must pay the resulting credit balance directly to the student or parent as soon as possible but— (1) No later than 14 days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (2) No later than 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition/Context: Through our testing of 18 students whose accounts had a credit balance resulting from federal funds during the year, we noted that 6 students did not have the credit balance refunded within the 14-day period. Questioned Costs: None Cause: The refunds for the students in question were not completed within the 14-day period for one of the following reasons – (1) the payment file was created timely but had an error that needed correction and caused payment delay and/or (2) payment was on or around a holiday and the University’s accounts payable personnel were out of office. Effect: The University did not refund students within 14 days for credit balances that arose from federal funds as required by U.S. Department of Education regulations. Repeat Finding: No Recommendation: We recommend that the University put a process in place to refund student credit balances that arose from federal funds within 14 days. We also recommend that postings to student accounts of institutional charges for each payment period be posted and dated prior to disbursing federal funds to limit the number of refund checks. Views of responsible officials: Please refer to the attached corrective action plan.

2023–002: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

2023-003: NSLDS Enrollment Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Assistance Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 2 instances where the student's enrollment status was not certified within 60 days, 5 instances where the effective date of a student status change was improperly reported at the program-level and campus-level record, and 2 instances where the student status was incorrectly reported. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: No Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

2023–004: 14 Day Credit Balances Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(e) states, "Whenever an institution disburses title IV, HEA program funds by crediting a student's account and the total amount of all title IV, HEA program funds credited exceeds the amount of tuition and fees, room and board, and other authorized charges the institution assessed the student, the institution must pay the resulting credit balance directly to the student or parent as soon as possible but— (1) No later than 14 days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (2) No later than 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition/Context: Through our testing of 18 students whose accounts had a credit balance resulting from federal funds during the year, we noted that 6 students did not have the credit balance refunded within the 14-day period. Questioned Costs: None Cause: The refunds for the students in question were not completed within the 14-day period for one of the following reasons – (1) the payment file was created timely but had an error that needed correction and caused payment delay and/or (2) payment was on or around a holiday and the University’s accounts payable personnel were out of office. Effect: The University did not refund students within 14 days for credit balances that arose from federal funds as required by U.S. Department of Education regulations. Repeat Finding: No Recommendation: We recommend that the University put a process in place to refund student credit balances that arose from federal funds within 14 days. We also recommend that postings to student accounts of institutional charges for each payment period be posted and dated prior to disbursing federal funds to limit the number of refund checks. Views of responsible officials: Please refer to the attached corrective action plan.

2023–002: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

2023-003: NSLDS Enrollment Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Assistance Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 2 instances where the student's enrollment status was not certified within 60 days, 5 instances where the effective date of a student status change was improperly reported at the program-level and campus-level record, and 2 instances where the student status was incorrectly reported. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: No Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

2023–004: 14 Day Credit Balances Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.268, 84.033, 84.038, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(e) states, "Whenever an institution disburses title IV, HEA program funds by crediting a student's account and the total amount of all title IV, HEA program funds credited exceeds the amount of tuition and fees, room and board, and other authorized charges the institution assessed the student, the institution must pay the resulting credit balance directly to the student or parent as soon as possible but— (1) No later than 14 days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (2) No later than 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition/Context: Through our testing of 18 students whose accounts had a credit balance resulting from federal funds during the year, we noted that 6 students did not have the credit balance refunded within the 14-day period. Questioned Costs: None Cause: The refunds for the students in question were not completed within the 14-day period for one of the following reasons – (1) the payment file was created timely but had an error that needed correction and caused payment delay and/or (2) payment was on or around a holiday and the University’s accounts payable personnel were out of office. Effect: The University did not refund students within 14 days for credit balances that arose from federal funds as required by U.S. Department of Education regulations. Repeat Finding: No Recommendation: We recommend that the University put a process in place to refund student credit balances that arose from federal funds within 14 days. We also recommend that postings to student accounts of institutional charges for each payment period be posted and dated prior to disbursing federal funds to limit the number of refund checks. Views of responsible officials: Please refer to the attached corrective action plan.