Audit 299518

2023-001 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program. (16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University has a Written information Security Program; however, the University did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Context: These new GLBA requirements were applicable beginning on June 9, 2023, and there were certain required elements missing from the institution’s Written Information Security Program (WISP). Questioned costs: None. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: The University was not in Gramm-Leach-Bliley compliance standards. Repeat Finding: No. Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of responsible officials: Management agrees with the finding.

2023-001 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program. (16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University has a Written information Security Program; however, the University did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Context: These new GLBA requirements were applicable beginning on June 9, 2023, and there were certain required elements missing from the institution’s Written Information Security Program (WISP). Questioned costs: None. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: The University was not in Gramm-Leach-Bliley compliance standards. Repeat Finding: No. Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of responsible officials: Management agrees with the finding.

2023-001 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program. (16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University has a Written information Security Program; however, the University did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Context: These new GLBA requirements were applicable beginning on June 9, 2023, and there were certain required elements missing from the institution’s Written Information Security Program (WISP). Questioned costs: None. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: The University was not in Gramm-Leach-Bliley compliance standards. Repeat Finding: No. Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of responsible officials: Management agrees with the finding.

2023-001 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program. (16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University has a Written information Security Program; however, the University did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Context: These new GLBA requirements were applicable beginning on June 9, 2023, and there were certain required elements missing from the institution’s Written Information Security Program (WISP). Questioned costs: None. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: The University was not in Gramm-Leach-Bliley compliance standards. Repeat Finding: No. Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of responsible officials: Management agrees with the finding.

2023-001 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program. (16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University has a Written information Security Program; however, the University did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Context: These new GLBA requirements were applicable beginning on June 9, 2023, and there were certain required elements missing from the institution’s Written Information Security Program (WISP). Questioned costs: None. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: The University was not in Gramm-Leach-Bliley compliance standards. Repeat Finding: No. Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of responsible officials: Management agrees with the finding.

2023-001 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program. (16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University has a Written information Security Program; however, the University did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Context: These new GLBA requirements were applicable beginning on June 9, 2023, and there were certain required elements missing from the institution’s Written Information Security Program (WISP). Questioned costs: None. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: The University was not in Gramm-Leach-Bliley compliance standards. Repeat Finding: No. Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of responsible officials: Management agrees with the finding.

2023-002 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely report all disbursement dates and amounts to the COD system. Context: We identified 2 out of 40 COD disbursements tested that were not reported within the required 15 days to COD, these two instances were reported 7 days late. Questioned costs: None. Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat Finding: No. Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding.

2023-002 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely report all disbursement dates and amounts to the COD system. Context: We identified 2 out of 40 COD disbursements tested that were not reported within the required 15 days to COD, these two instances were reported 7 days late. Questioned costs: None. Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat Finding: No. Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding.

2023-002 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely report all disbursement dates and amounts to the COD system. Context: We identified 2 out of 40 COD disbursements tested that were not reported within the required 15 days to COD, these two instances were reported 7 days late. Questioned costs: None. Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat Finding: No. Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding.

2023-002 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely report all disbursement dates and amounts to the COD system. Context: We identified 2 out of 40 COD disbursements tested that were not reported within the required 15 days to COD, these two instances were reported 7 days late. Questioned costs: None. Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat Finding: No. Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding.

2023-002 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely report all disbursement dates and amounts to the COD system. Context: We identified 2 out of 40 COD disbursements tested that were not reported within the required 15 days to COD, these two instances were reported 7 days late. Questioned costs: None. Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat Finding: No. Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding.

2023-002 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely report all disbursement dates and amounts to the COD system. Context: We identified 2 out of 40 COD disbursements tested that were not reported within the required 15 days to COD, these two instances were reported 7 days late. Questioned costs: None. Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat Finding: No. Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding.

2023-003 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that Title IV credit balances must be paid to the student or parent no later than 14 days after the credit balance occurred. (34 CFR 164(h)(2)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely refund credit balances to the student or parent. Context: We identified 1 out of 40 students tested that was not refunded within the required 14 days, the credit balance was refunded 7 days late. Questioned costs: None. Cause: The Student Financial Aid office had an automated process to ensure all refunds were issued in 14 days failed to recognize a credit balance in a student's account. Effect: The student did not have access to Title IV funds timely after disbursement. Repeat Finding: No. Recommendation: We recommend that the student financial aid department develop a process to identify all credit balances are paid timely. Views of responsible officials: Management agrees with the finding.

2023-003 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that Title IV credit balances must be paid to the student or parent no later than 14 days after the credit balance occurred. (34 CFR 164(h)(2)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely refund credit balances to the student or parent. Context: We identified 1 out of 40 students tested that was not refunded within the required 14 days, the credit balance was refunded 7 days late. Questioned costs: None. Cause: The Student Financial Aid office had an automated process to ensure all refunds were issued in 14 days failed to recognize a credit balance in a student's account. Effect: The student did not have access to Title IV funds timely after disbursement. Repeat Finding: No. Recommendation: We recommend that the student financial aid department develop a process to identify all credit balances are paid timely. Views of responsible officials: Management agrees with the finding.

2023-003 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that Title IV credit balances must be paid to the student or parent no later than 14 days after the credit balance occurred. (34 CFR 164(h)(2)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely refund credit balances to the student or parent. Context: We identified 1 out of 40 students tested that was not refunded within the required 14 days, the credit balance was refunded 7 days late. Questioned costs: None. Cause: The Student Financial Aid office had an automated process to ensure all refunds were issued in 14 days failed to recognize a credit balance in a student's account. Effect: The student did not have access to Title IV funds timely after disbursement. Repeat Finding: No. Recommendation: We recommend that the student financial aid department develop a process to identify all credit balances are paid timely. Views of responsible officials: Management agrees with the finding.

2023-003 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that Title IV credit balances must be paid to the student or parent no later than 14 days after the credit balance occurred. (34 CFR 164(h)(2)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely refund credit balances to the student or parent. Context: We identified 1 out of 40 students tested that was not refunded within the required 14 days, the credit balance was refunded 7 days late. Questioned costs: None. Cause: The Student Financial Aid office had an automated process to ensure all refunds were issued in 14 days failed to recognize a credit balance in a student's account. Effect: The student did not have access to Title IV funds timely after disbursement. Repeat Finding: No. Recommendation: We recommend that the student financial aid department develop a process to identify all credit balances are paid timely. Views of responsible officials: Management agrees with the finding.

2023-003 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that Title IV credit balances must be paid to the student or parent no later than 14 days after the credit balance occurred. (34 CFR 164(h)(2)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely refund credit balances to the student or parent. Context: We identified 1 out of 40 students tested that was not refunded within the required 14 days, the credit balance was refunded 7 days late. Questioned costs: None. Cause: The Student Financial Aid office had an automated process to ensure all refunds were issued in 14 days failed to recognize a credit balance in a student's account. Effect: The student did not have access to Title IV funds timely after disbursement. Repeat Finding: No. Recommendation: We recommend that the student financial aid department develop a process to identify all credit balances are paid timely. Views of responsible officials: Management agrees with the finding.

2023-003 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that Title IV credit balances must be paid to the student or parent no later than 14 days after the credit balance occurred. (34 CFR 164(h)(2)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely refund credit balances to the student or parent. Context: We identified 1 out of 40 students tested that was not refunded within the required 14 days, the credit balance was refunded 7 days late. Questioned costs: None. Cause: The Student Financial Aid office had an automated process to ensure all refunds were issued in 14 days failed to recognize a credit balance in a student's account. Effect: The student did not have access to Title IV funds timely after disbursement. Repeat Finding: No. Recommendation: We recommend that the student financial aid department develop a process to identify all credit balances are paid timely. Views of responsible officials: Management agrees with the finding.

2023-004 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that the college provide to the Secretary an up-to-date Uniform Resource Locator (URL) for the contract for publication in a centralized database to the public. (34 CFR 668.164(f)(4)(iii)(B)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The college had the required information on their website but had not disclosed the URL to the Department of Education. Context: The college published the contract, assessed fees, and terms and conditions, however, they did not properly report the URL to Department of Education. Questioned costs: None. Cause: The contract is in its first year of operations, and the URL was not submitted within 60 days after award year. Effect: The college was not in compliance with Title IV third-party servicer compliance. Repeat Finding: No. Recommendation: We recommend the College implement policies and procedures to identify these requirements and timely report to the appropriate regulators. Views of responsible officials: Management agrees with the finding.

2023-004 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that the college provide to the Secretary an up-to-date Uniform Resource Locator (URL) for the contract for publication in a centralized database to the public. (34 CFR 668.164(f)(4)(iii)(B)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The college had the required information on their website but had not disclosed the URL to the Department of Education. Context: The college published the contract, assessed fees, and terms and conditions, however, they did not properly report the URL to Department of Education. Questioned costs: None. Cause: The contract is in its first year of operations, and the URL was not submitted within 60 days after award year. Effect: The college was not in compliance with Title IV third-party servicer compliance. Repeat Finding: No. Recommendation: We recommend the College implement policies and procedures to identify these requirements and timely report to the appropriate regulators. Views of responsible officials: Management agrees with the finding.

2023-004 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that the college provide to the Secretary an up-to-date Uniform Resource Locator (URL) for the contract for publication in a centralized database to the public. (34 CFR 668.164(f)(4)(iii)(B)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The college had the required information on their website but had not disclosed the URL to the Department of Education. Context: The college published the contract, assessed fees, and terms and conditions, however, they did not properly report the URL to Department of Education. Questioned costs: None. Cause: The contract is in its first year of operations, and the URL was not submitted within 60 days after award year. Effect: The college was not in compliance with Title IV third-party servicer compliance. Repeat Finding: No. Recommendation: We recommend the College implement policies and procedures to identify these requirements and timely report to the appropriate regulators. Views of responsible officials: Management agrees with the finding.

2023-004 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that the college provide to the Secretary an up-to-date Uniform Resource Locator (URL) for the contract for publication in a centralized database to the public. (34 CFR 668.164(f)(4)(iii)(B)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The college had the required information on their website but had not disclosed the URL to the Department of Education. Context: The college published the contract, assessed fees, and terms and conditions, however, they did not properly report the URL to Department of Education. Questioned costs: None. Cause: The contract is in its first year of operations, and the URL was not submitted within 60 days after award year. Effect: The college was not in compliance with Title IV third-party servicer compliance. Repeat Finding: No. Recommendation: We recommend the College implement policies and procedures to identify these requirements and timely report to the appropriate regulators. Views of responsible officials: Management agrees with the finding.

2023-004 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that the college provide to the Secretary an up-to-date Uniform Resource Locator (URL) for the contract for publication in a centralized database to the public. (34 CFR 668.164(f)(4)(iii)(B)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The college had the required information on their website but had not disclosed the URL to the Department of Education. Context: The college published the contract, assessed fees, and terms and conditions, however, they did not properly report the URL to Department of Education. Questioned costs: None. Cause: The contract is in its first year of operations, and the URL was not submitted within 60 days after award year. Effect: The college was not in compliance with Title IV third-party servicer compliance. Repeat Finding: No. Recommendation: We recommend the College implement policies and procedures to identify these requirements and timely report to the appropriate regulators. Views of responsible officials: Management agrees with the finding.

2023-004 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that the college provide to the Secretary an up-to-date Uniform Resource Locator (URL) for the contract for publication in a centralized database to the public. (34 CFR 668.164(f)(4)(iii)(B)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The college had the required information on their website but had not disclosed the URL to the Department of Education. Context: The college published the contract, assessed fees, and terms and conditions, however, they did not properly report the URL to Department of Education. Questioned costs: None. Cause: The contract is in its first year of operations, and the URL was not submitted within 60 days after award year. Effect: The college was not in compliance with Title IV third-party servicer compliance. Repeat Finding: No. Recommendation: We recommend the College implement policies and procedures to identify these requirements and timely report to the appropriate regulators. Views of responsible officials: Management agrees with the finding.

2023-005 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified 5 students that were reported past the 60-day reporting timeframe to NSLDS. These student enrollment dates were reported 12 days late. Questioned costs: None. Cause: The College didn't have proper procedures in place to verify students' status in NSLDS matched the institutions records in a timely manner. Effect: Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat Finding: No. Recommendation: We recommend the College review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely. Views of responsible officials: Management agrees with the finding.

2023-005 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified 5 students that were reported past the 60-day reporting timeframe to NSLDS. These student enrollment dates were reported 12 days late. Questioned costs: None. Cause: The College didn't have proper procedures in place to verify students' status in NSLDS matched the institutions records in a timely manner. Effect: Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat Finding: No. Recommendation: We recommend the College review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely. Views of responsible officials: Management agrees with the finding.

2023-005 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified 5 students that were reported past the 60-day reporting timeframe to NSLDS. These student enrollment dates were reported 12 days late. Questioned costs: None. Cause: The College didn't have proper procedures in place to verify students' status in NSLDS matched the institutions records in a timely manner. Effect: Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat Finding: No. Recommendation: We recommend the College review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely. Views of responsible officials: Management agrees with the finding.

2023-005 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified 5 students that were reported past the 60-day reporting timeframe to NSLDS. These student enrollment dates were reported 12 days late. Questioned costs: None. Cause: The College didn't have proper procedures in place to verify students' status in NSLDS matched the institutions records in a timely manner. Effect: Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat Finding: No. Recommendation: We recommend the College review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely. Views of responsible officials: Management agrees with the finding.

2023-005 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified 5 students that were reported past the 60-day reporting timeframe to NSLDS. These student enrollment dates were reported 12 days late. Questioned costs: None. Cause: The College didn't have proper procedures in place to verify students' status in NSLDS matched the institutions records in a timely manner. Effect: Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat Finding: No. Recommendation: We recommend the College review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely. Views of responsible officials: Management agrees with the finding.

2023-005 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified 5 students that were reported past the 60-day reporting timeframe to NSLDS. These student enrollment dates were reported 12 days late. Questioned costs: None. Cause: The College didn't have proper procedures in place to verify students' status in NSLDS matched the institutions records in a timely manner. Effect: Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat Finding: No. Recommendation: We recommend the College review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely. Views of responsible officials: Management agrees with the finding.

2023-001 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program. (16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University has a Written information Security Program; however, the University did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Context: These new GLBA requirements were applicable beginning on June 9, 2023, and there were certain required elements missing from the institution’s Written Information Security Program (WISP). Questioned costs: None. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: The University was not in Gramm-Leach-Bliley compliance standards. Repeat Finding: No. Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of responsible officials: Management agrees with the finding.

2023-001 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program. (16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University has a Written information Security Program; however, the University did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Context: These new GLBA requirements were applicable beginning on June 9, 2023, and there were certain required elements missing from the institution’s Written Information Security Program (WISP). Questioned costs: None. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: The University was not in Gramm-Leach-Bliley compliance standards. Repeat Finding: No. Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of responsible officials: Management agrees with the finding.

2023-001 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program. (16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University has a Written information Security Program; however, the University did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Context: These new GLBA requirements were applicable beginning on June 9, 2023, and there were certain required elements missing from the institution’s Written Information Security Program (WISP). Questioned costs: None. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: The University was not in Gramm-Leach-Bliley compliance standards. Repeat Finding: No. Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of responsible officials: Management agrees with the finding.

2023-001 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program. (16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University has a Written information Security Program; however, the University did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Context: These new GLBA requirements were applicable beginning on June 9, 2023, and there were certain required elements missing from the institution’s Written Information Security Program (WISP). Questioned costs: None. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: The University was not in Gramm-Leach-Bliley compliance standards. Repeat Finding: No. Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of responsible officials: Management agrees with the finding.

2023-001 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program. (16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University has a Written information Security Program; however, the University did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Context: These new GLBA requirements were applicable beginning on June 9, 2023, and there were certain required elements missing from the institution’s Written Information Security Program (WISP). Questioned costs: None. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: The University was not in Gramm-Leach-Bliley compliance standards. Repeat Finding: No. Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of responsible officials: Management agrees with the finding.

2023-001 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program. (16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University has a Written information Security Program; however, the University did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Context: These new GLBA requirements were applicable beginning on June 9, 2023, and there were certain required elements missing from the institution’s Written Information Security Program (WISP). Questioned costs: None. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: The University was not in Gramm-Leach-Bliley compliance standards. Repeat Finding: No. Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of responsible officials: Management agrees with the finding.

2023-002 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely report all disbursement dates and amounts to the COD system. Context: We identified 2 out of 40 COD disbursements tested that were not reported within the required 15 days to COD, these two instances were reported 7 days late. Questioned costs: None. Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat Finding: No. Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding.

2023-002 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely report all disbursement dates and amounts to the COD system. Context: We identified 2 out of 40 COD disbursements tested that were not reported within the required 15 days to COD, these two instances were reported 7 days late. Questioned costs: None. Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat Finding: No. Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding.

2023-002 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely report all disbursement dates and amounts to the COD system. Context: We identified 2 out of 40 COD disbursements tested that were not reported within the required 15 days to COD, these two instances were reported 7 days late. Questioned costs: None. Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat Finding: No. Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding.

2023-002 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely report all disbursement dates and amounts to the COD system. Context: We identified 2 out of 40 COD disbursements tested that were not reported within the required 15 days to COD, these two instances were reported 7 days late. Questioned costs: None. Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat Finding: No. Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding.

2023-002 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely report all disbursement dates and amounts to the COD system. Context: We identified 2 out of 40 COD disbursements tested that were not reported within the required 15 days to COD, these two instances were reported 7 days late. Questioned costs: None. Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat Finding: No. Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding.

2023-002 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely report all disbursement dates and amounts to the COD system. Context: We identified 2 out of 40 COD disbursements tested that were not reported within the required 15 days to COD, these two instances were reported 7 days late. Questioned costs: None. Cause: The Student Financial Aid Office does not have a process in place to ensure all disbursements are reported within 15 days to COD. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be misstated due to the discrepancy in disbursement dates reported. Repeat Finding: No. Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Views of responsible officials: Management agrees with the finding.

2023-003 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that Title IV credit balances must be paid to the student or parent no later than 14 days after the credit balance occurred. (34 CFR 164(h)(2)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely refund credit balances to the student or parent. Context: We identified 1 out of 40 students tested that was not refunded within the required 14 days, the credit balance was refunded 7 days late. Questioned costs: None. Cause: The Student Financial Aid office had an automated process to ensure all refunds were issued in 14 days failed to recognize a credit balance in a student's account. Effect: The student did not have access to Title IV funds timely after disbursement. Repeat Finding: No. Recommendation: We recommend that the student financial aid department develop a process to identify all credit balances are paid timely. Views of responsible officials: Management agrees with the finding.

2023-003 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that Title IV credit balances must be paid to the student or parent no later than 14 days after the credit balance occurred. (34 CFR 164(h)(2)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely refund credit balances to the student or parent. Context: We identified 1 out of 40 students tested that was not refunded within the required 14 days, the credit balance was refunded 7 days late. Questioned costs: None. Cause: The Student Financial Aid office had an automated process to ensure all refunds were issued in 14 days failed to recognize a credit balance in a student's account. Effect: The student did not have access to Title IV funds timely after disbursement. Repeat Finding: No. Recommendation: We recommend that the student financial aid department develop a process to identify all credit balances are paid timely. Views of responsible officials: Management agrees with the finding.

2023-003 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that Title IV credit balances must be paid to the student or parent no later than 14 days after the credit balance occurred. (34 CFR 164(h)(2)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely refund credit balances to the student or parent. Context: We identified 1 out of 40 students tested that was not refunded within the required 14 days, the credit balance was refunded 7 days late. Questioned costs: None. Cause: The Student Financial Aid office had an automated process to ensure all refunds were issued in 14 days failed to recognize a credit balance in a student's account. Effect: The student did not have access to Title IV funds timely after disbursement. Repeat Finding: No. Recommendation: We recommend that the student financial aid department develop a process to identify all credit balances are paid timely. Views of responsible officials: Management agrees with the finding.

2023-003 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that Title IV credit balances must be paid to the student or parent no later than 14 days after the credit balance occurred. (34 CFR 164(h)(2)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely refund credit balances to the student or parent. Context: We identified 1 out of 40 students tested that was not refunded within the required 14 days, the credit balance was refunded 7 days late. Questioned costs: None. Cause: The Student Financial Aid office had an automated process to ensure all refunds were issued in 14 days failed to recognize a credit balance in a student's account. Effect: The student did not have access to Title IV funds timely after disbursement. Repeat Finding: No. Recommendation: We recommend that the student financial aid department develop a process to identify all credit balances are paid timely. Views of responsible officials: Management agrees with the finding.

2023-003 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that Title IV credit balances must be paid to the student or parent no later than 14 days after the credit balance occurred. (34 CFR 164(h)(2)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely refund credit balances to the student or parent. Context: We identified 1 out of 40 students tested that was not refunded within the required 14 days, the credit balance was refunded 7 days late. Questioned costs: None. Cause: The Student Financial Aid office had an automated process to ensure all refunds were issued in 14 days failed to recognize a credit balance in a student's account. Effect: The student did not have access to Title IV funds timely after disbursement. Repeat Finding: No. Recommendation: We recommend that the student financial aid department develop a process to identify all credit balances are paid timely. Views of responsible officials: Management agrees with the finding.

2023-003 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that Title IV credit balances must be paid to the student or parent no later than 14 days after the credit balance occurred. (34 CFR 164(h)(2)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not timely refund credit balances to the student or parent. Context: We identified 1 out of 40 students tested that was not refunded within the required 14 days, the credit balance was refunded 7 days late. Questioned costs: None. Cause: The Student Financial Aid office had an automated process to ensure all refunds were issued in 14 days failed to recognize a credit balance in a student's account. Effect: The student did not have access to Title IV funds timely after disbursement. Repeat Finding: No. Recommendation: We recommend that the student financial aid department develop a process to identify all credit balances are paid timely. Views of responsible officials: Management agrees with the finding.

2023-004 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that the college provide to the Secretary an up-to-date Uniform Resource Locator (URL) for the contract for publication in a centralized database to the public. (34 CFR 668.164(f)(4)(iii)(B)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The college had the required information on their website but had not disclosed the URL to the Department of Education. Context: The college published the contract, assessed fees, and terms and conditions, however, they did not properly report the URL to Department of Education. Questioned costs: None. Cause: The contract is in its first year of operations, and the URL was not submitted within 60 days after award year. Effect: The college was not in compliance with Title IV third-party servicer compliance. Repeat Finding: No. Recommendation: We recommend the College implement policies and procedures to identify these requirements and timely report to the appropriate regulators. Views of responsible officials: Management agrees with the finding.

2023-004 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that the college provide to the Secretary an up-to-date Uniform Resource Locator (URL) for the contract for publication in a centralized database to the public. (34 CFR 668.164(f)(4)(iii)(B)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The college had the required information on their website but had not disclosed the URL to the Department of Education. Context: The college published the contract, assessed fees, and terms and conditions, however, they did not properly report the URL to Department of Education. Questioned costs: None. Cause: The contract is in its first year of operations, and the URL was not submitted within 60 days after award year. Effect: The college was not in compliance with Title IV third-party servicer compliance. Repeat Finding: No. Recommendation: We recommend the College implement policies and procedures to identify these requirements and timely report to the appropriate regulators. Views of responsible officials: Management agrees with the finding.

2023-004 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that the college provide to the Secretary an up-to-date Uniform Resource Locator (URL) for the contract for publication in a centralized database to the public. (34 CFR 668.164(f)(4)(iii)(B)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The college had the required information on their website but had not disclosed the URL to the Department of Education. Context: The college published the contract, assessed fees, and terms and conditions, however, they did not properly report the URL to Department of Education. Questioned costs: None. Cause: The contract is in its first year of operations, and the URL was not submitted within 60 days after award year. Effect: The college was not in compliance with Title IV third-party servicer compliance. Repeat Finding: No. Recommendation: We recommend the College implement policies and procedures to identify these requirements and timely report to the appropriate regulators. Views of responsible officials: Management agrees with the finding.

2023-004 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that the college provide to the Secretary an up-to-date Uniform Resource Locator (URL) for the contract for publication in a centralized database to the public. (34 CFR 668.164(f)(4)(iii)(B)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The college had the required information on their website but had not disclosed the URL to the Department of Education. Context: The college published the contract, assessed fees, and terms and conditions, however, they did not properly report the URL to Department of Education. Questioned costs: None. Cause: The contract is in its first year of operations, and the URL was not submitted within 60 days after award year. Effect: The college was not in compliance with Title IV third-party servicer compliance. Repeat Finding: No. Recommendation: We recommend the College implement policies and procedures to identify these requirements and timely report to the appropriate regulators. Views of responsible officials: Management agrees with the finding.

2023-004 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that the college provide to the Secretary an up-to-date Uniform Resource Locator (URL) for the contract for publication in a centralized database to the public. (34 CFR 668.164(f)(4)(iii)(B)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The college had the required information on their website but had not disclosed the URL to the Department of Education. Context: The college published the contract, assessed fees, and terms and conditions, however, they did not properly report the URL to Department of Education. Questioned costs: None. Cause: The contract is in its first year of operations, and the URL was not submitted within 60 days after award year. Effect: The college was not in compliance with Title IV third-party servicer compliance. Repeat Finding: No. Recommendation: We recommend the College implement policies and procedures to identify these requirements and timely report to the appropriate regulators. Views of responsible officials: Management agrees with the finding.

2023-004 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires that the college provide to the Secretary an up-to-date Uniform Resource Locator (URL) for the contract for publication in a centralized database to the public. (34 CFR 668.164(f)(4)(iii)(B)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The college had the required information on their website but had not disclosed the URL to the Department of Education. Context: The college published the contract, assessed fees, and terms and conditions, however, they did not properly report the URL to Department of Education. Questioned costs: None. Cause: The contract is in its first year of operations, and the URL was not submitted within 60 days after award year. Effect: The college was not in compliance with Title IV third-party servicer compliance. Repeat Finding: No. Recommendation: We recommend the College implement policies and procedures to identify these requirements and timely report to the appropriate regulators. Views of responsible officials: Management agrees with the finding.

2023-005 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified 5 students that were reported past the 60-day reporting timeframe to NSLDS. These student enrollment dates were reported 12 days late. Questioned costs: None. Cause: The College didn't have proper procedures in place to verify students' status in NSLDS matched the institutions records in a timely manner. Effect: Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat Finding: No. Recommendation: We recommend the College review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely. Views of responsible officials: Management agrees with the finding.

2023-005 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified 5 students that were reported past the 60-day reporting timeframe to NSLDS. These student enrollment dates were reported 12 days late. Questioned costs: None. Cause: The College didn't have proper procedures in place to verify students' status in NSLDS matched the institutions records in a timely manner. Effect: Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat Finding: No. Recommendation: We recommend the College review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely. Views of responsible officials: Management agrees with the finding.

2023-005 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified 5 students that were reported past the 60-day reporting timeframe to NSLDS. These student enrollment dates were reported 12 days late. Questioned costs: None. Cause: The College didn't have proper procedures in place to verify students' status in NSLDS matched the institutions records in a timely manner. Effect: Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat Finding: No. Recommendation: We recommend the College review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely. Views of responsible officials: Management agrees with the finding.

2023-005 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified 5 students that were reported past the 60-day reporting timeframe to NSLDS. These student enrollment dates were reported 12 days late. Questioned costs: None. Cause: The College didn't have proper procedures in place to verify students' status in NSLDS matched the institutions records in a timely manner. Effect: Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat Finding: No. Recommendation: We recommend the College review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely. Views of responsible officials: Management agrees with the finding.

2023-005 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified 5 students that were reported past the 60-day reporting timeframe to NSLDS. These student enrollment dates were reported 12 days late. Questioned costs: None. Cause: The College didn't have proper procedures in place to verify students' status in NSLDS matched the institutions records in a timely manner. Effect: Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat Finding: No. Recommendation: We recommend the College review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely. Views of responsible officials: Management agrees with the finding.

2023-005 Special Tests and Provisions Federal agency: U.S Department of Education Federal program title: Student Financial Assistance Cluster Assistant Listing Number: 84.007/84.033/84.063/84.268 Federal Award Identification Number: P007A221105 - P033A221105 - P063P221336 - P268K231336 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Compliance, Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified 5 students that were reported past the 60-day reporting timeframe to NSLDS. These student enrollment dates were reported 12 days late. Questioned costs: None. Cause: The College didn't have proper procedures in place to verify students' status in NSLDS matched the institutions records in a timely manner. Effect: Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat Finding: No. Recommendation: We recommend the College review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely. Views of responsible officials: Management agrees with the finding.