Audit 301881

2023–002: Outstanding Checks Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(l)(3) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing of Title IV checks, we noted refunds of Title IV financial aid outstanding more than 240 days. Questioned costs: $129 Context: During our testing, we noted 2 Title IV refund checks not returned to the Department of Education within 240 days. Cause: Due to management turnover and lack of following policies and procedures, these checks were missed being escheated back to the Department of Education. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department of Education. Repeat Finding: No Recommendation: We recommend the College review its policies and procedures related to Title IV outstanding checks to ensure they are being returned to the Department of Education after 240 days. Views of responsible officials: There is no disagreement with the finding.

2023–002: Outstanding Checks Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(l)(3) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing of Title IV checks, we noted refunds of Title IV financial aid outstanding more than 240 days. Questioned costs: $129 Context: During our testing, we noted 2 Title IV refund checks not returned to the Department of Education within 240 days. Cause: Due to management turnover and lack of following policies and procedures, these checks were missed being escheated back to the Department of Education. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department of Education. Repeat Finding: No Recommendation: We recommend the College review its policies and procedures related to Title IV outstanding checks to ensure they are being returned to the Department of Education after 240 days. Views of responsible officials: There is no disagreement with the finding.

2023–002: Outstanding Checks Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(l)(3) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing of Title IV checks, we noted refunds of Title IV financial aid outstanding more than 240 days. Questioned costs: $129 Context: During our testing, we noted 2 Title IV refund checks not returned to the Department of Education within 240 days. Cause: Due to management turnover and lack of following policies and procedures, these checks were missed being escheated back to the Department of Education. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department of Education. Repeat Finding: No Recommendation: We recommend the College review its policies and procedures related to Title IV outstanding checks to ensure they are being returned to the Department of Education after 240 days. Views of responsible officials: There is no disagreement with the finding.

2023–002: Outstanding Checks Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(l)(3) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing of Title IV checks, we noted refunds of Title IV financial aid outstanding more than 240 days. Questioned costs: $129 Context: During our testing, we noted 2 Title IV refund checks not returned to the Department of Education within 240 days. Cause: Due to management turnover and lack of following policies and procedures, these checks were missed being escheated back to the Department of Education. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department of Education. Repeat Finding: No Recommendation: We recommend the College review its policies and procedures related to Title IV outstanding checks to ensure they are being returned to the Department of Education after 240 days. Views of responsible officials: There is no disagreement with the finding.

2023–002: Outstanding Checks Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(l)(3) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing of Title IV checks, we noted refunds of Title IV financial aid outstanding more than 240 days. Questioned costs: $129 Context: During our testing, we noted 2 Title IV refund checks not returned to the Department of Education within 240 days. Cause: Due to management turnover and lack of following policies and procedures, these checks were missed being escheated back to the Department of Education. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department of Education. Repeat Finding: No Recommendation: We recommend the College review its policies and procedures related to Title IV outstanding checks to ensure they are being returned to the Department of Education after 240 days. Views of responsible officials: There is no disagreement with the finding.

2023–003: Common Origination and Disbursement (COD) Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.268, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Department of Education requires the College to report the disbursement dates and amounts to the COD system within 15 days of disbursing Pell (34 CFR 690.83(b)(2)) and Direct Loan (34 CFR 685.309) funds to a student. Condition: During our testing of 40 disbursements, we noted 4 disbursements that were not reported to COD in a timely manner. Questioned costs: None. Context: Disbursements were not reported to COD within the required 15 days. Cause: Due to turnover, management did not ensure disbursements were reported to COD within prescribed timeframes. Effect: The College is not in compliance with the Department of Education regulations. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and policies around reporting to the COD to ensure that student information is reported timely. Views of responsible officials: There is no disagreement with the finding.

2023–003: Common Origination and Disbursement (COD) Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.268, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Department of Education requires the College to report the disbursement dates and amounts to the COD system within 15 days of disbursing Pell (34 CFR 690.83(b)(2)) and Direct Loan (34 CFR 685.309) funds to a student. Condition: During our testing of 40 disbursements, we noted 4 disbursements that were not reported to COD in a timely manner. Questioned costs: None. Context: Disbursements were not reported to COD within the required 15 days. Cause: Due to turnover, management did not ensure disbursements were reported to COD within prescribed timeframes. Effect: The College is not in compliance with the Department of Education regulations. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and policies around reporting to the COD to ensure that student information is reported timely. Views of responsible officials: There is no disagreement with the finding.

2023–004: Exit Counseling Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.268 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.304 require entrance counseling be performed before disbursing loan funds to the student for Direct Subsidized Loan, Direct Unsubsidized Loan and Direct PLUS Loan to a graduate or professional student. The regulations also require exit counseling for all students who cease at least half-time study at the school. Condition: During our testing, it was noted that individuals did not receive exit counseling after their departure from the College. Questioned costs: None. Context: 3 out of 40 students tested did not receive exit counseling within the required 30 days of a student ceasing attendance. Cause: The College did not follow its policies and procedures to ensure students who departed the College received direct loan exit counseling. Effect: Students are not receiving the proper loan counseling which may contribute to a higher default rate. Repeat Finding: No Recommendation: We recommend the College review its policies and procedures around sending exit counseling information to students to ensure students are receiving proper counseling. Views of responsible officials: There is no disagreement with the finding.

2023–005: Return of Title IV (R2T4) Calculations Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 34 CFR 668.22(a)(1), when a recipient of Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the recipient began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date. Condition: During our testing, it was noted that R2T4 calculations were not completed for 2 students. Questioned costs: None. Context: 2 out of 7 students tested should have had a R2T4 calculation completed upon withdrawing from the College. Cause: The College followed their procedures but the report that identifies students who withdrew did not include these students. Effect: Funds are not being returned to the Department of Education. Repeat Finding: No Recommendation: We recommend reviewing the report that is run to identify withdrawn students to understand why these students were not included, as well as implement a compensating control to ensure future students are not missed. Views of responsible officials: There is no disagreement with the finding.

2023–005: Return of Title IV (R2T4) Calculations Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 34 CFR 668.22(a)(1), when a recipient of Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the recipient began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date. Condition: During our testing, it was noted that R2T4 calculations were not completed for 2 students. Questioned costs: None. Context: 2 out of 7 students tested should have had a R2T4 calculation completed upon withdrawing from the College. Cause: The College followed their procedures but the report that identifies students who withdrew did not include these students. Effect: Funds are not being returned to the Department of Education. Repeat Finding: No Recommendation: We recommend reviewing the report that is run to identify withdrawn students to understand why these students were not included, as well as implement a compensating control to ensure future students are not missed. Views of responsible officials: There is no disagreement with the finding.

2023–005: Return of Title IV (R2T4) Calculations Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 34 CFR 668.22(a)(1), when a recipient of Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the recipient began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date. Condition: During our testing, it was noted that R2T4 calculations were not completed for 2 students. Questioned costs: None. Context: 2 out of 7 students tested should have had a R2T4 calculation completed upon withdrawing from the College. Cause: The College followed their procedures but the report that identifies students who withdrew did not include these students. Effect: Funds are not being returned to the Department of Education. Repeat Finding: No Recommendation: We recommend reviewing the report that is run to identify withdrawn students to understand why these students were not included, as well as implement a compensating control to ensure future students are not missed. Views of responsible officials: There is no disagreement with the finding.

2023–005: Return of Title IV (R2T4) Calculations Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 34 CFR 668.22(a)(1), when a recipient of Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the recipient began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date. Condition: During our testing, it was noted that R2T4 calculations were not completed for 2 students. Questioned costs: None. Context: 2 out of 7 students tested should have had a R2T4 calculation completed upon withdrawing from the College. Cause: The College followed their procedures but the report that identifies students who withdrew did not include these students. Effect: Funds are not being returned to the Department of Education. Repeat Finding: No Recommendation: We recommend reviewing the report that is run to identify withdrawn students to understand why these students were not included, as well as implement a compensating control to ensure future students are not missed. Views of responsible officials: There is no disagreement with the finding.

2023–006: National Student Loan Database System (NSLDS) Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.063, 84.268 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Per U.S. Department of Education (ED) regulations, all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a roster file. The school is required to report enrollment status at both the school and program level. The school is required to report changes in the student’s enrollment status, the effective date of the status and an anticipated completion date. An academic program is defined as the combination of the school’s Office of Postsecondary Education Identification (OPEID) number and the program’s Classification of Instructional Program (CIP) code, credential level, and published program length. ED requires the College to report changes in enrollment status and indicate the date that the changes occurred (34 CFR 685.309). Condition: Certain students’ enrollment information was not reported accurately to the NSLDS. Questioned costs: None. Context: 7 out of 28 students tested were reported with the incorrect effective date on the program-level in NSLDS. Cause: The College's student information system was pulling the effective dates incorrectly for the reports sent to the third-party servicer who report to the NSLDS for which are used for the program-level of the NSLDS. Effect: Inaccurate reporting to the NSLDS can result in incorrect determination of when the students’ grace period should begin. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and review regulations set by the Department of Education around NSLDS to ensure the College understands the definitions for each enrollment information that gets reported. Views of responsible officials: There is no disagreement with the finding.

2023–006: National Student Loan Database System (NSLDS) Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.063, 84.268 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Per U.S. Department of Education (ED) regulations, all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a roster file. The school is required to report enrollment status at both the school and program level. The school is required to report changes in the student’s enrollment status, the effective date of the status and an anticipated completion date. An academic program is defined as the combination of the school’s Office of Postsecondary Education Identification (OPEID) number and the program’s Classification of Instructional Program (CIP) code, credential level, and published program length. ED requires the College to report changes in enrollment status and indicate the date that the changes occurred (34 CFR 685.309). Condition: Certain students’ enrollment information was not reported accurately to the NSLDS. Questioned costs: None. Context: 7 out of 28 students tested were reported with the incorrect effective date on the program-level in NSLDS. Cause: The College's student information system was pulling the effective dates incorrectly for the reports sent to the third-party servicer who report to the NSLDS for which are used for the program-level of the NSLDS. Effect: Inaccurate reporting to the NSLDS can result in incorrect determination of when the students’ grace period should begin. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and review regulations set by the Department of Education around NSLDS to ensure the College understands the definitions for each enrollment information that gets reported. Views of responsible officials: There is no disagreement with the finding.

2023–007: Return of Title IV (R2T4) Returning of Funds Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 34 CFR 668.22(j)(1), An institution must return the amount of title IV funds for which it is responsible to return as soon as possible but no later than 45 days after the date of the institution's determination that the student withdrew. Condition: Funds were not returned to the Department of Education within 45 days of the College determining the withdrawal. Questioned costs: None. Context: During our testing of R2T4, 1 student out of 7 tested did not have the funds returned to the Department of Education within 45 days. Cause: Due to turnover, management did not ensure funds were returned through the Common Origination and Disbursement (COD) system in the required timeframe. Effect: The College is not in compliance with the Department of Education regulations. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and policies around reporting to the COD to ensure that student information is reported timely. Views of responsible officials: There is no disagreement with the finding.

2023–007: Return of Title IV (R2T4) Returning of Funds Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 34 CFR 668.22(j)(1), An institution must return the amount of title IV funds for which it is responsible to return as soon as possible but no later than 45 days after the date of the institution's determination that the student withdrew. Condition: Funds were not returned to the Department of Education within 45 days of the College determining the withdrawal. Questioned costs: None. Context: During our testing of R2T4, 1 student out of 7 tested did not have the funds returned to the Department of Education within 45 days. Cause: Due to turnover, management did not ensure funds were returned through the Common Origination and Disbursement (COD) system in the required timeframe. Effect: The College is not in compliance with the Department of Education regulations. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and policies around reporting to the COD to ensure that student information is reported timely. Views of responsible officials: There is no disagreement with the finding.

2023–007: Return of Title IV (R2T4) Returning of Funds Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 34 CFR 668.22(j)(1), An institution must return the amount of title IV funds for which it is responsible to return as soon as possible but no later than 45 days after the date of the institution's determination that the student withdrew. Condition: Funds were not returned to the Department of Education within 45 days of the College determining the withdrawal. Questioned costs: None. Context: During our testing of R2T4, 1 student out of 7 tested did not have the funds returned to the Department of Education within 45 days. Cause: Due to turnover, management did not ensure funds were returned through the Common Origination and Disbursement (COD) system in the required timeframe. Effect: The College is not in compliance with the Department of Education regulations. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and policies around reporting to the COD to ensure that student information is reported timely. Views of responsible officials: There is no disagreement with the finding.

2023–007: Return of Title IV (R2T4) Returning of Funds Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 34 CFR 668.22(j)(1), An institution must return the amount of title IV funds for which it is responsible to return as soon as possible but no later than 45 days after the date of the institution's determination that the student withdrew. Condition: Funds were not returned to the Department of Education within 45 days of the College determining the withdrawal. Questioned costs: None. Context: During our testing of R2T4, 1 student out of 7 tested did not have the funds returned to the Department of Education within 45 days. Cause: Due to turnover, management did not ensure funds were returned through the Common Origination and Disbursement (COD) system in the required timeframe. Effect: The College is not in compliance with the Department of Education regulations. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and policies around reporting to the COD to ensure that student information is reported timely. Views of responsible officials: There is no disagreement with the finding.

2023–008: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College had not developed and implemented an approved written information security program. Cause: The College did not develop and implement a written information security program as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: The College should develop and implement an approved written information security program and verify there is a risk management section that describes how the College is identifying, assessing and communicating risks. In addition, there should be a description on the evaluation of safeguard sufficiency in mitigating risks. The information security program should also include the following: • IT Security Policy • Acceptable Use Policy • Incident Response Policy • Data Classification Policies • Vendor Management Policy • Patch Management Policy • Data Disposal Policy • Risk Assessment Policy • Logical Access and User Access Review Policies • Evidence of Review by CIO/CISO and responsibility of program Views of responsible officials: There is no disagreement with the finding.

2023–008: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College had not developed and implemented an approved written information security program. Cause: The College did not develop and implement a written information security program as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: The College should develop and implement an approved written information security program and verify there is a risk management section that describes how the College is identifying, assessing and communicating risks. In addition, there should be a description on the evaluation of safeguard sufficiency in mitigating risks. The information security program should also include the following: • IT Security Policy • Acceptable Use Policy • Incident Response Policy • Data Classification Policies • Vendor Management Policy • Patch Management Policy • Data Disposal Policy • Risk Assessment Policy • Logical Access and User Access Review Policies • Evidence of Review by CIO/CISO and responsibility of program Views of responsible officials: There is no disagreement with the finding.

2023–008: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College had not developed and implemented an approved written information security program. Cause: The College did not develop and implement a written information security program as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: The College should develop and implement an approved written information security program and verify there is a risk management section that describes how the College is identifying, assessing and communicating risks. In addition, there should be a description on the evaluation of safeguard sufficiency in mitigating risks. The information security program should also include the following: • IT Security Policy • Acceptable Use Policy • Incident Response Policy • Data Classification Policies • Vendor Management Policy • Patch Management Policy • Data Disposal Policy • Risk Assessment Policy • Logical Access and User Access Review Policies • Evidence of Review by CIO/CISO and responsibility of program Views of responsible officials: There is no disagreement with the finding.

2023–008: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College had not developed and implemented an approved written information security program. Cause: The College did not develop and implement a written information security program as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: The College should develop and implement an approved written information security program and verify there is a risk management section that describes how the College is identifying, assessing and communicating risks. In addition, there should be a description on the evaluation of safeguard sufficiency in mitigating risks. The information security program should also include the following: • IT Security Policy • Acceptable Use Policy • Incident Response Policy • Data Classification Policies • Vendor Management Policy • Patch Management Policy • Data Disposal Policy • Risk Assessment Policy • Logical Access and User Access Review Policies • Evidence of Review by CIO/CISO and responsibility of program Views of responsible officials: There is no disagreement with the finding.

2023–008: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College had not developed and implemented an approved written information security program. Cause: The College did not develop and implement a written information security program as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: The College should develop and implement an approved written information security program and verify there is a risk management section that describes how the College is identifying, assessing and communicating risks. In addition, there should be a description on the evaluation of safeguard sufficiency in mitigating risks. The information security program should also include the following: • IT Security Policy • Acceptable Use Policy • Incident Response Policy • Data Classification Policies • Vendor Management Policy • Patch Management Policy • Data Disposal Policy • Risk Assessment Policy • Logical Access and User Access Review Policies • Evidence of Review by CIO/CISO and responsibility of program Views of responsible officials: There is no disagreement with the finding.

2023–008: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College had not developed and implemented an approved written information security program. Cause: The College did not develop and implement a written information security program as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: The College should develop and implement an approved written information security program and verify there is a risk management section that describes how the College is identifying, assessing and communicating risks. In addition, there should be a description on the evaluation of safeguard sufficiency in mitigating risks. The information security program should also include the following: • IT Security Policy • Acceptable Use Policy • Incident Response Policy • Data Classification Policies • Vendor Management Policy • Patch Management Policy • Data Disposal Policy • Risk Assessment Policy • Logical Access and User Access Review Policies • Evidence of Review by CIO/CISO and responsibility of program Views of responsible officials: There is no disagreement with the finding.

2023–002: Outstanding Checks Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(l)(3) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing of Title IV checks, we noted refunds of Title IV financial aid outstanding more than 240 days. Questioned costs: $129 Context: During our testing, we noted 2 Title IV refund checks not returned to the Department of Education within 240 days. Cause: Due to management turnover and lack of following policies and procedures, these checks were missed being escheated back to the Department of Education. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department of Education. Repeat Finding: No Recommendation: We recommend the College review its policies and procedures related to Title IV outstanding checks to ensure they are being returned to the Department of Education after 240 days. Views of responsible officials: There is no disagreement with the finding.

2023–002: Outstanding Checks Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(l)(3) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing of Title IV checks, we noted refunds of Title IV financial aid outstanding more than 240 days. Questioned costs: $129 Context: During our testing, we noted 2 Title IV refund checks not returned to the Department of Education within 240 days. Cause: Due to management turnover and lack of following policies and procedures, these checks were missed being escheated back to the Department of Education. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department of Education. Repeat Finding: No Recommendation: We recommend the College review its policies and procedures related to Title IV outstanding checks to ensure they are being returned to the Department of Education after 240 days. Views of responsible officials: There is no disagreement with the finding.

2023–002: Outstanding Checks Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(l)(3) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing of Title IV checks, we noted refunds of Title IV financial aid outstanding more than 240 days. Questioned costs: $129 Context: During our testing, we noted 2 Title IV refund checks not returned to the Department of Education within 240 days. Cause: Due to management turnover and lack of following policies and procedures, these checks were missed being escheated back to the Department of Education. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department of Education. Repeat Finding: No Recommendation: We recommend the College review its policies and procedures related to Title IV outstanding checks to ensure they are being returned to the Department of Education after 240 days. Views of responsible officials: There is no disagreement with the finding.

2023–002: Outstanding Checks Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(l)(3) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing of Title IV checks, we noted refunds of Title IV financial aid outstanding more than 240 days. Questioned costs: $129 Context: During our testing, we noted 2 Title IV refund checks not returned to the Department of Education within 240 days. Cause: Due to management turnover and lack of following policies and procedures, these checks were missed being escheated back to the Department of Education. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department of Education. Repeat Finding: No Recommendation: We recommend the College review its policies and procedures related to Title IV outstanding checks to ensure they are being returned to the Department of Education after 240 days. Views of responsible officials: There is no disagreement with the finding.

2023–002: Outstanding Checks Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(l)(3) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing of Title IV checks, we noted refunds of Title IV financial aid outstanding more than 240 days. Questioned costs: $129 Context: During our testing, we noted 2 Title IV refund checks not returned to the Department of Education within 240 days. Cause: Due to management turnover and lack of following policies and procedures, these checks were missed being escheated back to the Department of Education. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department of Education. Repeat Finding: No Recommendation: We recommend the College review its policies and procedures related to Title IV outstanding checks to ensure they are being returned to the Department of Education after 240 days. Views of responsible officials: There is no disagreement with the finding.

2023–003: Common Origination and Disbursement (COD) Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.268, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Department of Education requires the College to report the disbursement dates and amounts to the COD system within 15 days of disbursing Pell (34 CFR 690.83(b)(2)) and Direct Loan (34 CFR 685.309) funds to a student. Condition: During our testing of 40 disbursements, we noted 4 disbursements that were not reported to COD in a timely manner. Questioned costs: None. Context: Disbursements were not reported to COD within the required 15 days. Cause: Due to turnover, management did not ensure disbursements were reported to COD within prescribed timeframes. Effect: The College is not in compliance with the Department of Education regulations. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and policies around reporting to the COD to ensure that student information is reported timely. Views of responsible officials: There is no disagreement with the finding.

2023–003: Common Origination and Disbursement (COD) Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.268, 84.063 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Department of Education requires the College to report the disbursement dates and amounts to the COD system within 15 days of disbursing Pell (34 CFR 690.83(b)(2)) and Direct Loan (34 CFR 685.309) funds to a student. Condition: During our testing of 40 disbursements, we noted 4 disbursements that were not reported to COD in a timely manner. Questioned costs: None. Context: Disbursements were not reported to COD within the required 15 days. Cause: Due to turnover, management did not ensure disbursements were reported to COD within prescribed timeframes. Effect: The College is not in compliance with the Department of Education regulations. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and policies around reporting to the COD to ensure that student information is reported timely. Views of responsible officials: There is no disagreement with the finding.

2023–004: Exit Counseling Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.268 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.304 require entrance counseling be performed before disbursing loan funds to the student for Direct Subsidized Loan, Direct Unsubsidized Loan and Direct PLUS Loan to a graduate or professional student. The regulations also require exit counseling for all students who cease at least half-time study at the school. Condition: During our testing, it was noted that individuals did not receive exit counseling after their departure from the College. Questioned costs: None. Context: 3 out of 40 students tested did not receive exit counseling within the required 30 days of a student ceasing attendance. Cause: The College did not follow its policies and procedures to ensure students who departed the College received direct loan exit counseling. Effect: Students are not receiving the proper loan counseling which may contribute to a higher default rate. Repeat Finding: No Recommendation: We recommend the College review its policies and procedures around sending exit counseling information to students to ensure students are receiving proper counseling. Views of responsible officials: There is no disagreement with the finding.

2023–005: Return of Title IV (R2T4) Calculations Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 34 CFR 668.22(a)(1), when a recipient of Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the recipient began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date. Condition: During our testing, it was noted that R2T4 calculations were not completed for 2 students. Questioned costs: None. Context: 2 out of 7 students tested should have had a R2T4 calculation completed upon withdrawing from the College. Cause: The College followed their procedures but the report that identifies students who withdrew did not include these students. Effect: Funds are not being returned to the Department of Education. Repeat Finding: No Recommendation: We recommend reviewing the report that is run to identify withdrawn students to understand why these students were not included, as well as implement a compensating control to ensure future students are not missed. Views of responsible officials: There is no disagreement with the finding.

2023–005: Return of Title IV (R2T4) Calculations Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 34 CFR 668.22(a)(1), when a recipient of Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the recipient began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date. Condition: During our testing, it was noted that R2T4 calculations were not completed for 2 students. Questioned costs: None. Context: 2 out of 7 students tested should have had a R2T4 calculation completed upon withdrawing from the College. Cause: The College followed their procedures but the report that identifies students who withdrew did not include these students. Effect: Funds are not being returned to the Department of Education. Repeat Finding: No Recommendation: We recommend reviewing the report that is run to identify withdrawn students to understand why these students were not included, as well as implement a compensating control to ensure future students are not missed. Views of responsible officials: There is no disagreement with the finding.

2023–005: Return of Title IV (R2T4) Calculations Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 34 CFR 668.22(a)(1), when a recipient of Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the recipient began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date. Condition: During our testing, it was noted that R2T4 calculations were not completed for 2 students. Questioned costs: None. Context: 2 out of 7 students tested should have had a R2T4 calculation completed upon withdrawing from the College. Cause: The College followed their procedures but the report that identifies students who withdrew did not include these students. Effect: Funds are not being returned to the Department of Education. Repeat Finding: No Recommendation: We recommend reviewing the report that is run to identify withdrawn students to understand why these students were not included, as well as implement a compensating control to ensure future students are not missed. Views of responsible officials: There is no disagreement with the finding.

2023–005: Return of Title IV (R2T4) Calculations Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 34 CFR 668.22(a)(1), when a recipient of Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the recipient began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date. Condition: During our testing, it was noted that R2T4 calculations were not completed for 2 students. Questioned costs: None. Context: 2 out of 7 students tested should have had a R2T4 calculation completed upon withdrawing from the College. Cause: The College followed their procedures but the report that identifies students who withdrew did not include these students. Effect: Funds are not being returned to the Department of Education. Repeat Finding: No Recommendation: We recommend reviewing the report that is run to identify withdrawn students to understand why these students were not included, as well as implement a compensating control to ensure future students are not missed. Views of responsible officials: There is no disagreement with the finding.

2023–006: National Student Loan Database System (NSLDS) Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.063, 84.268 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Per U.S. Department of Education (ED) regulations, all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a roster file. The school is required to report enrollment status at both the school and program level. The school is required to report changes in the student’s enrollment status, the effective date of the status and an anticipated completion date. An academic program is defined as the combination of the school’s Office of Postsecondary Education Identification (OPEID) number and the program’s Classification of Instructional Program (CIP) code, credential level, and published program length. ED requires the College to report changes in enrollment status and indicate the date that the changes occurred (34 CFR 685.309). Condition: Certain students’ enrollment information was not reported accurately to the NSLDS. Questioned costs: None. Context: 7 out of 28 students tested were reported with the incorrect effective date on the program-level in NSLDS. Cause: The College's student information system was pulling the effective dates incorrectly for the reports sent to the third-party servicer who report to the NSLDS for which are used for the program-level of the NSLDS. Effect: Inaccurate reporting to the NSLDS can result in incorrect determination of when the students’ grace period should begin. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and review regulations set by the Department of Education around NSLDS to ensure the College understands the definitions for each enrollment information that gets reported. Views of responsible officials: There is no disagreement with the finding.

2023–006: National Student Loan Database System (NSLDS) Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.063, 84.268 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Per U.S. Department of Education (ED) regulations, all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a roster file. The school is required to report enrollment status at both the school and program level. The school is required to report changes in the student’s enrollment status, the effective date of the status and an anticipated completion date. An academic program is defined as the combination of the school’s Office of Postsecondary Education Identification (OPEID) number and the program’s Classification of Instructional Program (CIP) code, credential level, and published program length. ED requires the College to report changes in enrollment status and indicate the date that the changes occurred (34 CFR 685.309). Condition: Certain students’ enrollment information was not reported accurately to the NSLDS. Questioned costs: None. Context: 7 out of 28 students tested were reported with the incorrect effective date on the program-level in NSLDS. Cause: The College's student information system was pulling the effective dates incorrectly for the reports sent to the third-party servicer who report to the NSLDS for which are used for the program-level of the NSLDS. Effect: Inaccurate reporting to the NSLDS can result in incorrect determination of when the students’ grace period should begin. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and review regulations set by the Department of Education around NSLDS to ensure the College understands the definitions for each enrollment information that gets reported. Views of responsible officials: There is no disagreement with the finding.

2023–007: Return of Title IV (R2T4) Returning of Funds Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 34 CFR 668.22(j)(1), An institution must return the amount of title IV funds for which it is responsible to return as soon as possible but no later than 45 days after the date of the institution's determination that the student withdrew. Condition: Funds were not returned to the Department of Education within 45 days of the College determining the withdrawal. Questioned costs: None. Context: During our testing of R2T4, 1 student out of 7 tested did not have the funds returned to the Department of Education within 45 days. Cause: Due to turnover, management did not ensure funds were returned through the Common Origination and Disbursement (COD) system in the required timeframe. Effect: The College is not in compliance with the Department of Education regulations. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and policies around reporting to the COD to ensure that student information is reported timely. Views of responsible officials: There is no disagreement with the finding.

2023–007: Return of Title IV (R2T4) Returning of Funds Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 34 CFR 668.22(j)(1), An institution must return the amount of title IV funds for which it is responsible to return as soon as possible but no later than 45 days after the date of the institution's determination that the student withdrew. Condition: Funds were not returned to the Department of Education within 45 days of the College determining the withdrawal. Questioned costs: None. Context: During our testing of R2T4, 1 student out of 7 tested did not have the funds returned to the Department of Education within 45 days. Cause: Due to turnover, management did not ensure funds were returned through the Common Origination and Disbursement (COD) system in the required timeframe. Effect: The College is not in compliance with the Department of Education regulations. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and policies around reporting to the COD to ensure that student information is reported timely. Views of responsible officials: There is no disagreement with the finding.

2023–007: Return of Title IV (R2T4) Returning of Funds Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 34 CFR 668.22(j)(1), An institution must return the amount of title IV funds for which it is responsible to return as soon as possible but no later than 45 days after the date of the institution's determination that the student withdrew. Condition: Funds were not returned to the Department of Education within 45 days of the College determining the withdrawal. Questioned costs: None. Context: During our testing of R2T4, 1 student out of 7 tested did not have the funds returned to the Department of Education within 45 days. Cause: Due to turnover, management did not ensure funds were returned through the Common Origination and Disbursement (COD) system in the required timeframe. Effect: The College is not in compliance with the Department of Education regulations. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and policies around reporting to the COD to ensure that student information is reported timely. Views of responsible officials: There is no disagreement with the finding.

2023–007: Return of Title IV (R2T4) Returning of Funds Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: In accordance with 34 CFR 668.22(j)(1), An institution must return the amount of title IV funds for which it is responsible to return as soon as possible but no later than 45 days after the date of the institution's determination that the student withdrew. Condition: Funds were not returned to the Department of Education within 45 days of the College determining the withdrawal. Questioned costs: None. Context: During our testing of R2T4, 1 student out of 7 tested did not have the funds returned to the Department of Education within 45 days. Cause: Due to turnover, management did not ensure funds were returned through the Common Origination and Disbursement (COD) system in the required timeframe. Effect: The College is not in compliance with the Department of Education regulations. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and policies around reporting to the COD to ensure that student information is reported timely. Views of responsible officials: There is no disagreement with the finding.

2023–008: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College had not developed and implemented an approved written information security program. Cause: The College did not develop and implement a written information security program as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: The College should develop and implement an approved written information security program and verify there is a risk management section that describes how the College is identifying, assessing and communicating risks. In addition, there should be a description on the evaluation of safeguard sufficiency in mitigating risks. The information security program should also include the following: • IT Security Policy • Acceptable Use Policy • Incident Response Policy • Data Classification Policies • Vendor Management Policy • Patch Management Policy • Data Disposal Policy • Risk Assessment Policy • Logical Access and User Access Review Policies • Evidence of Review by CIO/CISO and responsibility of program Views of responsible officials: There is no disagreement with the finding.

2023–008: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College had not developed and implemented an approved written information security program. Cause: The College did not develop and implement a written information security program as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: The College should develop and implement an approved written information security program and verify there is a risk management section that describes how the College is identifying, assessing and communicating risks. In addition, there should be a description on the evaluation of safeguard sufficiency in mitigating risks. The information security program should also include the following: • IT Security Policy • Acceptable Use Policy • Incident Response Policy • Data Classification Policies • Vendor Management Policy • Patch Management Policy • Data Disposal Policy • Risk Assessment Policy • Logical Access and User Access Review Policies • Evidence of Review by CIO/CISO and responsibility of program Views of responsible officials: There is no disagreement with the finding.

2023–008: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College had not developed and implemented an approved written information security program. Cause: The College did not develop and implement a written information security program as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: The College should develop and implement an approved written information security program and verify there is a risk management section that describes how the College is identifying, assessing and communicating risks. In addition, there should be a description on the evaluation of safeguard sufficiency in mitigating risks. The information security program should also include the following: • IT Security Policy • Acceptable Use Policy • Incident Response Policy • Data Classification Policies • Vendor Management Policy • Patch Management Policy • Data Disposal Policy • Risk Assessment Policy • Logical Access and User Access Review Policies • Evidence of Review by CIO/CISO and responsibility of program Views of responsible officials: There is no disagreement with the finding.

2023–008: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College had not developed and implemented an approved written information security program. Cause: The College did not develop and implement a written information security program as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: The College should develop and implement an approved written information security program and verify there is a risk management section that describes how the College is identifying, assessing and communicating risks. In addition, there should be a description on the evaluation of safeguard sufficiency in mitigating risks. The information security program should also include the following: • IT Security Policy • Acceptable Use Policy • Incident Response Policy • Data Classification Policies • Vendor Management Policy • Patch Management Policy • Data Disposal Policy • Risk Assessment Policy • Logical Access and User Access Review Policies • Evidence of Review by CIO/CISO and responsibility of program Views of responsible officials: There is no disagreement with the finding.

2023–008: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College had not developed and implemented an approved written information security program. Cause: The College did not develop and implement a written information security program as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: The College should develop and implement an approved written information security program and verify there is a risk management section that describes how the College is identifying, assessing and communicating risks. In addition, there should be a description on the evaluation of safeguard sufficiency in mitigating risks. The information security program should also include the following: • IT Security Policy • Acceptable Use Policy • Incident Response Policy • Data Classification Policies • Vendor Management Policy • Patch Management Policy • Data Disposal Policy • Risk Assessment Policy • Logical Access and User Access Review Policies • Evidence of Review by CIO/CISO and responsibility of program Views of responsible officials: There is no disagreement with the finding.

2023–008: Gramm-Leach-Bliley Act Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Numbers: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College had not developed and implemented an approved written information security program. Cause: The College did not develop and implement a written information security program as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: No Recommendation: The College should develop and implement an approved written information security program and verify there is a risk management section that describes how the College is identifying, assessing and communicating risks. In addition, there should be a description on the evaluation of safeguard sufficiency in mitigating risks. The information security program should also include the following: • IT Security Policy • Acceptable Use Policy • Incident Response Policy • Data Classification Policies • Vendor Management Policy • Patch Management Policy • Data Disposal Policy • Risk Assessment Policy • Logical Access and User Access Review Policies • Evidence of Review by CIO/CISO and responsibility of program Views of responsible officials: There is no disagreement with the finding.