Information on the federal program: Student Financial Assistance Cluster; United States Department of Education; Award Year 2022-23: Compliance Requirement – Special Tests and Provisions; Type of Finding: Material Noncompliance.
Criteria: 16 CFR 314 requires that higher education institutions develop, implement, and maintain a comprehensive written information security program (WISP) in compliance with the Gramm-Leach-Bliley Act (GLBA).
Condition: The University has not established a WISP.
Cause: The University’s IT personnel were not made aware of this compliance requirement.
Effect: Confidential student financial and other information could be exposed to the risk of outside parties gaining access.
Questioned Costs: n/a for this finding.
Context: All confidential student financial and other information could be affected if the information security procedures are not adequate.
Recommendations: Formulate a WISP and follow its procedures as soon as possible.
Responsible Official’s Response and Corrective Action Planned: see corrective action plan.
Information on the federal program: Student Financial Assistance Cluster; United States Department of Education; Award Year 2022-23: Compliance Requirement – Special Tests and Provisions; Type of Finding: Material Noncompliance.
Criteria: 16 CFR 314 requires that higher education institutions develop, implement, and maintain a comprehensive written information security program (WISP) in compliance with the Gramm-Leach-Bliley Act (GLBA).
Condition: The University has not established a WISP.
Cause: The University’s IT personnel were not made aware of this compliance requirement.
Effect: Confidential student financial and other information could be exposed to the risk of outside parties gaining access.
Questioned Costs: n/a for this finding.
Context: All confidential student financial and other information could be affected if the information security procedures are not adequate.
Recommendations: Formulate a WISP and follow its procedures as soon as possible.
Responsible Official’s Response and Corrective Action Planned: see corrective action plan.
Information on the federal program: Student Financial Assistance Cluster; United States Department of Education; Award Year 2022-23: Compliance Requirement – Special Tests and Provisions; Type of Finding: Material Noncompliance.
Criteria: 16 CFR 314 requires that higher education institutions develop, implement, and maintain a comprehensive written information security program (WISP) in compliance with the Gramm-Leach-Bliley Act (GLBA).
Condition: The University has not established a WISP.
Cause: The University’s IT personnel were not made aware of this compliance requirement.
Effect: Confidential student financial and other information could be exposed to the risk of outside parties gaining access.
Questioned Costs: n/a for this finding.
Context: All confidential student financial and other information could be affected if the information security procedures are not adequate.
Recommendations: Formulate a WISP and follow its procedures as soon as possible.
Responsible Official’s Response and Corrective Action Planned: see corrective action plan.
Information on the federal program: Student Financial Assistance Cluster; United States Department of Education; Award Year 2022-23: Compliance Requirement – Special Tests and Provisions; Type of Finding: Material Noncompliance.
Criteria: 16 CFR 314 requires that higher education institutions develop, implement, and maintain a comprehensive written information security program (WISP) in compliance with the Gramm-Leach-Bliley Act (GLBA).
Condition: The University has not established a WISP.
Cause: The University’s IT personnel were not made aware of this compliance requirement.
Effect: Confidential student financial and other information could be exposed to the risk of outside parties gaining access.
Questioned Costs: n/a for this finding.
Context: All confidential student financial and other information could be affected if the information security procedures are not adequate.
Recommendations: Formulate a WISP and follow its procedures as soon as possible.
Responsible Official’s Response and Corrective Action Planned: see corrective action plan.
Information on the federal program:
Higher Education Institutional Aid - Hispanic-Serving Institutions – Science, Technology, Engineering, or Mathematics and Articulations Programs (Assistance Listing number 84.031C) and Hispanic-Serving Institutions – DHSI Program (Assistance Listing number 84.031S); United States Department of Education; Award Year 2022-23; Compliance Requirement – Allowable Costs; Type of Finding – Questioned Cost.
Criteria: 2 CFR Part 200 requires that compensation charged to a program must be adequately supported by documentation of the employee’s time.
Condition: For one employee, for all three paychecks included in the sample tested, 100% of salary was charged to the grant, but only 35% was supported by the time & effort records and program budget. For one paycheck tested for another employee, 100% was charged to the grant, but the supporting documentation indicated that this employee did not work on the grant program.
Cause: University management did not have controls in place to ensure that the correct salary amounts were charged to the grant.
Effect: Incorrect amounts could be charged to the grant.
Questioned Costs: Known questioned costs totaled $4,352, with likely questioned costs exceeding $25,000.
Context: Total payroll charged to this program for the year was $608,941.
Recommendations: Management should add a procedure to review payroll charges made to grants each pay period as compared to the time & effort documentation.
Responsible Official’s Response and Corrective Action Planned: see corrective action plan.
Information on the federal program:
Higher Education Institutional Aid - Hispanic-Serving Institutions – Science, Technology, Engineering, or Mathematics and Articulations Programs (Assistance Listing number 84.031C) and Hispanic-Serving Institutions – DHSI Program (Assistance Listing number 84.031S); United States Department of Education; Award Year 2022-23; Compliance Requirement – Allowable Costs; Type of Finding – Questioned Cost.
Criteria: 2 CFR Part 200 requires that compensation charged to a program must be adequately supported by documentation of the employee’s time.
Condition: For one employee, for all three paychecks included in the sample tested, 100% of salary was charged to the grant, but only 35% was supported by the time & effort records and program budget. For one paycheck tested for another employee, 100% was charged to the grant, but the supporting documentation indicated that this employee did not work on the grant program.
Cause: University management did not have controls in place to ensure that the correct salary amounts were charged to the grant.
Effect: Incorrect amounts could be charged to the grant.
Questioned Costs: Known questioned costs totaled $4,352, with likely questioned costs exceeding $25,000.
Context: Total payroll charged to this program for the year was $608,941.
Recommendations: Management should add a procedure to review payroll charges made to grants each pay period as compared to the time & effort documentation.
Responsible Official’s Response and Corrective Action Planned: see corrective action plan.
Information on the federal program:
Higher Education Institutional Aid - Hispanic-Serving Institutions – Science, Technology, Engineering, or Mathematics and Articulations Programs (Assistance Listing number 84.031C); United States Department of Education; Award Year 2022-23; Compliance Requirement – Procurement and Suspension & Debarment; Type of Finding – Material Noncompliance.
Criteria: 2 CFR Part 180 requires that grantees establish procedures that prohibit the entity from contracting with or making subawards to parties that are suspended or debarred by the federal government.
Condition: SWAU’s internal control policies and procedures do not address the prohibition of doing business with suspended or debarred parties.
Cause: Although SWAU was notified of this requirement in two previous audit years, audit follow-up procedures were not put in place due to management personnel changes.
Effect: Goods or services for the grant could have been provided by a debarred or suspended party, in violation of federal regulations.
Questioned Costs: n/a for this finding.
Context: Current year goods and services totaled $542,779 for this grant. For the nine goods and services disbursements we tested, totaling $492,896, we searched the federal list of debarred/suspended parties and did not find any of them listed.
Recommendations: Management should immediately implement a written procedure that prohibits doing business with debarred or suspended parties and includes steps to ensure compliance with that prohibition.
Responsible Official’s Response and Corrective Action Planned: see corrective action plan.
Information on the federal program: Higher Education Institutional Aid - Hispanic-Serving Institutions – Science, Technology, Engineering, or Mathematics and Articulations Programs (Assistance Listing number 84.031C) and Hispanic-Serving Institutions - (DHSI) Program (Assistance Listing number 84.031S); United States Department of Education; Award Year 2022-23; Internal Control Deficiency; Type of Finding: Material Weakness in Internal Control over Compliance.
Criteria: Institutions should follow established procedures to ensure compliance with 2 CFR Part 200 requirements for adequate documentation to support grant expenses.
Condition: Lack of appropriate management review allowed for the following issues in the grant disbursements we tested:
1) Time & effort certifications:
a. One was not completed until after we requested it in the course of the audit.
b. One showed 50% should be charged to the grant, but only 35% was charged to the grant.
c. Two did not list the month on the form.
d. Three showed 80% grant and 20% institutional, but the hours listed showed equal hours for grant and institutional.
e. One was not signed by the supervisor.
f. As noted in 2023-002 above, one showed 35% should be charged to the grant, but 100% was charged to the grant.
2) Five purchases totaling $472,879 did not follow approval procedures outlined in the internal control policy, which required prior Board of Trustee approval for purchases over $17,500.
3) Two purchases totaling $91,975 did not reflect bid approval as outlined in the internal control policy.
Cause: The University implemented a comprehensive system software change during the current year. The additional time required for this effort, coupled with management personnel changes and staff shortages, led to the lack of appropriate approval and review of documentation.
Effect: Incorrect amounts and/or improper payments could be charged to the grant.
Questioned Costs: n/a for this finding.
Context: Our testing included 25 payroll items and 10 payments for goods and services.
Recommendations: Management should add procedures to (1) review payroll charges made to grants each pay period as compared to the time & effort documentation and (2) document approval for purchases and bids, in accordance with policy. If the intent is not for the Board of Trustees to provide approval, policies should be revised to reflect which committee/individuals will provide that approval.
Responsible Official’s Response and Corrective Action Planned: see corrective action plan.
Information on the federal program: Higher Education Institutional Aid - Hispanic-Serving Institutions – Science, Technology, Engineering, or Mathematics and Articulations Programs (Assistance Listing number 84.031C) and Hispanic-Serving Institutions - (DHSI) Program (Assistance Listing number 84.031S); United States Department of Education; Award Year 2022-23; Internal Control Deficiency; Type of Finding: Material Weakness in Internal Control over Compliance.
Criteria: Institutions should follow established procedures to ensure compliance with 2 CFR Part 200 requirements for adequate documentation to support grant expenses.
Condition: Lack of appropriate management review allowed for the following issues in the grant disbursements we tested:
1) Time & effort certifications:
a. One was not completed until after we requested it in the course of the audit.
b. One showed 50% should be charged to the grant, but only 35% was charged to the grant.
c. Two did not list the month on the form.
d. Three showed 80% grant and 20% institutional, but the hours listed showed equal hours for grant and institutional.
e. One was not signed by the supervisor.
f. As noted in 2023-002 above, one showed 35% should be charged to the grant, but 100% was charged to the grant.
2) Five purchases totaling $472,879 did not follow approval procedures outlined in the internal control policy, which required prior Board of Trustee approval for purchases over $17,500.
3) Two purchases totaling $91,975 did not reflect bid approval as outlined in the internal control policy.
Cause: The University implemented a comprehensive system software change during the current year. The additional time required for this effort, coupled with management personnel changes and staff shortages, led to the lack of appropriate approval and review of documentation.
Effect: Incorrect amounts and/or improper payments could be charged to the grant.
Questioned Costs: n/a for this finding.
Context: Our testing included 25 payroll items and 10 payments for goods and services.
Recommendations: Management should add procedures to (1) review payroll charges made to grants each pay period as compared to the time & effort documentation and (2) document approval for purchases and bids, in accordance with policy. If the intent is not for the Board of Trustees to provide approval, policies should be revised to reflect which committee/individuals will provide that approval.
Responsible Official’s Response and Corrective Action Planned: see corrective action plan.
Information on the federal program: Student Financial Assistance Cluster; United States Department of Education; Award Year 2022-23: Compliance Requirement – Special Tests and Provisions; Type of Finding: Material Noncompliance.
Criteria: 16 CFR 314 requires that higher education institutions develop, implement, and maintain a comprehensive written information security program (WISP) in compliance with the Gramm-Leach-Bliley Act (GLBA).
Condition: The University has not established a WISP.
Cause: The University’s IT personnel were not made aware of this compliance requirement.
Effect: Confidential student financial and other information could be exposed to the risk of outside parties gaining access.
Questioned Costs: n/a for this finding.
Context: All confidential student financial and other information could be affected if the information security procedures are not adequate.
Recommendations: Formulate a WISP and follow its procedures as soon as possible.
Responsible Official’s Response and Corrective Action Planned: see corrective action plan.
Information on the federal program: Student Financial Assistance Cluster; United States Department of Education; Award Year 2022-23: Compliance Requirement – Special Tests and Provisions; Type of Finding: Material Noncompliance.
Criteria: 16 CFR 314 requires that higher education institutions develop, implement, and maintain a comprehensive written information security program (WISP) in compliance with the Gramm-Leach-Bliley Act (GLBA).
Condition: The University has not established a WISP.
Cause: The University’s IT personnel were not made aware of this compliance requirement.
Effect: Confidential student financial and other information could be exposed to the risk of outside parties gaining access.
Questioned Costs: n/a for this finding.
Context: All confidential student financial and other information could be affected if the information security procedures are not adequate.
Recommendations: Formulate a WISP and follow its procedures as soon as possible.
Responsible Official’s Response and Corrective Action Planned: see corrective action plan.
Information on the federal program: Student Financial Assistance Cluster; United States Department of Education; Award Year 2022-23: Compliance Requirement – Special Tests and Provisions; Type of Finding: Material Noncompliance.
Criteria: 16 CFR 314 requires that higher education institutions develop, implement, and maintain a comprehensive written information security program (WISP) in compliance with the Gramm-Leach-Bliley Act (GLBA).
Condition: The University has not established a WISP.
Cause: The University’s IT personnel were not made aware of this compliance requirement.
Effect: Confidential student financial and other information could be exposed to the risk of outside parties gaining access.
Questioned Costs: n/a for this finding.
Context: All confidential student financial and other information could be affected if the information security procedures are not adequate.
Recommendations: Formulate a WISP and follow its procedures as soon as possible.
Responsible Official’s Response and Corrective Action Planned: see corrective action plan.
Information on the federal program: Student Financial Assistance Cluster; United States Department of Education; Award Year 2022-23: Compliance Requirement – Special Tests and Provisions; Type of Finding: Material Noncompliance.
Criteria: 16 CFR 314 requires that higher education institutions develop, implement, and maintain a comprehensive written information security program (WISP) in compliance with the Gramm-Leach-Bliley Act (GLBA).
Condition: The University has not established a WISP.
Cause: The University’s IT personnel were not made aware of this compliance requirement.
Effect: Confidential student financial and other information could be exposed to the risk of outside parties gaining access.
Questioned Costs: n/a for this finding.
Context: All confidential student financial and other information could be affected if the information security procedures are not adequate.
Recommendations: Formulate a WISP and follow its procedures as soon as possible.
Responsible Official’s Response and Corrective Action Planned: see corrective action plan.
Information on the federal program:
Higher Education Institutional Aid - Hispanic-Serving Institutions – Science, Technology, Engineering, or Mathematics and Articulations Programs (Assistance Listing number 84.031C) and Hispanic-Serving Institutions – DHSI Program (Assistance Listing number 84.031S); United States Department of Education; Award Year 2022-23; Compliance Requirement – Allowable Costs; Type of Finding – Questioned Cost.
Criteria: 2 CFR Part 200 requires that compensation charged to a program must be adequately supported by documentation of the employee’s time.
Condition: For one employee, for all three paychecks included in the sample tested, 100% of salary was charged to the grant, but only 35% was supported by the time & effort records and program budget. For one paycheck tested for another employee, 100% was charged to the grant, but the supporting documentation indicated that this employee did not work on the grant program.
Cause: University management did not have controls in place to ensure that the correct salary amounts were charged to the grant.
Effect: Incorrect amounts could be charged to the grant.
Questioned Costs: Known questioned costs totaled $4,352, with likely questioned costs exceeding $25,000.
Context: Total payroll charged to this program for the year was $608,941.
Recommendations: Management should add a procedure to review payroll charges made to grants each pay period as compared to the time & effort documentation.
Responsible Official’s Response and Corrective Action Planned: see corrective action plan.
Information on the federal program:
Higher Education Institutional Aid - Hispanic-Serving Institutions – Science, Technology, Engineering, or Mathematics and Articulations Programs (Assistance Listing number 84.031C) and Hispanic-Serving Institutions – DHSI Program (Assistance Listing number 84.031S); United States Department of Education; Award Year 2022-23; Compliance Requirement – Allowable Costs; Type of Finding – Questioned Cost.
Criteria: 2 CFR Part 200 requires that compensation charged to a program must be adequately supported by documentation of the employee’s time.
Condition: For one employee, for all three paychecks included in the sample tested, 100% of salary was charged to the grant, but only 35% was supported by the time & effort records and program budget. For one paycheck tested for another employee, 100% was charged to the grant, but the supporting documentation indicated that this employee did not work on the grant program.
Cause: University management did not have controls in place to ensure that the correct salary amounts were charged to the grant.
Effect: Incorrect amounts could be charged to the grant.
Questioned Costs: Known questioned costs totaled $4,352, with likely questioned costs exceeding $25,000.
Context: Total payroll charged to this program for the year was $608,941.
Recommendations: Management should add a procedure to review payroll charges made to grants each pay period as compared to the time & effort documentation.
Responsible Official’s Response and Corrective Action Planned: see corrective action plan.
Information on the federal program:
Higher Education Institutional Aid - Hispanic-Serving Institutions – Science, Technology, Engineering, or Mathematics and Articulations Programs (Assistance Listing number 84.031C); United States Department of Education; Award Year 2022-23; Compliance Requirement – Procurement and Suspension & Debarment; Type of Finding – Material Noncompliance.
Criteria: 2 CFR Part 180 requires that grantees establish procedures that prohibit the entity from contracting with or making subawards to parties that are suspended or debarred by the federal government.
Condition: SWAU’s internal control policies and procedures do not address the prohibition of doing business with suspended or debarred parties.
Cause: Although SWAU was notified of this requirement in two previous audit years, audit follow-up procedures were not put in place due to management personnel changes.
Effect: Goods or services for the grant could have been provided by a debarred or suspended party, in violation of federal regulations.
Questioned Costs: n/a for this finding.
Context: Current year goods and services totaled $542,779 for this grant. For the nine goods and services disbursements we tested, totaling $492,896, we searched the federal list of debarred/suspended parties and did not find any of them listed.
Recommendations: Management should immediately implement a written procedure that prohibits doing business with debarred or suspended parties and includes steps to ensure compliance with that prohibition.
Responsible Official’s Response and Corrective Action Planned: see corrective action plan.
Information on the federal program: Higher Education Institutional Aid - Hispanic-Serving Institutions – Science, Technology, Engineering, or Mathematics and Articulations Programs (Assistance Listing number 84.031C) and Hispanic-Serving Institutions - (DHSI) Program (Assistance Listing number 84.031S); United States Department of Education; Award Year 2022-23; Internal Control Deficiency; Type of Finding: Material Weakness in Internal Control over Compliance.
Criteria: Institutions should follow established procedures to ensure compliance with 2 CFR Part 200 requirements for adequate documentation to support grant expenses.
Condition: Lack of appropriate management review allowed for the following issues in the grant disbursements we tested:
1) Time & effort certifications:
a. One was not completed until after we requested it in the course of the audit.
b. One showed 50% should be charged to the grant, but only 35% was charged to the grant.
c. Two did not list the month on the form.
d. Three showed 80% grant and 20% institutional, but the hours listed showed equal hours for grant and institutional.
e. One was not signed by the supervisor.
f. As noted in 2023-002 above, one showed 35% should be charged to the grant, but 100% was charged to the grant.
2) Five purchases totaling $472,879 did not follow approval procedures outlined in the internal control policy, which required prior Board of Trustee approval for purchases over $17,500.
3) Two purchases totaling $91,975 did not reflect bid approval as outlined in the internal control policy.
Cause: The University implemented a comprehensive system software change during the current year. The additional time required for this effort, coupled with management personnel changes and staff shortages, led to the lack of appropriate approval and review of documentation.
Effect: Incorrect amounts and/or improper payments could be charged to the grant.
Questioned Costs: n/a for this finding.
Context: Our testing included 25 payroll items and 10 payments for goods and services.
Recommendations: Management should add procedures to (1) review payroll charges made to grants each pay period as compared to the time & effort documentation and (2) document approval for purchases and bids, in accordance with policy. If the intent is not for the Board of Trustees to provide approval, policies should be revised to reflect which committee/individuals will provide that approval.
Responsible Official’s Response and Corrective Action Planned: see corrective action plan.
Information on the federal program: Higher Education Institutional Aid - Hispanic-Serving Institutions – Science, Technology, Engineering, or Mathematics and Articulations Programs (Assistance Listing number 84.031C) and Hispanic-Serving Institutions - (DHSI) Program (Assistance Listing number 84.031S); United States Department of Education; Award Year 2022-23; Internal Control Deficiency; Type of Finding: Material Weakness in Internal Control over Compliance.
Criteria: Institutions should follow established procedures to ensure compliance with 2 CFR Part 200 requirements for adequate documentation to support grant expenses.
Condition: Lack of appropriate management review allowed for the following issues in the grant disbursements we tested:
1) Time & effort certifications:
a. One was not completed until after we requested it in the course of the audit.
b. One showed 50% should be charged to the grant, but only 35% was charged to the grant.
c. Two did not list the month on the form.
d. Three showed 80% grant and 20% institutional, but the hours listed showed equal hours for grant and institutional.
e. One was not signed by the supervisor.
f. As noted in 2023-002 above, one showed 35% should be charged to the grant, but 100% was charged to the grant.
2) Five purchases totaling $472,879 did not follow approval procedures outlined in the internal control policy, which required prior Board of Trustee approval for purchases over $17,500.
3) Two purchases totaling $91,975 did not reflect bid approval as outlined in the internal control policy.
Cause: The University implemented a comprehensive system software change during the current year. The additional time required for this effort, coupled with management personnel changes and staff shortages, led to the lack of appropriate approval and review of documentation.
Effect: Incorrect amounts and/or improper payments could be charged to the grant.
Questioned Costs: n/a for this finding.
Context: Our testing included 25 payroll items and 10 payments for goods and services.
Recommendations: Management should add procedures to (1) review payroll charges made to grants each pay period as compared to the time & effort documentation and (2) document approval for purchases and bids, in accordance with policy. If the intent is not for the Board of Trustees to provide approval, policies should be revised to reflect which committee/individuals will provide that approval.
Responsible Official’s Response and Corrective Action Planned: see corrective action plan.