Audit 307518

FY End
2023-06-30
Total Expended
$729.77M
Findings
316
Programs
343
Year: 2023 Accepted: 2024-05-29

Organization Exclusion Status:

Checking exclusion status...

Findings

ID Ref Severity Repeat Requirement
398762 2023-002 Significant Deficiency Yes P
398763 2023-002 Significant Deficiency Yes P
398764 2023-002 Significant Deficiency Yes P
398765 2023-002 Significant Deficiency Yes P
398766 2023-002 Significant Deficiency Yes P
398767 2023-002 Significant Deficiency Yes P
398768 2023-002 Significant Deficiency Yes P
398769 2023-002 Significant Deficiency Yes P
398770 2023-002 Significant Deficiency Yes P
398771 2023-002 Significant Deficiency Yes P
398772 2023-002 Significant Deficiency Yes P
398773 2023-002 Significant Deficiency Yes P
398774 2023-002 Significant Deficiency Yes P
398775 2023-002 Significant Deficiency Yes P
398776 2023-002 Significant Deficiency Yes P
398777 2023-002 Significant Deficiency Yes P
398778 2023-002 Significant Deficiency Yes P
398779 2023-002 Significant Deficiency Yes P
398780 2023-002 Significant Deficiency Yes P
398781 2023-002 Significant Deficiency Yes P
398782 2023-002 Significant Deficiency Yes P
398783 2023-002 Significant Deficiency Yes P
398784 2023-002 Significant Deficiency Yes P
398785 2023-002 Significant Deficiency Yes P
398786 2023-002 Significant Deficiency Yes P
398787 2023-002 Significant Deficiency Yes P
398788 2023-002 Significant Deficiency Yes P
398789 2023-002 Significant Deficiency Yes P
398790 2023-002 Significant Deficiency Yes P
398791 2023-002 Significant Deficiency Yes P
398792 2023-002 Significant Deficiency Yes P
398793 2023-002 Significant Deficiency Yes P
398794 2023-002 Significant Deficiency Yes P
398795 2023-002 Significant Deficiency Yes P
398796 2023-002 Significant Deficiency Yes P
398797 2023-002 Significant Deficiency Yes P
398798 2023-002 Significant Deficiency Yes P
398799 2023-002 Significant Deficiency Yes P
398800 2023-002 Significant Deficiency Yes P
398801 2023-002 Significant Deficiency Yes P
398802 2023-002 Significant Deficiency Yes P
398803 2023-002 Significant Deficiency Yes P
398804 2023-002 Significant Deficiency Yes P
398805 2023-002 Significant Deficiency Yes P
398806 2023-002 Significant Deficiency Yes P
398807 2023-002 Significant Deficiency Yes P
398808 2023-002 Significant Deficiency Yes P
398809 2023-002 Significant Deficiency Yes P
398810 2023-002 Significant Deficiency Yes P
398811 2023-002 Significant Deficiency Yes P
398812 2023-002 Significant Deficiency Yes P
398813 2023-002 Significant Deficiency Yes P
398814 2023-002 Significant Deficiency Yes P
398815 2023-002 Significant Deficiency Yes P
398816 2023-002 Significant Deficiency Yes P
398817 2023-002 Significant Deficiency Yes P
398818 2023-002 Significant Deficiency Yes P
398819 2023-002 Significant Deficiency Yes P
398820 2023-002 Significant Deficiency Yes P
398821 2023-002 Significant Deficiency Yes P
398822 2023-002 Significant Deficiency Yes P
398823 2023-002 Significant Deficiency Yes P
398824 2023-002 Significant Deficiency Yes P
398825 2023-002 Significant Deficiency Yes P
398826 2023-002 Significant Deficiency Yes P
398827 2023-002 Significant Deficiency Yes P
398828 2023-002 Significant Deficiency Yes P
398829 2023-002 Significant Deficiency Yes P
398830 2023-002 Significant Deficiency Yes P
398831 2023-002 Significant Deficiency Yes P
398832 2023-002 Significant Deficiency Yes P
398833 2023-002 Significant Deficiency Yes P
398834 2023-002 Significant Deficiency Yes P
398835 2023-002 Significant Deficiency Yes P
398836 2023-002 Significant Deficiency Yes P
398837 2023-002 Significant Deficiency Yes P
398838 2023-002 Significant Deficiency Yes P
398839 2023-002 Significant Deficiency Yes P
398840 2023-002 Significant Deficiency Yes P
398841 2023-002 Significant Deficiency Yes P
398842 2023-002 Significant Deficiency Yes P
398843 2023-002 Significant Deficiency Yes P
398844 2023-002 Significant Deficiency Yes P
398845 2023-002 Significant Deficiency Yes P
398846 2023-002 Significant Deficiency Yes P
398847 2023-002 Significant Deficiency Yes P
398848 2023-002 Significant Deficiency Yes P
398849 2023-002 Significant Deficiency Yes P
398850 2023-002 Significant Deficiency Yes P
398851 2023-002 Significant Deficiency Yes P
398852 2023-002 Significant Deficiency Yes P
398853 2023-002 Significant Deficiency Yes P
398854 2023-002 Significant Deficiency Yes P
398855 2023-002 Significant Deficiency Yes P
398856 2023-002 Significant Deficiency Yes P
398857 2023-002 Significant Deficiency Yes P
398858 2023-002 Significant Deficiency Yes P
398859 2023-002 Significant Deficiency Yes P
398860 2023-002 Significant Deficiency Yes P
398861 2023-002 Significant Deficiency Yes P
398862 2023-002 Significant Deficiency Yes P
398863 2023-003 Significant Deficiency Yes N
398864 2023-003 Significant Deficiency Yes N
398865 2023-003 Significant Deficiency Yes N
398866 2023-003 Significant Deficiency Yes N
398867 2023-003 Significant Deficiency Yes N
398868 2023-003 Significant Deficiency Yes N
398869 2023-003 Significant Deficiency Yes N
398870 2023-003 Significant Deficiency Yes N
398871 2023-003 Significant Deficiency Yes N
398872 2023-003 Significant Deficiency Yes N
398873 2023-003 Significant Deficiency Yes N
398874 2023-003 Significant Deficiency Yes N
398875 2023-003 Significant Deficiency Yes N
398876 2023-003 Significant Deficiency Yes N
398877 2023-003 Significant Deficiency Yes N
398878 2023-003 Significant Deficiency Yes N
398879 2023-003 Significant Deficiency Yes N
398880 2023-003 Significant Deficiency Yes N
398881 2023-003 Significant Deficiency Yes N
398882 2023-003 Significant Deficiency Yes N
398883 2023-003 Significant Deficiency Yes N
398884 2023-003 Significant Deficiency Yes N
398885 2023-003 Significant Deficiency Yes N
398886 2023-003 Significant Deficiency Yes N
398887 2023-003 Significant Deficiency Yes N
398888 2023-003 Significant Deficiency Yes N
398889 2023-003 Significant Deficiency Yes N
398890 2023-003 Significant Deficiency Yes N
398891 2023-003 Significant Deficiency Yes N
398892 2023-003 Significant Deficiency Yes N
398893 2023-003 Significant Deficiency Yes N
398894 2023-003 Significant Deficiency Yes N
398895 2023-003 Significant Deficiency Yes N
398896 2023-003 Significant Deficiency Yes N
398897 2023-003 Significant Deficiency Yes N
398898 2023-003 Significant Deficiency Yes N
398899 2023-003 Significant Deficiency Yes N
398900 2023-003 Significant Deficiency Yes N
398901 2023-003 Significant Deficiency Yes N
398902 2023-003 Significant Deficiency Yes N
398903 2023-003 Significant Deficiency Yes N
398904 2023-003 Significant Deficiency Yes N
398905 2023-003 Significant Deficiency Yes N
398906 2023-003 Significant Deficiency Yes N
398907 2023-003 Significant Deficiency Yes N
398908 2023-003 Significant Deficiency Yes N
398909 2023-003 Significant Deficiency Yes N
398910 2023-003 Significant Deficiency Yes N
398911 2023-003 Significant Deficiency Yes N
398912 2023-003 Significant Deficiency Yes N
398913 2023-003 Significant Deficiency Yes N
398914 2023-003 Significant Deficiency Yes N
398915 2023-003 Significant Deficiency Yes N
398916 2023-003 Significant Deficiency Yes N
398917 2023-003 Significant Deficiency Yes N
398918 2023-003 Significant Deficiency Yes N
398919 2023-003 Significant Deficiency Yes N
975204 2023-002 Significant Deficiency Yes P
975205 2023-002 Significant Deficiency Yes P
975206 2023-002 Significant Deficiency Yes P
975207 2023-002 Significant Deficiency Yes P
975208 2023-002 Significant Deficiency Yes P
975209 2023-002 Significant Deficiency Yes P
975210 2023-002 Significant Deficiency Yes P
975211 2023-002 Significant Deficiency Yes P
975212 2023-002 Significant Deficiency Yes P
975213 2023-002 Significant Deficiency Yes P
975214 2023-002 Significant Deficiency Yes P
975215 2023-002 Significant Deficiency Yes P
975216 2023-002 Significant Deficiency Yes P
975217 2023-002 Significant Deficiency Yes P
975218 2023-002 Significant Deficiency Yes P
975219 2023-002 Significant Deficiency Yes P
975220 2023-002 Significant Deficiency Yes P
975221 2023-002 Significant Deficiency Yes P
975222 2023-002 Significant Deficiency Yes P
975223 2023-002 Significant Deficiency Yes P
975224 2023-002 Significant Deficiency Yes P
975225 2023-002 Significant Deficiency Yes P
975226 2023-002 Significant Deficiency Yes P
975227 2023-002 Significant Deficiency Yes P
975228 2023-002 Significant Deficiency Yes P
975229 2023-002 Significant Deficiency Yes P
975230 2023-002 Significant Deficiency Yes P
975231 2023-002 Significant Deficiency Yes P
975232 2023-002 Significant Deficiency Yes P
975233 2023-002 Significant Deficiency Yes P
975234 2023-002 Significant Deficiency Yes P
975235 2023-002 Significant Deficiency Yes P
975236 2023-002 Significant Deficiency Yes P
975237 2023-002 Significant Deficiency Yes P
975238 2023-002 Significant Deficiency Yes P
975239 2023-002 Significant Deficiency Yes P
975240 2023-002 Significant Deficiency Yes P
975241 2023-002 Significant Deficiency Yes P
975242 2023-002 Significant Deficiency Yes P
975243 2023-002 Significant Deficiency Yes P
975244 2023-002 Significant Deficiency Yes P
975245 2023-002 Significant Deficiency Yes P
975246 2023-002 Significant Deficiency Yes P
975247 2023-002 Significant Deficiency Yes P
975248 2023-002 Significant Deficiency Yes P
975249 2023-002 Significant Deficiency Yes P
975250 2023-002 Significant Deficiency Yes P
975251 2023-002 Significant Deficiency Yes P
975252 2023-002 Significant Deficiency Yes P
975253 2023-002 Significant Deficiency Yes P
975254 2023-002 Significant Deficiency Yes P
975255 2023-002 Significant Deficiency Yes P
975256 2023-002 Significant Deficiency Yes P
975257 2023-002 Significant Deficiency Yes P
975258 2023-002 Significant Deficiency Yes P
975259 2023-002 Significant Deficiency Yes P
975260 2023-002 Significant Deficiency Yes P
975261 2023-002 Significant Deficiency Yes P
975262 2023-002 Significant Deficiency Yes P
975263 2023-002 Significant Deficiency Yes P
975264 2023-002 Significant Deficiency Yes P
975265 2023-002 Significant Deficiency Yes P
975266 2023-002 Significant Deficiency Yes P
975267 2023-002 Significant Deficiency Yes P
975268 2023-002 Significant Deficiency Yes P
975269 2023-002 Significant Deficiency Yes P
975270 2023-002 Significant Deficiency Yes P
975271 2023-002 Significant Deficiency Yes P
975272 2023-002 Significant Deficiency Yes P
975273 2023-002 Significant Deficiency Yes P
975274 2023-002 Significant Deficiency Yes P
975275 2023-002 Significant Deficiency Yes P
975276 2023-002 Significant Deficiency Yes P
975277 2023-002 Significant Deficiency Yes P
975278 2023-002 Significant Deficiency Yes P
975279 2023-002 Significant Deficiency Yes P
975280 2023-002 Significant Deficiency Yes P
975281 2023-002 Significant Deficiency Yes P
975282 2023-002 Significant Deficiency Yes P
975283 2023-002 Significant Deficiency Yes P
975284 2023-002 Significant Deficiency Yes P
975285 2023-002 Significant Deficiency Yes P
975286 2023-002 Significant Deficiency Yes P
975287 2023-002 Significant Deficiency Yes P
975288 2023-002 Significant Deficiency Yes P
975289 2023-002 Significant Deficiency Yes P
975290 2023-002 Significant Deficiency Yes P
975291 2023-002 Significant Deficiency Yes P
975292 2023-002 Significant Deficiency Yes P
975293 2023-002 Significant Deficiency Yes P
975294 2023-002 Significant Deficiency Yes P
975295 2023-002 Significant Deficiency Yes P
975296 2023-002 Significant Deficiency Yes P
975297 2023-002 Significant Deficiency Yes P
975298 2023-002 Significant Deficiency Yes P
975299 2023-002 Significant Deficiency Yes P
975300 2023-002 Significant Deficiency Yes P
975301 2023-002 Significant Deficiency Yes P
975302 2023-002 Significant Deficiency Yes P
975303 2023-002 Significant Deficiency Yes P
975304 2023-002 Significant Deficiency Yes P
975305 2023-003 Significant Deficiency Yes N
975306 2023-003 Significant Deficiency Yes N
975307 2023-003 Significant Deficiency Yes N
975308 2023-003 Significant Deficiency Yes N
975309 2023-003 Significant Deficiency Yes N
975310 2023-003 Significant Deficiency Yes N
975311 2023-003 Significant Deficiency Yes N
975312 2023-003 Significant Deficiency Yes N
975313 2023-003 Significant Deficiency Yes N
975314 2023-003 Significant Deficiency Yes N
975315 2023-003 Significant Deficiency Yes N
975316 2023-003 Significant Deficiency Yes N
975317 2023-003 Significant Deficiency Yes N
975318 2023-003 Significant Deficiency Yes N
975319 2023-003 Significant Deficiency Yes N
975320 2023-003 Significant Deficiency Yes N
975321 2023-003 Significant Deficiency Yes N
975322 2023-003 Significant Deficiency Yes N
975323 2023-003 Significant Deficiency Yes N
975324 2023-003 Significant Deficiency Yes N
975325 2023-003 Significant Deficiency Yes N
975326 2023-003 Significant Deficiency Yes N
975327 2023-003 Significant Deficiency Yes N
975328 2023-003 Significant Deficiency Yes N
975329 2023-003 Significant Deficiency Yes N
975330 2023-003 Significant Deficiency Yes N
975331 2023-003 Significant Deficiency Yes N
975332 2023-003 Significant Deficiency Yes N
975333 2023-003 Significant Deficiency Yes N
975334 2023-003 Significant Deficiency Yes N
975335 2023-003 Significant Deficiency Yes N
975336 2023-003 Significant Deficiency Yes N
975337 2023-003 Significant Deficiency Yes N
975338 2023-003 Significant Deficiency Yes N
975339 2023-003 Significant Deficiency Yes N
975340 2023-003 Significant Deficiency Yes N
975341 2023-003 Significant Deficiency Yes N
975342 2023-003 Significant Deficiency Yes N
975343 2023-003 Significant Deficiency Yes N
975344 2023-003 Significant Deficiency Yes N
975345 2023-003 Significant Deficiency Yes N
975346 2023-003 Significant Deficiency Yes N
975347 2023-003 Significant Deficiency Yes N
975348 2023-003 Significant Deficiency Yes N
975349 2023-003 Significant Deficiency Yes N
975350 2023-003 Significant Deficiency Yes N
975351 2023-003 Significant Deficiency Yes N
975352 2023-003 Significant Deficiency Yes N
975353 2023-003 Significant Deficiency Yes N
975354 2023-003 Significant Deficiency Yes N
975355 2023-003 Significant Deficiency Yes N
975356 2023-003 Significant Deficiency Yes N
975357 2023-003 Significant Deficiency Yes N
975358 2023-003 Significant Deficiency Yes N
975359 2023-003 Significant Deficiency Yes N
975360 2023-003 Significant Deficiency Yes N
975361 2023-003 Significant Deficiency Yes N

Programs

ALN Program Spent Major Findings
15.982 Radium Remediation at Land-Grant Universities $5.60M - 0
93.264 Nurse Faculty Loan Program (nflp) $1.36M Yes 2
84.038 2010: Archived, Federal Perkins Loans $1.26M Yes 2
17.268 H-1b Job Training Grants $1.07M - 0
11.469 Congressionally Identified Awards and Projects $654,027 - 0
93.110 Maternal and Child Health Federal Consolidated Programs $618,197 - 0
10.557 Special Supplemental Nutrition Program for Women, Infants, and Children $611,759 - 0
84.335 Child Care Access Means Parents in School $483,147 - 0
12.600 Community Investment $433,885 - 0
84.116 Fund for the Improvement of Postsecondary Education $422,131 - 0
93.884 Grants for Primary Care Training and Enhancement $413,630 - 0
81.136 Long-Term Surveillance and Maintenance $412,968 - 0
93.103 Food and Drug Administration_research $408,791 - 0
93.077 Family Smoking Prevention and Tobacco Control Act Regulatory Research $408,177 - 0
93.364 Nursing Student Loans $403,060 Yes 2
84.382 Strengthening Minority-Serving Institutions $349,221 - 0
84.031 Higher Education_institutional Aid $337,347 - 0
84.000 Contract - Department of Education $326,886 - 0
17.283 Workforce Innovation Fund $322,280 - 0
93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund $309,109 - 0
93.351 Research Infrastructure Programs $286,264 - 0
93.268 Immunization Cooperative Agreements $280,052 - 0
84.325 Special Education - Personnel Development to Improve Services and Results for Children with Disabilities $275,974 - 0
84.042 Trio_student Support Services $274,013 Yes 0
84.200 Graduate Assistance in Areas of National Need $271,699 - 0
84.066 Trio_educational Opportunity Centers $265,206 Yes 0
84.002 Adult Education - Basic Grants to States $264,965 - 0
84.044 Trio_talent Search $248,338 Yes 0
93.658 Foster Care_title IV-E $246,338 - 0
15.232 Wildland Fire Research and Studies Program $236,817 - 0
84.048 Career and Technical Education -- Basic Grants to States $233,821 - 0
93.257 Grants for Education, Prevention, and Early Detection of Radiogenic Cancers and Diseases $232,857 - 0
10.311 Beginning Farmer and Rancher Development Program $228,498 - 0
66.509 Science to Achieve Results (star) Research Program $227,003 - 0
66.032 State Indoor Radon Grants $217,745 - 0
93.145 Aids Education and Training Centers $211,672 - 0
93.913 Grants to States for Operation of Offices of Rural Health $205,446 - 0
93.197 Childhood Lead Poisoning Prevention Projects_state and Local Childhood Lead Poisoning Prevention and Surveillance of Blood Lead Levels in Children $200,977 - 0
14.902 Lead Technical Studies Grants $192,390 - 0
10.664 Cooperative Forestry Assistance $189,189 - 0
93.137 Community Programs to Improve Minority Health Grant Program $176,282 - 0
93.059 Training in General, Pediatric, and Public Health Dentistry $174,745 - 0
19.027 Energy Governance and Reform Programs $173,244 - 0
81.089 Fossil Energy Research and Development $165,473 - 0
11.303 Economic Development_technical Assistance $163,899 - 0
84.365 English Language Acquisition State Grants $155,250 - 0
15.000 Contract - Department of Interior $151,833 - 0
93.242 Mental Health Research Grants $143,697 - 0
45.164 Promotion of the Humanities_public Programs $143,689 - 0
93.073 Birth Defects and Developmental Disabilities - Prevention and Surveillance $141,575 - 0
84.215 Fund for the Improvement of Education $140,241 - 0
93.107 Area Health Education Centers Point of Service Maintenance and Enhancement Awards $140,144 - 0
10.443 Outreach and Assistance for Socially Disadvantaged and Veteran Farmers and Ranchers $137,968 - 0
93.395 Cancer Treatment Research $131,546 - 0
93.172 Human Genome Research $127,953 - 0
81.086 Conservation Research and Development $127,661 - 0
47.000 Contract - National Science Foundation $127,587 - 0
93.838 Lung Diseases Research $125,688 - 0
84.326 Special Education_technical Assistance and Dissemination to Improve Services and Results for Children with Disabilities $123,146 - 0
93.079 Cooperative Agreements to Promote Adolescent Health Through School-Based Hiv/std Prevention and School-Based Surveillance $123,124 - 0
93.779 Centers for Medicare and Medicaid Services (cms) Research, Demonstrations and Evaluations $111,591 - 0
15.228 Blm Fuels Management and Community Fire Assistance Program Activities $110,979 - 0
93.969 Pphf Geriatric Education Centers $108,438 - 0
93.354 Public Health Emergency Response: Cooperative Agreement for Emergency Response: Public Health Crisis Response $107,026 - 0
93.504 Family to Family Health Information Centers $105,494 - 0
15.237 Rangeland Resource Management $104,586 - 0
84.007 Federal Supplemental Educational Opportunity Grants $104,494 Yes 2
12.903 Gencyber Grants Program $103,588 - 0
94.002 Retired and Senior Volunteer Program $101,556 - 0
47.080 Office of Cyberinfrastructure $101,127 - 0
93.350 National Center for Advancing Translational Sciences $99,537 - 0
10.699 Partnership Agreements $96,903 - 0
93.241 State Rural Hospital Flexibility Program $96,649 - 0
10.674 Wood Utilization Assistance $94,873 - 0
97.044 Assistance to Firefighters Grant $84,654 - 0
84.217 Trio_mcnair Post-Baccalaureate Achievement $84,137 Yes 0
17.289 Community Project Funding/congressionally Directed Spending $83,784 - 0
93.045 Special Programs for the Aging_title Iii, Part C_nutrition Services $82,990 - 0
93.734 Empowering Older Adults and Adults with Disabilities Through Chronic Disease Self-Management Education Programs Ð Financed by Prevention and Public Health Funds (pphf) $81,541 - 0
15.244 Fisheries and Aquatic Resources Management $79,149 - 0
93.918 Grants to Provide Outpatient Early Intervention Services with Respect to Hiv Disease $78,593 - 0
45.162 Promotion of the Humanities_teaching and Learning Resources and Curriculum Development $77,801 - 0
21.027 Coronavirus State and Local Fiscal Recovery Funds $74,924 Yes 0
17.285 Apprenticeship USA Grants $72,608 - 0
93.590 Community-Based Child Abuse Prevention Grants $71,768 - 0
66.708 Pollution Prevention Grants Program $70,279 - 0
93.043 Special Programs for the Aging_title Iii, Part D_disease Prevention and Health Promotion Services $69,828 - 0
93.361 Nursing Research $69,141 - 0
81.113 Defense Nuclear Nonproliferation Research $67,084 - 0
16.525 Grants to Reduce Domestic Violence, Dating Violence, Sexual Assault, and Stalking on Campus $65,867 - 0
16.817 Byrne Criminal Justice Innovation Program $65,251 - 0
84.103 Trio Staff Training Program $64,265 Yes 0
10.291 Agricultural and Food Policy Research Centers $63,490 - 0
12.900 Language Grant Program $63,031 - 0
10.516 Rural Health and Safety Education Competitive Grants Program $59,972 - 0
10.175 Farmers Market and Local Food Promotion Program (b) $59,344 - 0
93.470 Alzheimer's Disease Program Initiative (adpi) $57,667 - 0
20.530 Public Transportation Innovation $56,798 - 0
12.630 Basic, Applied, and Advanced Research in Science and Engineering $56,035 - 0
15.660 Endangered Species - Candidate Conservation Action Funds $53,797 - 0
43.002 Aeronautics $53,559 - 0
93.270 Adult Viral Hepatitis Prevention and Control $52,036 - 0
93.959 Block Grants for Prevention and Treatment of Substance Abuse $51,813 - 0
15.805 Assistance to State Water Resources Research Institutes $51,649 - 0
10.855 Distance Learning and Telemedicine Loans and Grants $49,464 - 0
16.838 Comprehensive Opioid Abuse Site-Based Program $47,804 - 0
84.033 Federal Work-Study Program $46,719 Yes 2
10.351 Rural Business Development Grant $45,591 - 0
93.165 Grants to States for Loan Repayment $45,500 - 0
17.277 Workforce Investment Act (wia) National Emergency Grants $45,451 - 0
20.611 Incentive Grant Program to Prohibit Racial Profiling $45,310 - 0
93.493 Congressional Directives $44,300 Yes 0
93.747 Elder Abuse Prevention Interventions Program $43,884 - 0
77.008 U.s. Nuclear Regulatory Commission Scholarship and Fellowship Program $43,487 - 0
10.318 Women and Minorities in Science, Technology, Engineering, and Mathematics Fields $43,080 - 0
84.047 Trio_upward Bound $42,807 Yes 0
93.396 Cancer Biology Research $41,887 - 0
93.173 Research Related to Deafness and Communication Disorders $40,720 - 0
16.738 Edward Byrne Memorial Justice Assistance Grant Program $40,250 - 0
15.808 U.s. Geological Survey_ Research and Data Collection $40,158 - 0
17.258 Wia Adult Program $40,000 - 0
81.112 Stewardship Science Grant Program $39,511 - 0
93.556 Promoting Safe and Stable Families $39,206 - 0
93.853 Extramural Research Programs in the Neurosciences and Neurological Disorders $37,802 - 0
93.000 Contract - Health and Human Services $37,524 - 0
93.233 National Center on Sleep Disorders Research $36,898 - 0
16.839 Stop School Violence $36,161 - 0
16.588 Violence Against Women Formula Grants $35,041 - 0
20.513 Enhanced Mobility of Seniors and Individuals with Disabilities $35,003 - 0
94.006 Americorps $34,703 - 0
93.889 National Bioterrorism Hospital Preparedness Program $33,981 - 0
84.379 Teacher Education Assistance for College and Higher Education Grants (teach Grants) $33,640 Yes 2
84.153 Business and International Education Projects $33,218 - 0
15.654 Visitor Facility Enhancements - Refuges and Wildlife $32,974 - 0
15.657 Endangered Species Conservation Ð Recovery Implementation Funds $32,645 - 0
93.336 Behavioral Risk Factor Surveillance System $32,421 - 0
12.005 Conservation and Rehabilitation of Natural Resources on Military Installations (b) $31,827 - 0
16.833 National Sexual Assault Kit Initiative $31,785 - 0
10.514 Expanded Food and Nutrition Education Program $29,891 - 0
93.153 Coordinated Services and Access to Research for Women, Infants, Children, and Youth $29,693 - 0
93.669 Child Abuse and Neglect State Grants $29,393 - 0
66.608 Environmental Information Exchange Network Grant Program and Related Assistance $29,239 - 0
93.323 Epidemiology and Laboratory Capacity for Infectious Diseases (elc) $27,843 - 0
93.121 Oral Diseases and Disorders Research $27,508 - 0
45.310 Grants to States $27,298 - 0
97.067 Homeland Security Grant Program $27,199 - 0
10.527 New Beginnings for Tribal Students $27,091 - 0
93.342 Health Professions Student Loans, Including Primary Care Loans/loans for Disadvantaged Students $26,479 Yes 2
93.866 Aging Research $26,363 - 0
84.425 Education Stabilization Fund $25,889 Yes 1
16.123 Community-Based Violence Prevention Program $24,597 - 0
10.525 Farm and Ranch Stress Assistance Network Competitive Grants Program (b) $24,255 - 0
93.394 Cancer Detection and Diagnosis Research $23,191 - 0
93.426 Improving the Health of Americans Through Prevention and Management of Diabetes and Heart Disease and Stroke $23,171 - 0
10.177 Regional Food System Partnerships (b) $23,108 - 0
93.421 Strengthening Public Health Systems and Services Through National Partnerships to Improve and Protect the Nation’s Health $22,991 - 0
81.000 Contract - Department of Energy $22,574 - 0
16.710 Public Safety Partnership and Community Policing Grants $21,477 - 0
15.231 Fish, Wildlife and Plant Conservation Resource Management $21,189 - 0
84.268 Federal Direct Student Loans $20,983 Yes 2
16.754 Harold Rogers Prescription Drug Monitoring Program $20,866 - 0
43.007 Space Operations $20,806 - 0
93.991 Preventive Health and Health Services Block Grant $20,638 - 0
15.225 Recreation Resource Management $20,568 - 0
93.104 Comprehensive Community Mental Health Services for Children with Serious Emotional Disturbances (sed) $20,429 - 0
11.459 Weather and Air Quality Research $20,338 - 0
11.805 Mbda Business Center $20,221 - 0
66.610 Surveys, Studies, Investigations and Special Purpose Grants Within the Office of the Administrator $20,206 - 0
93.397 Cancer Centers Support Grants $20,000 - 0
15.814 National Geological and Geophysical Data Preservation Program $19,765 - 0
93.738 Pphf: Racial and Ethnic Approaches to Community Health Program Financed Solely by Public Prevention and Health Funds $19,632 - 0
10.684 International Forestry Programs $19,623 - 0
10.332 Agricultural Genome to Phenome Initiative $19,573 - 0
15.246 Threatened and Endangered Species $19,508 - 0
20.600 State and Community Highway Safety $19,475 - 0
97.039 Hazard Mitigation Grant $19,438 - 0
93.391 Activities to Support State, Tribal, Local and Territorial (stlt) Health Department Response to Public Health Or Healthcare Crises $18,750 - 0
15.557 Desert and Southern Rockies Landscape Conservation Cooperatives $18,660 - 0
20.000 Contract - Department of Transportation $17,952 - 0
66.716 Research, Development, Monitoring, Public Education, Training, Demonstrations, and Studies $17,598 - 0
17.259 Wia Youth Activities $17,500 - 0
15.560 Secure Water Act Ð Research Agreements $17,377 - 0
15.637 Migratory Bird Joint Ventures $17,211 - 0
47.079 Office of International Science and Engineering $16,464 - 0
93.435 Innovative State and Local Public Health Strategies to Prevent and Manage Diabetes and Heart Disease and Stroke- $16,360 - 0
93.516 Affordable Care Act (aca) Public Health Training Centers Program $16,340 - 0
17.000 Contract - Department of Labor $16,118 - 0
97.130 National Nuclear Forensics Expertise Development Program $15,732 - 0
47.083 Integrative Activities $15,465 - 0
19.408 Academic Exchange Programs - Teachers $15,037 - 0
16.582 Crime Victim Assistance/discretionary Grants $14,939 - 0
81.087 Renewable Energy Research and Development $14,735 - 0
20.701 University Transportation Centers Program $14,709 - 0
10.558 Child and Adult Care Food Program $14,502 - 0
84.144 Migrant Education_coordination Program $14,318 - 0
84.367 Improving Teacher Quality State Grants $14,318 - 0
10.559 Summer Food Service Program for Children $14,312 - 0
11.468 Applied Meteorological Research $14,289 - 0
15.233 Forests and Woodlands Resource Management $13,886 - 0
93.262 Occupational Safety and Health Program $13,873 - 0
93.643 Children's Justice Grants to States $13,663 - 0
10.675 Urban and Community Forestry Program $13,447 - 0
10.170 Specialty Crop Block Grant Program - Farm Bill $13,194 - 0
81.123 National Nuclear Security Administration (nnsa) Minority Serving Institutions (msi) Program $12,692 - 0
15.247 Wildlife Resource Management $12,595 - 0
66.461 Regional Wetland Program Development Grants $12,459 - 0
15.508 Providing Water to At-Risk Natural Desert Terminal Lakes $12,130 - 0
93.070 Environmental Public Health and Emergency Response $12,105 - 0
10.215 Sustainable Agriculture Research and Education $11,843 - 0
16.585 Drug Court Discretionary Grant Program $11,496 - 0
98.001 Usaid Foreign Assistance for Programs Overseas $11,375 - 0
45.313 Laura Bush 21st Century Librarian Program $11,346 - 0
15.923 National Center for Preservation Technology and Training $10,605 - 0
17.273 Temporary Labor Certification for Foreign Workers $10,584 - 0
15.517 Fish and Wildlife Coordination Act $10,578 - 0
20.200 Highway Research and Development Program $10,355 - 0
93.116 Project Grants and Cooperative Agreements for Tuberculosis Control Programs $10,170 - 0
10.219 Biotechnology Risk Assessment Research $10,001 - 0
45.149 Promotion of the Humanities_division of Preservation and Access $10,000 - 0
43.008 Education $9,600 - 0
19.040 Public Diplomacy Programs $9,270 - 0
12.905 Cybersecurity Core Curriculum $9,220 - 0
93.286 Discovery and Applied Research for Technological Innovations to Improve Human Health $9,187 - 0
84.027 Special Education_grants to States $8,876 - 0
43.001 Science $8,531 - 0
15.224 Cultural Resource Management $8,526 - 0
93.310 Trans-Nih Research Support $8,325 - 0
84.323 Special Education - State Personnel Development $8,050 - 0
47.078 Polar Programs $7,935 - 0
66.419 Water Pollution Control State, Interstate, and Tribal Program Support $7,816 - 0
15.073 Earth Mapping Resource Initiative $7,806 - 0
93.136 Injury Prevention and Control Research and State and Community Based Programs $7,645 - 0
93.052 National Family Caregiver Support, Title Iii, Part E $7,604 - 0
15.810 National Cooperative Geologic Mapping Program $7,459 - 0
15.245 Plant Conservation and Restoration Management $7,379 - 0
93.977 Preventive Health Services_sexually Transmitted Diseases Control Grants $6,965 - 0
93.334 The Healthy Brain Initiative: Technical Assistance to Implement Public Health Actions Related to Cognitive Health, Cognitive Impairment, and Caregiving at the State and Local Levels $6,944 - 0
10.902 Soil and Water Conservation $6,900 - 0
10.707 Research Joint Venture and Cost Reimbursable Agreements $6,630 - 0
15.248 National Landscape Conservation System (b) $6,627 - 0
47.076 Education and Human Resources $6,339 - 0
93.859 Biomedical Research and Research Training $6,256 - 0
12.420 Military Medical Research and Development $6,196 - 0
81.135 Advanced Research Projects Agency - Energy $6,120 - 0
11.611 Manufacturing Extension Partnership $5,535 - 0
15.820 National Climate Change and Wildlife Science Center $5,528 - 0
15.615 Cooperative Endangered Species Conservation Fund $5,271 - 0
93.898 Cancer Prevention and Control Programs for State, Territorial and Tribal Organizations $5,162 - 0
45.024 Promotion of the Arts_grants to Organizations and Individuals $5,101 - 0
11.307 Economic Adjustment Assistance $5,088 - 0
84.411 Investing in Innovation (i3) Fund $4,984 - 0
93.135 Centers for Research and Demonstration for Health Promotion and Disease Prevention $4,771 - 0
15.684 White-Nose Syndrome National Response Implementation $4,609 - 0
16.320 Services for Trafficking Victims $4,581 - 0
93.113 Environmental Health $4,518 - 0
93.665 Emergency Grants to Address Mental and Substance Use Disorders During Covid-19 $4,404 - 0
93.387 National and State Tobacco Control Program (b) $4,351 - 0
43.003 Exploration $4,319 - 0
81.121 Nuclear Energy Research, Development and Demonstration $4,294 - 0
81.049 Office of Science Financial Assistance Program $4,233 - 0
19.009 Academic Exchange Programs - Undergraduate Programs $4,168 - 0
45.025 Promotion of the Arts_partnership Agreements $4,000 - 0
15.634 State Wildlife Grants $3,748 - 0
10.515 Renewable Resources Extension Act and National Focus Fund Projects $3,702 - 0
15.670 Adaptive Science $3,680 - 0
12.910 Research and Technology Development $3,603 - 0
10.500 Cooperative Extension Service $3,488 - 0
93.994 Maternal and Child Health Services Block Grant to the States $3,407 - 0
16.607 Bulletproof Vest Partnership Program $3,385 - 0
43.012 Space Technology $3,279 - 0
10.329 Crop Protection and Pest Management Competitive Grants Program $3,034 - 0
15.611 Wildlife Restoration and Basic Hunter Education $3,027 - 0
93.600 Head Start $2,965 - 0
16.560 National Institute of Justice Research, Evaluation, and Development Project Grants $2,636 - 0
84.334 Gaining Early Awareness and Readiness for Undergraduate Programs $2,202 - 0
11.432 National Oceanic and Atmospheric Administration (noaa) Cooperative Institutes $1,998 - 0
10.556 Special Milk Program for Children $1,966 - 0
84.010 Title I Grants to Local Educational Agencies $1,862 - 0
10.561 State Administrative Matching Grants for the Supplemental Nutrition Assistance Program $1,830 - 0
93.155 Rural Health Research Centers $1,775 - 0
84.287 Twenty-First Century Community Learning Centers $1,639 - 0
84.324 Research in Special Education $1,620 - 0
10.652 Forestry Research $1,617 - 0
47.049 Mathematical and Physical Sciences $1,573 - 0
93.940 Hiv Prevention Activities_health Department Based $1,489 - 0
11.431 Climate and Atmospheric Research $1,478 - 0
47.041 Engineering $1,203 - 0
94.026 National Service and Civic Engagement Research Competition $1,070 - 0
93.870 Maternal, Infant and Early Childhood Home Visiting Grant $1,065 - 0
66.460 Nonpoint Source Implementation Grants $1,039 - 0
47.075 Social, Behavioral, and Economic Sciences $1,016 - 0
93.048 Special Programs for the Aging_title Iv_and Title Ii_discretionary Projects $1,013 - 0
20.205 Highway Planning and Construction $975 - 0
12.431 Basic Scientific Research $920 - 0
93.072 Lifespan Respite Care Program $900 - 0
47.084 Nsf Technology, Innovation, and Partnerships $870 - 0
10.000 Contract - Department of Agriculture $853 - 0
93.044 Special Programs for the Aging_title Iii, Part B_grants for Supportive Services and Senior Centers $799 - 0
47.070 Computer and Information Science and Engineering $660 - 0
15.608 Fish and Wildlife Management Assistance $629 - 0
20.616 National Priority Safety Programs $430 - 0
94.021 Volunteer Generation Fund $345 - 0
10.001 Agricultural Research_basic and Applied Research $280 - 0
16.575 Crime Victim Assistance $129 - 0
15.945 Cooperative Research and Training Programs Ð Resources of the National Park System $123 - 0
16.000 Contract - Department of Justice $73 - 0
47.074 Biological Sciences $44 - 0
93.243 Substance Abuse and Mental Health Services_projects of Regional and National Significance $1 - 0
93.632 University Centers for Excellence in Developmental Disabilities Education, Research, and Service $-2 - 0
15.807 Earthquake Hazards Research Grants $-2 - 0
93.301 Small Rural Hospital Improvement Grant Program $-23 - 0
15.235 Southern Nevada Public Land Management $-46 - 0
47.050 Geosciences $-87 - 0
93.464 Acl Assistive Technology $-90 - 0
15.678 Cooperative Ecosystem Studies Units $-108 - 0
21.019 Coronavirus Relief Fund $-135 - 0
84.184 Safe and Drug-Free Schools and Communities_national Programs $-155 - 0
93.946 Cooperative Agreements to Support State-Based Safe Motherhood and Infant Health Initiative Programs $-158 - 0
81.122 Electricity Delivery and Energy Reliability, Research, Development and Analysis $-167 - 0
45.129 Promotion of the Humanities_federal/state Partnership $-195 - 0
43.000 Contract - National Aeronautics and Space Administration $-390 - 0
10.310 Agriculture and Food Research Initiative (afri) $-610 - 0
84.327 Special Education_educational Technology Media, and Materials for Individuals with Disabilities $-1,181 - 0
84.063 Federal Pell Grant Program $-1,332 Yes 2
93.575 Child Care and Development Block Grant $-1,709 - 0
12.300 Basic and Applied Scientific Research $-2,286 - 0
93.958 Block Grants for Community Mental Health Services $-2,755 - 0
45.160 Promotion of the Humanities_fellowships and Stipends $-3,289 - 0
93.279 Drug Abuse and Addiction Research Programs $-3,349 - 0
59.037 Small Business Development Centers $-5,452 - 0
12.800 Air Force Defense Research Sciences Program $-6,081 - 0
93.867 Vision Research $-8,593 - 0
97.091 Homeland Security Biowatch Program $-12,587 - 0
93.865 Child Health and Human Development Extramural Research $-20,180 - 0
93.837 Cardiovascular Diseases Research $-22,009 - 0
12.000 Contract - Department of Defense $-27,372 - 0
12.351 Basic Scientific Research - Combating Weapons of Mass Destruction $-57,883 - 0
93.788 Opioid Str $-62,499 Yes 0
93.846 Arthritis, Musculoskeletal and Skin Diseases Research $-92,336 - 0
12.340 Naval Medical Research and Development $-93,045 - 0
93.855 Allergy, Immunology and Transplantation Research $-125,083 - 0
93.847 Diabetes, Digestive, and Kidney Diseases Extramural Research $-133,859 - 0
93.393 Cancer Cause and Prevention Research $-136,704 - 0

Contacts

Name Title Type
F995DBS4SRN3 Rhett Vertrees Auditee
7757833409 Kim McCormick Auditor
No contacts on file

Notes to SEFA

Title: 1 Accounting Policies: Note 1: The purpose of the Supplementary Schedule of Expenditures of Federal Awards is to present a summary of the activities of the Nevada System of Higher Education for the year ended June 30, 2023, which have been financed by the United States Government. For the purpose of this Schedule, Federal awards have been classified into two types: - Direct Federal awards - Pass-through funds received from non-Federal organizations made under Federally sponsored programs coordinated by those organizations Because the Schedule presents only a selected portion of the activities of the Nevada System of Higher Education, it is not intended to and does not present either the net position, revenues, expenses, changes in net position, or changes in cash flows of the Nevada System of Higher Education. The Nevada System of Higher Education consists of: University of Nevada, Reno University of Nevada, Las Vegas Desert Research Institute Nevada State College College of Southern Nevada Great Basin College Truckee Meadows Community College Western Nevada College Nevada System of Higher Education System Administration The Schedule is prepared on the accrual basis of accounting. The Schedule does not include inter-system pass-through funds or the federal award activity of UNLV Medicine who have their Uniform Guidance audits conducted separately, as applicable. Note 2: The Federal Perkins, Nursing Faculty Loan Programs (“NFLP”), Nursing Student Loan Programs (“NSLP”) and Health Professions Student Loan Programs (“HPSL”) are administered directly by the System and balances and transactions relating to these programs are included in the System’s financial statements. Loans outstanding at the beginning of the year and loans made during the year are included in the federal expenditures presented in the Schedule. The balances of loans outstanding under the Perkins, NFLP, NSLP, and HPSL programs were $1,095,244, $1,406,392, $1,168,658, and $13,087, respectively as of June 30, 2023. Note 3: The total value of the Federal awards in the form of non-cash assistance during the fiscal year ended June 30, 2023, was zero De Minimis Rate Used: N Rate Explanation: For fiscal year 2023, NSHE institutions utilize negotiated indirect rates, and NSHE does not utilize the 10% de minimis rate provided by Uniform Guidance. The purpose of the Supplementary Schedule of Expenditures of Federal Awards is to present a summary of the activities of the Nevada System of Higher Education for the year ended June 30, 2023, which have been financed by the United States Government. For the purpose of this Schedule, Federal awards have been classified into two types: - Direct Federal awards - Pass-through funds received from non-Federal organizations made under Federally sponsored programs coordinated by those organizations Because the Schedule presents only a selected portion of the activities of the Nevada System of Higher Education, it is not intended to and does not present either the net position, revenues, expenses, changes in net position, or changes in cash flows of the Nevada System of Higher Education. The Nevada System of Higher Education consists of: University of Nevada, Reno University of Nevada, Las Vegas Desert Research Institute Nevada State College College of Southern Nevada Great Basin College Truckee Meadows Community College Western Nevada College Nevada System of Higher Education System Administration The Schedule is prepared on the accrual basis of accounting. The Schedule does not include inter-system pass-through funds or the federal award activity of UNLV Medicine who have their Uniform Guidance audits conducted separately, as applicable.
Title: 2 Accounting Policies: Note 1: The purpose of the Supplementary Schedule of Expenditures of Federal Awards is to present a summary of the activities of the Nevada System of Higher Education for the year ended June 30, 2023, which have been financed by the United States Government. For the purpose of this Schedule, Federal awards have been classified into two types: - Direct Federal awards - Pass-through funds received from non-Federal organizations made under Federally sponsored programs coordinated by those organizations Because the Schedule presents only a selected portion of the activities of the Nevada System of Higher Education, it is not intended to and does not present either the net position, revenues, expenses, changes in net position, or changes in cash flows of the Nevada System of Higher Education. The Nevada System of Higher Education consists of: University of Nevada, Reno University of Nevada, Las Vegas Desert Research Institute Nevada State College College of Southern Nevada Great Basin College Truckee Meadows Community College Western Nevada College Nevada System of Higher Education System Administration The Schedule is prepared on the accrual basis of accounting. The Schedule does not include inter-system pass-through funds or the federal award activity of UNLV Medicine who have their Uniform Guidance audits conducted separately, as applicable. Note 2: The Federal Perkins, Nursing Faculty Loan Programs (“NFLP”), Nursing Student Loan Programs (“NSLP”) and Health Professions Student Loan Programs (“HPSL”) are administered directly by the System and balances and transactions relating to these programs are included in the System’s financial statements. Loans outstanding at the beginning of the year and loans made during the year are included in the federal expenditures presented in the Schedule. The balances of loans outstanding under the Perkins, NFLP, NSLP, and HPSL programs were $1,095,244, $1,406,392, $1,168,658, and $13,087, respectively as of June 30, 2023. Note 3: The total value of the Federal awards in the form of non-cash assistance during the fiscal year ended June 30, 2023, was zero De Minimis Rate Used: N Rate Explanation: For fiscal year 2023, NSHE institutions utilize negotiated indirect rates, and NSHE does not utilize the 10% de minimis rate provided by Uniform Guidance. The Federal Perkins, Nursing Faculty Loan Programs (“NFLP”), Nursing Student Loan Programs (“NSLP”) and Health Professions Student Loan Programs (“HPSL”) are administered directly by the System and balances and transactions relating to these programs are included in the System’s financial statements. Loans outstanding at the beginning of the year and loans made during the year are included in the federal expenditures presented in the Schedule. The balances of loans outstanding under the Perkins, NFLP, NSLP, and HPSL programs were $1,095,244, $1,406,392, $1,168,658, and $13,087, respectively as of June 30, 2023.
Title: 3 Accounting Policies: Note 1: The purpose of the Supplementary Schedule of Expenditures of Federal Awards is to present a summary of the activities of the Nevada System of Higher Education for the year ended June 30, 2023, which have been financed by the United States Government. For the purpose of this Schedule, Federal awards have been classified into two types: - Direct Federal awards - Pass-through funds received from non-Federal organizations made under Federally sponsored programs coordinated by those organizations Because the Schedule presents only a selected portion of the activities of the Nevada System of Higher Education, it is not intended to and does not present either the net position, revenues, expenses, changes in net position, or changes in cash flows of the Nevada System of Higher Education. The Nevada System of Higher Education consists of: University of Nevada, Reno University of Nevada, Las Vegas Desert Research Institute Nevada State College College of Southern Nevada Great Basin College Truckee Meadows Community College Western Nevada College Nevada System of Higher Education System Administration The Schedule is prepared on the accrual basis of accounting. The Schedule does not include inter-system pass-through funds or the federal award activity of UNLV Medicine who have their Uniform Guidance audits conducted separately, as applicable. Note 2: The Federal Perkins, Nursing Faculty Loan Programs (“NFLP”), Nursing Student Loan Programs (“NSLP”) and Health Professions Student Loan Programs (“HPSL”) are administered directly by the System and balances and transactions relating to these programs are included in the System’s financial statements. Loans outstanding at the beginning of the year and loans made during the year are included in the federal expenditures presented in the Schedule. The balances of loans outstanding under the Perkins, NFLP, NSLP, and HPSL programs were $1,095,244, $1,406,392, $1,168,658, and $13,087, respectively as of June 30, 2023. Note 3: The total value of the Federal awards in the form of non-cash assistance during the fiscal year ended June 30, 2023, was zero De Minimis Rate Used: N Rate Explanation: For fiscal year 2023, NSHE institutions utilize negotiated indirect rates, and NSHE does not utilize the 10% de minimis rate provided by Uniform Guidance. The total value of the Federal awards in the form of non-cash assistance during the fiscal year ended June 30, 2023, was zero.
Title: 4 Accounting Policies: Note 1: The purpose of the Supplementary Schedule of Expenditures of Federal Awards is to present a summary of the activities of the Nevada System of Higher Education for the year ended June 30, 2023, which have been financed by the United States Government. For the purpose of this Schedule, Federal awards have been classified into two types: - Direct Federal awards - Pass-through funds received from non-Federal organizations made under Federally sponsored programs coordinated by those organizations Because the Schedule presents only a selected portion of the activities of the Nevada System of Higher Education, it is not intended to and does not present either the net position, revenues, expenses, changes in net position, or changes in cash flows of the Nevada System of Higher Education. The Nevada System of Higher Education consists of: University of Nevada, Reno University of Nevada, Las Vegas Desert Research Institute Nevada State College College of Southern Nevada Great Basin College Truckee Meadows Community College Western Nevada College Nevada System of Higher Education System Administration The Schedule is prepared on the accrual basis of accounting. The Schedule does not include inter-system pass-through funds or the federal award activity of UNLV Medicine who have their Uniform Guidance audits conducted separately, as applicable. Note 2: The Federal Perkins, Nursing Faculty Loan Programs (“NFLP”), Nursing Student Loan Programs (“NSLP”) and Health Professions Student Loan Programs (“HPSL”) are administered directly by the System and balances and transactions relating to these programs are included in the System’s financial statements. Loans outstanding at the beginning of the year and loans made during the year are included in the federal expenditures presented in the Schedule. The balances of loans outstanding under the Perkins, NFLP, NSLP, and HPSL programs were $1,095,244, $1,406,392, $1,168,658, and $13,087, respectively as of June 30, 2023. Note 3: The total value of the Federal awards in the form of non-cash assistance during the fiscal year ended June 30, 2023, was zero De Minimis Rate Used: N Rate Explanation: For fiscal year 2023, NSHE institutions utilize negotiated indirect rates, and NSHE does not utilize the 10% de minimis rate provided by Uniform Guidance. For fiscal year 2023, NSHE institutions utilize negotiated indirect rates, and NSHE does not utilize the 10% de minimis rate provided by Uniform Guidance.

Finding Details

Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Internal Control over Compliance (Repeat Finding 2022-003, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Federal Programs Departments of Education and Department of Health and Human Services Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Department of Education Education Stabilization Fund (COVID-19) (Assistance Listing number 84.425E) Award year ended June 30, 2023 Criteria: 2 CFR 200.303(a) requires that non-Federal entities receiving Federal awards establish and maintain effective internal control over the Federal award to provide reasonable assurance that they are managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: At the University of Nevada, Reno (“UNR”), University of Nevada, Las Vegas (“UNLV”), and System Computing Services (“SCS”), we noted deficiencies in security administration related to the information technology general controls (“ITGCs”) in the PeopleSoft application. Specifically, controls were lacking around restriction of elevated access, user access reviews, termination of access and segregation of duties as it relates to the PeopleSoft application over the student financial assistance program. Context: During our testing of the ITGCs in the PeopleSoft application, we noted the following segregation of duties issues: (1) At UNLV, UNR and SCS, several users have both PeopleSoft Administrator rights within the Production and Development Environment. (2) At UNLV, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (3) At UNR, three users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (4) At SCS, UNR and UNLV, no appropriate level of review of the activities performed by users with access to modify production during the audit period. (5) At SCS, four users have both Production and Development environment access which allows them to modify PS objects and perform change management duties. (6) At SCS, UNR and UNLV, activity performed by users with segregation of duties conflicts (see 1-3, 5 above), are not formally reviewed on a periodic basis for appropriateness. The deficiencies in security administration controls could impact compliance requirements related to determining eligibility, disbursements, return of Title IV funds and verification. Questioned Costs: $0 Effect: 1. Security Administration (#4) and Change Management (#1-3, #5 & #6)-Student data within the PeopleSoft application may be affected by users having conflicting roles or access levels, and accountability may not be established. Student data may be affected by unauthorized, inappropriate, or untested changes to the system. This could impact eligibility, disbursements, return of Title IV funds and verification. Cause: The issues identified are part of the lack of effective ITGCs in the PeopleSoft application for the majority of the fiscal year. Recommendation: 1. Security Administration (#4) - Management should perform a formally documented periodic review of user activities. 2. Change Management(#1-3, #5-6) - Management should segregate duties and remove users with access to both the Development and Production environments (limiting them to be able to access just one environment) or implement a formal review process over the activities performed by those responsible for program maintenance on a periodic basis. As of 4/28/2023, management has reported to us findings #1-3, #5 were remediated as the segregation of duties (“SOD”) access was revoked. However, due to the timing of remediation, management should perform a formally documented review of users activities for the period of 7/1/2022-4/7/2023. Views of Responsible Officials (unaudited): Management concurs. In addition, as of 4/28/2023, management has taken action to remove access which was causing SOD conflicts to address findings #1-3, #5.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.
Special Tests and Provisions: Return of Title IV funds for withdrawn students (Repeat finding 2021-004, 2020-002, 2019-003, 2018-005, 2017-004, 2016-003, 2015-004, 2014-011) Federal Programs: Department of Education Student Financial Assistance Cluster (Various Assistance Listing numbers) Award year ended June 30, 2023 Criteria: Pursuant to the 34 CFR 668.22(j)(2), an institution is required to determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew to allow for the timely calculation and return of Title IV funds as required. Pursuant to the 34 CFR 668.22(e), an institution is required to calculate the amount of Title IV assistance earned by the student once the institution has determined the withdrawal date in accordance with the 34 CFR 668.22(j), and pursuant to the 34 CFR 668.22(g), an institution is required to calculate and return unearned aid in the order as required: the lesser of the total amount of unearned Title IV assistance to be returned as calculated under 34 CFR 668.22(e)(4); or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance that has not been earned by the student, as described in 34 CFR 668.22(e)(3). Pursuant to the 34 CFR 690.83(b)(2) an institution shall submit, in accordance with deadline dates established by the U.S. Department of Education (Secretary), through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Pursuant to 34 CFR 668.22(j)(1), an institution must return the amount of Title IV funds for which it is responsible as soon as, but no later than 45 days, after the date of the institution's determination that the student withdrew. 34 CFR 668.22(d) requires that an institution does not have to treat a leave of absence as a withdrawal if it is an approved leave of absence. A leave of absence is an approved leave of absence if - (i) The institution has a formal policy regarding leaves of absence; (ii) The student followed the institution's policy in requesting the leave of absence; (iii) The institution determines that there is a reasonable expectation that the student will return to the school; (iv) The institution approved the student's request in accordance with the institution's policy; (v) The leave of absence does not involve additional charges by the institution; (vi) The number of days in the approved leave of absence, when added to the number of days in all other approved leaves of absence, does not exceed 180 days in any 12-month period; (vii) Except for a clock hour or nonterm credit hour program, upon the student's return from the leave of absence, the student is permitted to complete the coursework he or she began prior to the leave of absence; and (viii) If the student is a title IV, HEA program loan recipient, the institution explains to the student, prior to granting the leave of absence, the effects that the student's failure to return from a leave of absence may have on the student's loan repayment terms, including the exhaustion of some or all of the student's grace period. Condition: During our testing at CSN, we identified the following instance: the Institution did not complete the return of Title IV funds as calculated within the 45-day requirement as noted in the Federal Regulations. Context: For two out of sixty students tested at CSN, the funds to be returned were not returned within the 45-day timeframe. Questioned Costs: CSN - $0 Effect: CSN was not compliant with the timeliness rules for two students in our sample. Cause: Lack of oversight. Recommendation: We recommend that CSN adhere to its established controls to ensure the timely return of funds. Views of Responsible Officials (unaudited): Management concurs.