Criteria: The disbursement amounts and dates reported to the Department of Education must be the amounts and dates of the actual disbursement to the students’ accounts (CFR 34 668.164).
Condition: The Organization did not report actual loan disbursement dates to the Common Origination and Disbursement (COD) system for 7 of the 8 students in the sample (87.5%). We consider this condition to be a material weakness in internal control over compliance relating to the Eligibility compliance requirement. Statistical sampling was not used in making sample selections.
Questioned Costs: N/A
Cause: The Organization noted this was an error that occurred using the G5 drawdown date instead of the actual disbursement date per the students’ account ledgers.
Effect: The result is incorrect disbursement dates were reported to the Department of Education.
Recommendation: We recommend the Organization correct the disbursement dates in COD and tighten controls over reporting disbursement dates.
Views of Responsible Officials: Management agrees with this Single Audit Finding and response is included in the Corrective Action Plan.
Criteria: The disbursement amounts and dates reported to the Department of Education must be the amounts and dates of the actual disbursement to the students’ accounts (CFR 34 668.164).
Condition: The Organization did not report actual loan disbursement dates to the Common Origination and Disbursement (COD) system for 7 of the 8 students in the sample (87.5%). We consider this condition to be a material weakness in internal control over compliance relating to the Eligibility compliance requirement. Statistical sampling was not used in making sample selections.
Questioned Costs: N/A
Cause: The Organization noted this was an error that occurred using the G5 drawdown date instead of the actual disbursement date per the students’ account ledgers.
Effect: The result is incorrect disbursement dates were reported to the Department of Education.
Recommendation: We recommend the Organization correct the disbursement dates in COD and tighten controls over reporting disbursement dates.
Views of Responsible Officials: Management agrees with this Single Audit Finding and response is included in the Corrective Action Plan.
Criteria: Institutions shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue. The information security program shall include the elements set forth in § 314.4 and shall be reasonably designed to achieve the objectives of this part, as set forth in the objectives of section 501(b) of the Act (16 CFR 314.3(a)).
Base your information security program on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 314.4(b)).
Condition: The Organization failed to implement the new Gramm-Leach-Bliley Act’s (GLBA) standards for safeguarding customer information to their student information security policy. We consider this finding to be a material weakness in relation to Special Tests and Provisions. Statistical sampling was not used in making sample selections.
Questioned Costs: N/A
Cause: The condition was caused by the Organization’s security officer being unaware of the new GLBA requirements.
Effect: The result is the Organization did not meet the requirements for protecting and securing data obtained from the Department of Education’s systems for the purposes of administering the Title IV programs.
Recommendation: We recommend the Organization update their student information security program to adhere to the regulations and await guidance from the Department of Education.
Views of Responsible Officials: Management agrees with this Single Audit Finding and response is included in the Corrective Action Plan.
Criteria: Institutions shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue. The information security program shall include the elements set forth in § 314.4 and shall be reasonably designed to achieve the objectives of this part, as set forth in the objectives of section 501(b) of the Act (16 CFR 314.3(a)).
Base your information security program on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 314.4(b)).
Condition: The Organization failed to implement the new Gramm-Leach-Bliley Act’s (GLBA) standards for safeguarding customer information to their student information security policy. We consider this finding to be a material weakness in relation to Special Tests and Provisions. Statistical sampling was not used in making sample selections.
Questioned Costs: N/A
Cause: The condition was caused by the Organization’s security officer being unaware of the new GLBA requirements.
Effect: The result is the Organization did not meet the requirements for protecting and securing data obtained from the Department of Education’s systems for the purposes of administering the Title IV programs.
Recommendation: We recommend the Organization update their student information security program to adhere to the regulations and await guidance from the Department of Education.
Views of Responsible Officials: Management agrees with this Single Audit Finding and response is included in the Corrective Action Plan.
Criteria: The disbursement amounts and dates reported to the Department of Education must be the amounts and dates of the actual disbursement to the students’ accounts (CFR 34 668.164).
Condition: The Organization did not report actual loan disbursement dates to the Common Origination and Disbursement (COD) system for 7 of the 8 students in the sample (87.5%). We consider this condition to be a material weakness in internal control over compliance relating to the Eligibility compliance requirement. Statistical sampling was not used in making sample selections.
Questioned Costs: N/A
Cause: The Organization noted this was an error that occurred using the G5 drawdown date instead of the actual disbursement date per the students’ account ledgers.
Effect: The result is incorrect disbursement dates were reported to the Department of Education.
Recommendation: We recommend the Organization correct the disbursement dates in COD and tighten controls over reporting disbursement dates.
Views of Responsible Officials: Management agrees with this Single Audit Finding and response is included in the Corrective Action Plan.
Criteria: The disbursement amounts and dates reported to the Department of Education must be the amounts and dates of the actual disbursement to the students’ accounts (CFR 34 668.164).
Condition: The Organization did not report actual loan disbursement dates to the Common Origination and Disbursement (COD) system for 7 of the 8 students in the sample (87.5%). We consider this condition to be a material weakness in internal control over compliance relating to the Eligibility compliance requirement. Statistical sampling was not used in making sample selections.
Questioned Costs: N/A
Cause: The Organization noted this was an error that occurred using the G5 drawdown date instead of the actual disbursement date per the students’ account ledgers.
Effect: The result is incorrect disbursement dates were reported to the Department of Education.
Recommendation: We recommend the Organization correct the disbursement dates in COD and tighten controls over reporting disbursement dates.
Views of Responsible Officials: Management agrees with this Single Audit Finding and response is included in the Corrective Action Plan.
Criteria: Institutions shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue. The information security program shall include the elements set forth in § 314.4 and shall be reasonably designed to achieve the objectives of this part, as set forth in the objectives of section 501(b) of the Act (16 CFR 314.3(a)).
Base your information security program on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 314.4(b)).
Condition: The Organization failed to implement the new Gramm-Leach-Bliley Act’s (GLBA) standards for safeguarding customer information to their student information security policy. We consider this finding to be a material weakness in relation to Special Tests and Provisions. Statistical sampling was not used in making sample selections.
Questioned Costs: N/A
Cause: The condition was caused by the Organization’s security officer being unaware of the new GLBA requirements.
Effect: The result is the Organization did not meet the requirements for protecting and securing data obtained from the Department of Education’s systems for the purposes of administering the Title IV programs.
Recommendation: We recommend the Organization update their student information security program to adhere to the regulations and await guidance from the Department of Education.
Views of Responsible Officials: Management agrees with this Single Audit Finding and response is included in the Corrective Action Plan.
Criteria: Institutions shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue. The information security program shall include the elements set forth in § 314.4 and shall be reasonably designed to achieve the objectives of this part, as set forth in the objectives of section 501(b) of the Act (16 CFR 314.3(a)).
Base your information security program on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 314.4(b)).
Condition: The Organization failed to implement the new Gramm-Leach-Bliley Act’s (GLBA) standards for safeguarding customer information to their student information security policy. We consider this finding to be a material weakness in relation to Special Tests and Provisions. Statistical sampling was not used in making sample selections.
Questioned Costs: N/A
Cause: The condition was caused by the Organization’s security officer being unaware of the new GLBA requirements.
Effect: The result is the Organization did not meet the requirements for protecting and securing data obtained from the Department of Education’s systems for the purposes of administering the Title IV programs.
Recommendation: We recommend the Organization update their student information security program to adhere to the regulations and await guidance from the Department of Education.
Views of Responsible Officials: Management agrees with this Single Audit Finding and response is included in the Corrective Action Plan.