Audit 309593

2022 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2021-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: No Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022-003: Reporting – FISAP Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The University submitted inaccurate data in its annual FISAP report. Questioned Costs: None. Context: Section F Independent Taxable Income With Baccalaureate total per the FISAP is 5 but the support provide shows the total is 9. Graduate total per the FISAP is 25 but the support provide shows the total is 37. Cause: Due to change in management and turnover in office, in completing the data entry, there was no oversight to ensure reporting was accurate to the supporting University records. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: We recommend the applicable campus revise procedures to ensure that the record retention requirements are met and supporting documentation agrees to the FISAP, including a supervisory review by someone other than the preparer. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-004: Special Tests & Provision – Outstanding Checks over 240 Days Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: Student checks related to student refunds of Title IV federal financial aid was outstanding more than 240 days as of June 30, 2022. Questioned Costs: $45,109. Context: During our audit procedures, it was noted that the University had 84 Title IV outstanding checks at June 30, 2022, that aged over 240 days. The outstanding checks have not been canceled or the funds returned to the Secretary. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures related to Title IV outstanding checks. Effect: The University is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: No Recommendation: We recommend that the University review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-005: Special Tests & Provisions – Enrollment Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34CFR section 682.610 states that all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a Roster file. Rosters must be returned within 15 days and any subsequent error records must be returned within 10 days. Condition: The University’s June 2022 roster was not returned within 15 days of receipt. The University did not maintain reporting records for 13 of 38 students selected for testing. It was noted that 1 of the 38 students' enrollment status per institution records and NSLDS did not agree. Questioned Costs: None Context: While the University is reporting enrollment to the Clearinghouse each month, the June enrollment roster was not returned within the required 15-day period. While the University is reporting enrollment changes, it does not have adequate policies and procedure to ensure documentation for reporting is accurately reported and retained. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures to ensure accurate, timely, and complete enrollment reporting. Effect: National Student Loan Database System (NSLDS) is not updated with the student information which can cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes – 2021-003. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all enrollment records are reported correctly and within the required time period. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-006: Special Tests and Provisions – Return of Title IV Funding Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The financial aid personnel and the accounting department and the management accounting systems of each non-Federal entity must provide for, effective controls over, and accountability for all students the withdraws from the University [2 CFR §668.22]. Condition: The return to Title IV funding calculations performed on students withdrawn from the eligibility sample did not include a control process to review and approve the calculations for accuracy prior to changes being made to the student’s award. Questioned Costs: None. Context: During our audit procedures, the calculations that were preformed did not include documentation of the control process to review and approve the calculations prior to changes being made to the student’s award. Cause: The University must maintain adequate data and documentation, but due to change in management and turnover in office, there was a lack of conveying institutional knowledge and processes. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: Yes – 2021-004. Recommendation: We recommend the institution maintain proper documentation in accordance with federal grantor requirements and ensure that the documents are readily available for review upon request, including monitoring of students with triggering events that require a return to Title IV calculation to be completed, reviewed, and approved. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-007: Reporting – Common Origination and Disbursement (COD) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- From the 2022-23 FSA Handbook: to be in compliance with reporting disbursements and disbursement adjustments within 15 days. The date funds are credited to a student’s account in the institution’s general ledger or any subledger of the general ledger or paid to a student directly is the disbursement date the financial aid office reports to COD. The Common Origination and Disbursement (COD) additional requirements are: (1) Schools must use the COD system to request and receive federal student aid funds, including Direct Loans, Pell Grants, and Campus-Based aid programs. Schools must ensure that all disbursements of federal student aid are made through the COD system. (2) Schools must reconcile their records with the COD system to ensure that all disbursements are accurately reported and recorded. (3) Schools must comply with COD reporting requirements, including reporting disbursements, adjustments, and cancellations in a timely and accurate manner. Condition: For one (1) of 33 students tested, the Fall 2022 disbursement dates in COD for Pell did not match the disbursement date on the student ledgers. Questioned Costs: None. Context: The Fall 2022 disbursement dates in COD for the student in question is October 29, 2021, but on the student ledger the date is December 15, 2021. Cause: Employee turnover during the 2021-2022 academic year caused this process to not be completed accurately. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: No Recommendation: We recommend that the entity strengthen its internal controls to ensure that all disbursement dates are reported to COD accurately and timely. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-009: Special Tests and Provisions – The Gramm-Leach-Bliley Act (GLBA) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Material Weakness in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned Costs: None Context: During our audit procedures, it was noted that the University did not conduct a risk assessment that addresses (2) and (3) of the 3 areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University experienced turnover in the department responsible for this process and had a ransomware cyber-attack during the year ended June 30, 2022. Effect: The student personal information could be vulnerable. Repeat Finding: Yes – 2021-002. Recommendation: We recommend the University engage a third party or perform the risk assessment for the two areas required by the Gramm-Leach-Bliley Act that have not been completed and documented and ensure that there are documented safeguards for identified risks. Views of Responsible Officials: There is no disagreement with the audit finding.

2022 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2021-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: No Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022-003: Reporting – FISAP Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The University submitted inaccurate data in its annual FISAP report. Questioned Costs: None. Context: Section F Independent Taxable Income With Baccalaureate total per the FISAP is 5 but the support provide shows the total is 9. Graduate total per the FISAP is 25 but the support provide shows the total is 37. Cause: Due to change in management and turnover in office, in completing the data entry, there was no oversight to ensure reporting was accurate to the supporting University records. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: We recommend the applicable campus revise procedures to ensure that the record retention requirements are met and supporting documentation agrees to the FISAP, including a supervisory review by someone other than the preparer. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-004: Special Tests & Provision – Outstanding Checks over 240 Days Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: Student checks related to student refunds of Title IV federal financial aid was outstanding more than 240 days as of June 30, 2022. Questioned Costs: $45,109. Context: During our audit procedures, it was noted that the University had 84 Title IV outstanding checks at June 30, 2022, that aged over 240 days. The outstanding checks have not been canceled or the funds returned to the Secretary. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures related to Title IV outstanding checks. Effect: The University is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: No Recommendation: We recommend that the University review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-005: Special Tests & Provisions – Enrollment Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34CFR section 682.610 states that all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a Roster file. Rosters must be returned within 15 days and any subsequent error records must be returned within 10 days. Condition: The University’s June 2022 roster was not returned within 15 days of receipt. The University did not maintain reporting records for 13 of 38 students selected for testing. It was noted that 1 of the 38 students' enrollment status per institution records and NSLDS did not agree. Questioned Costs: None Context: While the University is reporting enrollment to the Clearinghouse each month, the June enrollment roster was not returned within the required 15-day period. While the University is reporting enrollment changes, it does not have adequate policies and procedure to ensure documentation for reporting is accurately reported and retained. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures to ensure accurate, timely, and complete enrollment reporting. Effect: National Student Loan Database System (NSLDS) is not updated with the student information which can cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes – 2021-003. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all enrollment records are reported correctly and within the required time period. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-006: Special Tests and Provisions – Return of Title IV Funding Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The financial aid personnel and the accounting department and the management accounting systems of each non-Federal entity must provide for, effective controls over, and accountability for all students the withdraws from the University [2 CFR §668.22]. Condition: The return to Title IV funding calculations performed on students withdrawn from the eligibility sample did not include a control process to review and approve the calculations for accuracy prior to changes being made to the student’s award. Questioned Costs: None. Context: During our audit procedures, the calculations that were preformed did not include documentation of the control process to review and approve the calculations prior to changes being made to the student’s award. Cause: The University must maintain adequate data and documentation, but due to change in management and turnover in office, there was a lack of conveying institutional knowledge and processes. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: Yes – 2021-004. Recommendation: We recommend the institution maintain proper documentation in accordance with federal grantor requirements and ensure that the documents are readily available for review upon request, including monitoring of students with triggering events that require a return to Title IV calculation to be completed, reviewed, and approved. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-007: Reporting – Common Origination and Disbursement (COD) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- From the 2022-23 FSA Handbook: to be in compliance with reporting disbursements and disbursement adjustments within 15 days. The date funds are credited to a student’s account in the institution’s general ledger or any subledger of the general ledger or paid to a student directly is the disbursement date the financial aid office reports to COD. The Common Origination and Disbursement (COD) additional requirements are: (1) Schools must use the COD system to request and receive federal student aid funds, including Direct Loans, Pell Grants, and Campus-Based aid programs. Schools must ensure that all disbursements of federal student aid are made through the COD system. (2) Schools must reconcile their records with the COD system to ensure that all disbursements are accurately reported and recorded. (3) Schools must comply with COD reporting requirements, including reporting disbursements, adjustments, and cancellations in a timely and accurate manner. Condition: For one (1) of 33 students tested, the Fall 2022 disbursement dates in COD for Pell did not match the disbursement date on the student ledgers. Questioned Costs: None. Context: The Fall 2022 disbursement dates in COD for the student in question is October 29, 2021, but on the student ledger the date is December 15, 2021. Cause: Employee turnover during the 2021-2022 academic year caused this process to not be completed accurately. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: No Recommendation: We recommend that the entity strengthen its internal controls to ensure that all disbursement dates are reported to COD accurately and timely. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-009: Special Tests and Provisions – The Gramm-Leach-Bliley Act (GLBA) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Material Weakness in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned Costs: None Context: During our audit procedures, it was noted that the University did not conduct a risk assessment that addresses (2) and (3) of the 3 areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University experienced turnover in the department responsible for this process and had a ransomware cyber-attack during the year ended June 30, 2022. Effect: The student personal information could be vulnerable. Repeat Finding: Yes – 2021-002. Recommendation: We recommend the University engage a third party or perform the risk assessment for the two areas required by the Gramm-Leach-Bliley Act that have not been completed and documented and ensure that there are documented safeguards for identified risks. Views of Responsible Officials: There is no disagreement with the audit finding.

2022 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2021-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: No Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022-003: Reporting – FISAP Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The University submitted inaccurate data in its annual FISAP report. Questioned Costs: None. Context: Section F Independent Taxable Income With Baccalaureate total per the FISAP is 5 but the support provide shows the total is 9. Graduate total per the FISAP is 25 but the support provide shows the total is 37. Cause: Due to change in management and turnover in office, in completing the data entry, there was no oversight to ensure reporting was accurate to the supporting University records. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: We recommend the applicable campus revise procedures to ensure that the record retention requirements are met and supporting documentation agrees to the FISAP, including a supervisory review by someone other than the preparer. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-004: Special Tests & Provision – Outstanding Checks over 240 Days Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: Student checks related to student refunds of Title IV federal financial aid was outstanding more than 240 days as of June 30, 2022. Questioned Costs: $45,109. Context: During our audit procedures, it was noted that the University had 84 Title IV outstanding checks at June 30, 2022, that aged over 240 days. The outstanding checks have not been canceled or the funds returned to the Secretary. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures related to Title IV outstanding checks. Effect: The University is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: No Recommendation: We recommend that the University review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-005: Special Tests & Provisions – Enrollment Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34CFR section 682.610 states that all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a Roster file. Rosters must be returned within 15 days and any subsequent error records must be returned within 10 days. Condition: The University’s June 2022 roster was not returned within 15 days of receipt. The University did not maintain reporting records for 13 of 38 students selected for testing. It was noted that 1 of the 38 students' enrollment status per institution records and NSLDS did not agree. Questioned Costs: None Context: While the University is reporting enrollment to the Clearinghouse each month, the June enrollment roster was not returned within the required 15-day period. While the University is reporting enrollment changes, it does not have adequate policies and procedure to ensure documentation for reporting is accurately reported and retained. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures to ensure accurate, timely, and complete enrollment reporting. Effect: National Student Loan Database System (NSLDS) is not updated with the student information which can cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes – 2021-003. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all enrollment records are reported correctly and within the required time period. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-006: Special Tests and Provisions – Return of Title IV Funding Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The financial aid personnel and the accounting department and the management accounting systems of each non-Federal entity must provide for, effective controls over, and accountability for all students the withdraws from the University [2 CFR §668.22]. Condition: The return to Title IV funding calculations performed on students withdrawn from the eligibility sample did not include a control process to review and approve the calculations for accuracy prior to changes being made to the student’s award. Questioned Costs: None. Context: During our audit procedures, the calculations that were preformed did not include documentation of the control process to review and approve the calculations prior to changes being made to the student’s award. Cause: The University must maintain adequate data and documentation, but due to change in management and turnover in office, there was a lack of conveying institutional knowledge and processes. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: Yes – 2021-004. Recommendation: We recommend the institution maintain proper documentation in accordance with federal grantor requirements and ensure that the documents are readily available for review upon request, including monitoring of students with triggering events that require a return to Title IV calculation to be completed, reviewed, and approved. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-007: Reporting – Common Origination and Disbursement (COD) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- From the 2022-23 FSA Handbook: to be in compliance with reporting disbursements and disbursement adjustments within 15 days. The date funds are credited to a student’s account in the institution’s general ledger or any subledger of the general ledger or paid to a student directly is the disbursement date the financial aid office reports to COD. The Common Origination and Disbursement (COD) additional requirements are: (1) Schools must use the COD system to request and receive federal student aid funds, including Direct Loans, Pell Grants, and Campus-Based aid programs. Schools must ensure that all disbursements of federal student aid are made through the COD system. (2) Schools must reconcile their records with the COD system to ensure that all disbursements are accurately reported and recorded. (3) Schools must comply with COD reporting requirements, including reporting disbursements, adjustments, and cancellations in a timely and accurate manner. Condition: For one (1) of 33 students tested, the Fall 2022 disbursement dates in COD for Pell did not match the disbursement date on the student ledgers. Questioned Costs: None. Context: The Fall 2022 disbursement dates in COD for the student in question is October 29, 2021, but on the student ledger the date is December 15, 2021. Cause: Employee turnover during the 2021-2022 academic year caused this process to not be completed accurately. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: No Recommendation: We recommend that the entity strengthen its internal controls to ensure that all disbursement dates are reported to COD accurately and timely. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-008: Eligibility – Pell Awarding Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.063 Award Number and Year: P063P213807(March 23, 2021 - August 31, 2027) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- 34 CFR 668.60(c), the institution shall adjust the student's award when an over award or under award is caused by the change in the expected family contribution. That adjustment must be made— (i) Within the same award year—if possible—to correct any overpayment or underpayment; or (ii) During the next award year to correct any overpayment that could not be adjusted during the year in which the student was overpaid. Condition: Students were disbursed Pell funds inaccurately. Questioned Costs: $4,317 Context: During our audit procedures, it was noted that four (4) of 33 students tested, the Pell amount disbursed was less than what the student was eligible. Cause: The University experienced turnover in the department responsible for this process. Effect: Students are not disbursed correct funds they are eligible to receive during the school year. Repeat Finding: No Recommendation: We recommend the University implement policies to review all student award packages at the start of the academic year to ensure no over and under awards exist. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-009: Special Tests and Provisions – The Gramm-Leach-Bliley Act (GLBA) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Material Weakness in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned Costs: None Context: During our audit procedures, it was noted that the University did not conduct a risk assessment that addresses (2) and (3) of the 3 areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University experienced turnover in the department responsible for this process and had a ransomware cyber-attack during the year ended June 30, 2022. Effect: The student personal information could be vulnerable. Repeat Finding: Yes – 2021-002. Recommendation: We recommend the University engage a third party or perform the risk assessment for the two areas required by the Gramm-Leach-Bliley Act that have not been completed and documented and ensure that there are documented safeguards for identified risks. Views of Responsible Officials: There is no disagreement with the audit finding.

2022 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2021-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: No Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022-003: Reporting – FISAP Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The University submitted inaccurate data in its annual FISAP report. Questioned Costs: None. Context: Section F Independent Taxable Income With Baccalaureate total per the FISAP is 5 but the support provide shows the total is 9. Graduate total per the FISAP is 25 but the support provide shows the total is 37. Cause: Due to change in management and turnover in office, in completing the data entry, there was no oversight to ensure reporting was accurate to the supporting University records. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: We recommend the applicable campus revise procedures to ensure that the record retention requirements are met and supporting documentation agrees to the FISAP, including a supervisory review by someone other than the preparer. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-004: Special Tests & Provision – Outstanding Checks over 240 Days Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: Student checks related to student refunds of Title IV federal financial aid was outstanding more than 240 days as of June 30, 2022. Questioned Costs: $45,109. Context: During our audit procedures, it was noted that the University had 84 Title IV outstanding checks at June 30, 2022, that aged over 240 days. The outstanding checks have not been canceled or the funds returned to the Secretary. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures related to Title IV outstanding checks. Effect: The University is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: No Recommendation: We recommend that the University review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-005: Special Tests & Provisions – Enrollment Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34CFR section 682.610 states that all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a Roster file. Rosters must be returned within 15 days and any subsequent error records must be returned within 10 days. Condition: The University’s June 2022 roster was not returned within 15 days of receipt. The University did not maintain reporting records for 13 of 38 students selected for testing. It was noted that 1 of the 38 students' enrollment status per institution records and NSLDS did not agree. Questioned Costs: None Context: While the University is reporting enrollment to the Clearinghouse each month, the June enrollment roster was not returned within the required 15-day period. While the University is reporting enrollment changes, it does not have adequate policies and procedure to ensure documentation for reporting is accurately reported and retained. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures to ensure accurate, timely, and complete enrollment reporting. Effect: National Student Loan Database System (NSLDS) is not updated with the student information which can cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes – 2021-003. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all enrollment records are reported correctly and within the required time period. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-006: Special Tests and Provisions – Return of Title IV Funding Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The financial aid personnel and the accounting department and the management accounting systems of each non-Federal entity must provide for, effective controls over, and accountability for all students the withdraws from the University [2 CFR §668.22]. Condition: The return to Title IV funding calculations performed on students withdrawn from the eligibility sample did not include a control process to review and approve the calculations for accuracy prior to changes being made to the student’s award. Questioned Costs: None. Context: During our audit procedures, the calculations that were preformed did not include documentation of the control process to review and approve the calculations prior to changes being made to the student’s award. Cause: The University must maintain adequate data and documentation, but due to change in management and turnover in office, there was a lack of conveying institutional knowledge and processes. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: Yes – 2021-004. Recommendation: We recommend the institution maintain proper documentation in accordance with federal grantor requirements and ensure that the documents are readily available for review upon request, including monitoring of students with triggering events that require a return to Title IV calculation to be completed, reviewed, and approved. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-007: Reporting – Common Origination and Disbursement (COD) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- From the 2022-23 FSA Handbook: to be in compliance with reporting disbursements and disbursement adjustments within 15 days. The date funds are credited to a student’s account in the institution’s general ledger or any subledger of the general ledger or paid to a student directly is the disbursement date the financial aid office reports to COD. The Common Origination and Disbursement (COD) additional requirements are: (1) Schools must use the COD system to request and receive federal student aid funds, including Direct Loans, Pell Grants, and Campus-Based aid programs. Schools must ensure that all disbursements of federal student aid are made through the COD system. (2) Schools must reconcile their records with the COD system to ensure that all disbursements are accurately reported and recorded. (3) Schools must comply with COD reporting requirements, including reporting disbursements, adjustments, and cancellations in a timely and accurate manner. Condition: For one (1) of 33 students tested, the Fall 2022 disbursement dates in COD for Pell did not match the disbursement date on the student ledgers. Questioned Costs: None. Context: The Fall 2022 disbursement dates in COD for the student in question is October 29, 2021, but on the student ledger the date is December 15, 2021. Cause: Employee turnover during the 2021-2022 academic year caused this process to not be completed accurately. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: No Recommendation: We recommend that the entity strengthen its internal controls to ensure that all disbursement dates are reported to COD accurately and timely. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-009: Special Tests and Provisions – The Gramm-Leach-Bliley Act (GLBA) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Material Weakness in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned Costs: None Context: During our audit procedures, it was noted that the University did not conduct a risk assessment that addresses (2) and (3) of the 3 areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University experienced turnover in the department responsible for this process and had a ransomware cyber-attack during the year ended June 30, 2022. Effect: The student personal information could be vulnerable. Repeat Finding: Yes – 2021-002. Recommendation: We recommend the University engage a third party or perform the risk assessment for the two areas required by the Gramm-Leach-Bliley Act that have not been completed and documented and ensure that there are documented safeguards for identified risks. Views of Responsible Officials: There is no disagreement with the audit finding.

2022 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2021-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: No Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022-010: Internal Control and Compliance – Higher Education Emergency Relief Funds (HEERF) Federal Agency: Department of Education Federal Program Title: Education Stabilization Fund (ESF) Assistance Listing Number: 84.425E, 84.425F Award Number and Year: P425E201739 (May 1, 2020 – June 30, 2023), P425F200479 (May 1, 2020 – June 30, 2023), Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The University must comply with the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) – HEERF I for all applicable assistance listing numbers under 84.425E and 84.425F, which were continued under the Coronavirus Response and Relief Supplemental Appropriations Act (CRRSAA) – HEERF II and American Rescue Plan (ARP) – HEERF III as to the use of the funds and required reporting. Condition: During the year 2022, the University continued to utilize the HEERF Student Aid Portion and the HEERF Institutional Portion. Collectively, the HEERF awards (or program) was a major federal program for the year ended June 30, 2022. The internal controls over the compliance and administration of the new program requires management of the University to comply with all direct and material compliance requirements outlined in the federal Compliance Supplement for 2022 for the HEERF program. While the University established a plan to distribute funds to students in accordance with the requirements and to cover qualified expenditures for the institution portion, it failed to properly maintain detailed records of the actual distributions to each student so that a reconciliation of the distributed funds could be reconciled to the subsidiary accounts in the general ledger. In addition, the University failed to properly maintain its documentation of the lost revenue calculation as required by the CARES Act and the expenditure detail for the institution portion. The University also failed to provide complete evidence of the quarterly and annual reporting as required under the CARES Act, CRRSAA, and ARP regulations. Questioned Costs: $518,388 Context: During the audit procedures, the University was unable to provide documentation for required compliance testing, specifically: • Activities Allowed and Unallowed – Institutional Portion • Allowable Costs – Institutional Portion • Cash Management – Student and Institutional Portion • Period of Performance Testing – Institutional Portion • Procurement Testing – Institutional Portion • Suspension and Debarment Testing – Institutional Portion • Reporting Testing Cause: The University experienced turnover in the department responsible for this process. Effect: The University is unable to adequately document its compliance with the requirements of the HEERF program administered. Reports submitted are not in compliance with the reporting and information-sharing requirements established by the Department of Education. Expenditures may be incorrectly charged to the program. Repeat Finding: Yes – 2021-005. Recommendation: We recommend the institutions strengthen their understanding of the compliance and reporting requirements established by grant programs and ensure supporting documentation is maintained to substantiate amounts reported, compliance with requirements is supported by University records, and ensure that federal expenditures are properly identified and classified. Views of Responsible Officials: There is no disagreement with the audit finding.

2022 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2021-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: No Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022-010: Internal Control and Compliance – Higher Education Emergency Relief Funds (HEERF) Federal Agency: Department of Education Federal Program Title: Education Stabilization Fund (ESF) Assistance Listing Number: 84.425E, 84.425F Award Number and Year: P425E201739 (May 1, 2020 – June 30, 2023), P425F200479 (May 1, 2020 – June 30, 2023), Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The University must comply with the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) – HEERF I for all applicable assistance listing numbers under 84.425E and 84.425F, which were continued under the Coronavirus Response and Relief Supplemental Appropriations Act (CRRSAA) – HEERF II and American Rescue Plan (ARP) – HEERF III as to the use of the funds and required reporting. Condition: During the year 2022, the University continued to utilize the HEERF Student Aid Portion and the HEERF Institutional Portion. Collectively, the HEERF awards (or program) was a major federal program for the year ended June 30, 2022. The internal controls over the compliance and administration of the new program requires management of the University to comply with all direct and material compliance requirements outlined in the federal Compliance Supplement for 2022 for the HEERF program. While the University established a plan to distribute funds to students in accordance with the requirements and to cover qualified expenditures for the institution portion, it failed to properly maintain detailed records of the actual distributions to each student so that a reconciliation of the distributed funds could be reconciled to the subsidiary accounts in the general ledger. In addition, the University failed to properly maintain its documentation of the lost revenue calculation as required by the CARES Act and the expenditure detail for the institution portion. The University also failed to provide complete evidence of the quarterly and annual reporting as required under the CARES Act, CRRSAA, and ARP regulations. Questioned Costs: $518,388 Context: During the audit procedures, the University was unable to provide documentation for required compliance testing, specifically: • Activities Allowed and Unallowed – Institutional Portion • Allowable Costs – Institutional Portion • Cash Management – Student and Institutional Portion • Period of Performance Testing – Institutional Portion • Procurement Testing – Institutional Portion • Suspension and Debarment Testing – Institutional Portion • Reporting Testing Cause: The University experienced turnover in the department responsible for this process. Effect: The University is unable to adequately document its compliance with the requirements of the HEERF program administered. Reports submitted are not in compliance with the reporting and information-sharing requirements established by the Department of Education. Expenditures may be incorrectly charged to the program. Repeat Finding: Yes – 2021-005. Recommendation: We recommend the institutions strengthen their understanding of the compliance and reporting requirements established by grant programs and ensure supporting documentation is maintained to substantiate amounts reported, compliance with requirements is supported by University records, and ensure that federal expenditures are properly identified and classified. Views of Responsible Officials: There is no disagreement with the audit finding.

2022 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2021-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: No Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022-003: Reporting – FISAP Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The University submitted inaccurate data in its annual FISAP report. Questioned Costs: None. Context: Section F Independent Taxable Income With Baccalaureate total per the FISAP is 5 but the support provide shows the total is 9. Graduate total per the FISAP is 25 but the support provide shows the total is 37. Cause: Due to change in management and turnover in office, in completing the data entry, there was no oversight to ensure reporting was accurate to the supporting University records. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: We recommend the applicable campus revise procedures to ensure that the record retention requirements are met and supporting documentation agrees to the FISAP, including a supervisory review by someone other than the preparer. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-004: Special Tests & Provision – Outstanding Checks over 240 Days Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: Student checks related to student refunds of Title IV federal financial aid was outstanding more than 240 days as of June 30, 2022. Questioned Costs: $45,109. Context: During our audit procedures, it was noted that the University had 84 Title IV outstanding checks at June 30, 2022, that aged over 240 days. The outstanding checks have not been canceled or the funds returned to the Secretary. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures related to Title IV outstanding checks. Effect: The University is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: No Recommendation: We recommend that the University review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-005: Special Tests & Provisions – Enrollment Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34CFR section 682.610 states that all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a Roster file. Rosters must be returned within 15 days and any subsequent error records must be returned within 10 days. Condition: The University’s June 2022 roster was not returned within 15 days of receipt. The University did not maintain reporting records for 13 of 38 students selected for testing. It was noted that 1 of the 38 students' enrollment status per institution records and NSLDS did not agree. Questioned Costs: None Context: While the University is reporting enrollment to the Clearinghouse each month, the June enrollment roster was not returned within the required 15-day period. While the University is reporting enrollment changes, it does not have adequate policies and procedure to ensure documentation for reporting is accurately reported and retained. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures to ensure accurate, timely, and complete enrollment reporting. Effect: National Student Loan Database System (NSLDS) is not updated with the student information which can cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes – 2021-003. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all enrollment records are reported correctly and within the required time period. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-006: Special Tests and Provisions – Return of Title IV Funding Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The financial aid personnel and the accounting department and the management accounting systems of each non-Federal entity must provide for, effective controls over, and accountability for all students the withdraws from the University [2 CFR §668.22]. Condition: The return to Title IV funding calculations performed on students withdrawn from the eligibility sample did not include a control process to review and approve the calculations for accuracy prior to changes being made to the student’s award. Questioned Costs: None. Context: During our audit procedures, the calculations that were preformed did not include documentation of the control process to review and approve the calculations prior to changes being made to the student’s award. Cause: The University must maintain adequate data and documentation, but due to change in management and turnover in office, there was a lack of conveying institutional knowledge and processes. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: Yes – 2021-004. Recommendation: We recommend the institution maintain proper documentation in accordance with federal grantor requirements and ensure that the documents are readily available for review upon request, including monitoring of students with triggering events that require a return to Title IV calculation to be completed, reviewed, and approved. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-007: Reporting – Common Origination and Disbursement (COD) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- From the 2022-23 FSA Handbook: to be in compliance with reporting disbursements and disbursement adjustments within 15 days. The date funds are credited to a student’s account in the institution’s general ledger or any subledger of the general ledger or paid to a student directly is the disbursement date the financial aid office reports to COD. The Common Origination and Disbursement (COD) additional requirements are: (1) Schools must use the COD system to request and receive federal student aid funds, including Direct Loans, Pell Grants, and Campus-Based aid programs. Schools must ensure that all disbursements of federal student aid are made through the COD system. (2) Schools must reconcile their records with the COD system to ensure that all disbursements are accurately reported and recorded. (3) Schools must comply with COD reporting requirements, including reporting disbursements, adjustments, and cancellations in a timely and accurate manner. Condition: For one (1) of 33 students tested, the Fall 2022 disbursement dates in COD for Pell did not match the disbursement date on the student ledgers. Questioned Costs: None. Context: The Fall 2022 disbursement dates in COD for the student in question is October 29, 2021, but on the student ledger the date is December 15, 2021. Cause: Employee turnover during the 2021-2022 academic year caused this process to not be completed accurately. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: No Recommendation: We recommend that the entity strengthen its internal controls to ensure that all disbursement dates are reported to COD accurately and timely. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-009: Special Tests and Provisions – The Gramm-Leach-Bliley Act (GLBA) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Material Weakness in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned Costs: None Context: During our audit procedures, it was noted that the University did not conduct a risk assessment that addresses (2) and (3) of the 3 areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University experienced turnover in the department responsible for this process and had a ransomware cyber-attack during the year ended June 30, 2022. Effect: The student personal information could be vulnerable. Repeat Finding: Yes – 2021-002. Recommendation: We recommend the University engage a third party or perform the risk assessment for the two areas required by the Gramm-Leach-Bliley Act that have not been completed and documented and ensure that there are documented safeguards for identified risks. Views of Responsible Officials: There is no disagreement with the audit finding.

2022 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2021-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: No Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022-003: Reporting – FISAP Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The University submitted inaccurate data in its annual FISAP report. Questioned Costs: None. Context: Section F Independent Taxable Income With Baccalaureate total per the FISAP is 5 but the support provide shows the total is 9. Graduate total per the FISAP is 25 but the support provide shows the total is 37. Cause: Due to change in management and turnover in office, in completing the data entry, there was no oversight to ensure reporting was accurate to the supporting University records. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: We recommend the applicable campus revise procedures to ensure that the record retention requirements are met and supporting documentation agrees to the FISAP, including a supervisory review by someone other than the preparer. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-004: Special Tests & Provision – Outstanding Checks over 240 Days Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: Student checks related to student refunds of Title IV federal financial aid was outstanding more than 240 days as of June 30, 2022. Questioned Costs: $45,109. Context: During our audit procedures, it was noted that the University had 84 Title IV outstanding checks at June 30, 2022, that aged over 240 days. The outstanding checks have not been canceled or the funds returned to the Secretary. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures related to Title IV outstanding checks. Effect: The University is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: No Recommendation: We recommend that the University review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-005: Special Tests & Provisions – Enrollment Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34CFR section 682.610 states that all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a Roster file. Rosters must be returned within 15 days and any subsequent error records must be returned within 10 days. Condition: The University’s June 2022 roster was not returned within 15 days of receipt. The University did not maintain reporting records for 13 of 38 students selected for testing. It was noted that 1 of the 38 students' enrollment status per institution records and NSLDS did not agree. Questioned Costs: None Context: While the University is reporting enrollment to the Clearinghouse each month, the June enrollment roster was not returned within the required 15-day period. While the University is reporting enrollment changes, it does not have adequate policies and procedure to ensure documentation for reporting is accurately reported and retained. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures to ensure accurate, timely, and complete enrollment reporting. Effect: National Student Loan Database System (NSLDS) is not updated with the student information which can cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes – 2021-003. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all enrollment records are reported correctly and within the required time period. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-006: Special Tests and Provisions – Return of Title IV Funding Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The financial aid personnel and the accounting department and the management accounting systems of each non-Federal entity must provide for, effective controls over, and accountability for all students the withdraws from the University [2 CFR §668.22]. Condition: The return to Title IV funding calculations performed on students withdrawn from the eligibility sample did not include a control process to review and approve the calculations for accuracy prior to changes being made to the student’s award. Questioned Costs: None. Context: During our audit procedures, the calculations that were preformed did not include documentation of the control process to review and approve the calculations prior to changes being made to the student’s award. Cause: The University must maintain adequate data and documentation, but due to change in management and turnover in office, there was a lack of conveying institutional knowledge and processes. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: Yes – 2021-004. Recommendation: We recommend the institution maintain proper documentation in accordance with federal grantor requirements and ensure that the documents are readily available for review upon request, including monitoring of students with triggering events that require a return to Title IV calculation to be completed, reviewed, and approved. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-007: Reporting – Common Origination and Disbursement (COD) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- From the 2022-23 FSA Handbook: to be in compliance with reporting disbursements and disbursement adjustments within 15 days. The date funds are credited to a student’s account in the institution’s general ledger or any subledger of the general ledger or paid to a student directly is the disbursement date the financial aid office reports to COD. The Common Origination and Disbursement (COD) additional requirements are: (1) Schools must use the COD system to request and receive federal student aid funds, including Direct Loans, Pell Grants, and Campus-Based aid programs. Schools must ensure that all disbursements of federal student aid are made through the COD system. (2) Schools must reconcile their records with the COD system to ensure that all disbursements are accurately reported and recorded. (3) Schools must comply with COD reporting requirements, including reporting disbursements, adjustments, and cancellations in a timely and accurate manner. Condition: For one (1) of 33 students tested, the Fall 2022 disbursement dates in COD for Pell did not match the disbursement date on the student ledgers. Questioned Costs: None. Context: The Fall 2022 disbursement dates in COD for the student in question is October 29, 2021, but on the student ledger the date is December 15, 2021. Cause: Employee turnover during the 2021-2022 academic year caused this process to not be completed accurately. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: No Recommendation: We recommend that the entity strengthen its internal controls to ensure that all disbursement dates are reported to COD accurately and timely. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-009: Special Tests and Provisions – The Gramm-Leach-Bliley Act (GLBA) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Material Weakness in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned Costs: None Context: During our audit procedures, it was noted that the University did not conduct a risk assessment that addresses (2) and (3) of the 3 areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University experienced turnover in the department responsible for this process and had a ransomware cyber-attack during the year ended June 30, 2022. Effect: The student personal information could be vulnerable. Repeat Finding: Yes – 2021-002. Recommendation: We recommend the University engage a third party or perform the risk assessment for the two areas required by the Gramm-Leach-Bliley Act that have not been completed and documented and ensure that there are documented safeguards for identified risks. Views of Responsible Officials: There is no disagreement with the audit finding.

2022 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2021-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: No Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022-003: Reporting – FISAP Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The University submitted inaccurate data in its annual FISAP report. Questioned Costs: None. Context: Section F Independent Taxable Income With Baccalaureate total per the FISAP is 5 but the support provide shows the total is 9. Graduate total per the FISAP is 25 but the support provide shows the total is 37. Cause: Due to change in management and turnover in office, in completing the data entry, there was no oversight to ensure reporting was accurate to the supporting University records. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: We recommend the applicable campus revise procedures to ensure that the record retention requirements are met and supporting documentation agrees to the FISAP, including a supervisory review by someone other than the preparer. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-004: Special Tests & Provision – Outstanding Checks over 240 Days Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: Student checks related to student refunds of Title IV federal financial aid was outstanding more than 240 days as of June 30, 2022. Questioned Costs: $45,109. Context: During our audit procedures, it was noted that the University had 84 Title IV outstanding checks at June 30, 2022, that aged over 240 days. The outstanding checks have not been canceled or the funds returned to the Secretary. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures related to Title IV outstanding checks. Effect: The University is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: No Recommendation: We recommend that the University review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-005: Special Tests & Provisions – Enrollment Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34CFR section 682.610 states that all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a Roster file. Rosters must be returned within 15 days and any subsequent error records must be returned within 10 days. Condition: The University’s June 2022 roster was not returned within 15 days of receipt. The University did not maintain reporting records for 13 of 38 students selected for testing. It was noted that 1 of the 38 students' enrollment status per institution records and NSLDS did not agree. Questioned Costs: None Context: While the University is reporting enrollment to the Clearinghouse each month, the June enrollment roster was not returned within the required 15-day period. While the University is reporting enrollment changes, it does not have adequate policies and procedure to ensure documentation for reporting is accurately reported and retained. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures to ensure accurate, timely, and complete enrollment reporting. Effect: National Student Loan Database System (NSLDS) is not updated with the student information which can cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes – 2021-003. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all enrollment records are reported correctly and within the required time period. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-006: Special Tests and Provisions – Return of Title IV Funding Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The financial aid personnel and the accounting department and the management accounting systems of each non-Federal entity must provide for, effective controls over, and accountability for all students the withdraws from the University [2 CFR §668.22]. Condition: The return to Title IV funding calculations performed on students withdrawn from the eligibility sample did not include a control process to review and approve the calculations for accuracy prior to changes being made to the student’s award. Questioned Costs: None. Context: During our audit procedures, the calculations that were preformed did not include documentation of the control process to review and approve the calculations prior to changes being made to the student’s award. Cause: The University must maintain adequate data and documentation, but due to change in management and turnover in office, there was a lack of conveying institutional knowledge and processes. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: Yes – 2021-004. Recommendation: We recommend the institution maintain proper documentation in accordance with federal grantor requirements and ensure that the documents are readily available for review upon request, including monitoring of students with triggering events that require a return to Title IV calculation to be completed, reviewed, and approved. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-007: Reporting – Common Origination and Disbursement (COD) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- From the 2022-23 FSA Handbook: to be in compliance with reporting disbursements and disbursement adjustments within 15 days. The date funds are credited to a student’s account in the institution’s general ledger or any subledger of the general ledger or paid to a student directly is the disbursement date the financial aid office reports to COD. The Common Origination and Disbursement (COD) additional requirements are: (1) Schools must use the COD system to request and receive federal student aid funds, including Direct Loans, Pell Grants, and Campus-Based aid programs. Schools must ensure that all disbursements of federal student aid are made through the COD system. (2) Schools must reconcile their records with the COD system to ensure that all disbursements are accurately reported and recorded. (3) Schools must comply with COD reporting requirements, including reporting disbursements, adjustments, and cancellations in a timely and accurate manner. Condition: For one (1) of 33 students tested, the Fall 2022 disbursement dates in COD for Pell did not match the disbursement date on the student ledgers. Questioned Costs: None. Context: The Fall 2022 disbursement dates in COD for the student in question is October 29, 2021, but on the student ledger the date is December 15, 2021. Cause: Employee turnover during the 2021-2022 academic year caused this process to not be completed accurately. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: No Recommendation: We recommend that the entity strengthen its internal controls to ensure that all disbursement dates are reported to COD accurately and timely. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-008: Eligibility – Pell Awarding Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.063 Award Number and Year: P063P213807(March 23, 2021 - August 31, 2027) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- 34 CFR 668.60(c), the institution shall adjust the student's award when an over award or under award is caused by the change in the expected family contribution. That adjustment must be made— (i) Within the same award year—if possible—to correct any overpayment or underpayment; or (ii) During the next award year to correct any overpayment that could not be adjusted during the year in which the student was overpaid. Condition: Students were disbursed Pell funds inaccurately. Questioned Costs: $4,317 Context: During our audit procedures, it was noted that four (4) of 33 students tested, the Pell amount disbursed was less than what the student was eligible. Cause: The University experienced turnover in the department responsible for this process. Effect: Students are not disbursed correct funds they are eligible to receive during the school year. Repeat Finding: No Recommendation: We recommend the University implement policies to review all student award packages at the start of the academic year to ensure no over and under awards exist. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-009: Special Tests and Provisions – The Gramm-Leach-Bliley Act (GLBA) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Material Weakness in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned Costs: None Context: During our audit procedures, it was noted that the University did not conduct a risk assessment that addresses (2) and (3) of the 3 areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University experienced turnover in the department responsible for this process and had a ransomware cyber-attack during the year ended June 30, 2022. Effect: The student personal information could be vulnerable. Repeat Finding: Yes – 2021-002. Recommendation: We recommend the University engage a third party or perform the risk assessment for the two areas required by the Gramm-Leach-Bliley Act that have not been completed and documented and ensure that there are documented safeguards for identified risks. Views of Responsible Officials: There is no disagreement with the audit finding.

2022 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2021-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: No Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022-003: Reporting – FISAP Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The University submitted inaccurate data in its annual FISAP report. Questioned Costs: None. Context: Section F Independent Taxable Income With Baccalaureate total per the FISAP is 5 but the support provide shows the total is 9. Graduate total per the FISAP is 25 but the support provide shows the total is 37. Cause: Due to change in management and turnover in office, in completing the data entry, there was no oversight to ensure reporting was accurate to the supporting University records. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: We recommend the applicable campus revise procedures to ensure that the record retention requirements are met and supporting documentation agrees to the FISAP, including a supervisory review by someone other than the preparer. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-004: Special Tests & Provision – Outstanding Checks over 240 Days Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: Student checks related to student refunds of Title IV federal financial aid was outstanding more than 240 days as of June 30, 2022. Questioned Costs: $45,109. Context: During our audit procedures, it was noted that the University had 84 Title IV outstanding checks at June 30, 2022, that aged over 240 days. The outstanding checks have not been canceled or the funds returned to the Secretary. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures related to Title IV outstanding checks. Effect: The University is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: No Recommendation: We recommend that the University review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-005: Special Tests & Provisions – Enrollment Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34CFR section 682.610 states that all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a Roster file. Rosters must be returned within 15 days and any subsequent error records must be returned within 10 days. Condition: The University’s June 2022 roster was not returned within 15 days of receipt. The University did not maintain reporting records for 13 of 38 students selected for testing. It was noted that 1 of the 38 students' enrollment status per institution records and NSLDS did not agree. Questioned Costs: None Context: While the University is reporting enrollment to the Clearinghouse each month, the June enrollment roster was not returned within the required 15-day period. While the University is reporting enrollment changes, it does not have adequate policies and procedure to ensure documentation for reporting is accurately reported and retained. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures to ensure accurate, timely, and complete enrollment reporting. Effect: National Student Loan Database System (NSLDS) is not updated with the student information which can cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes – 2021-003. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all enrollment records are reported correctly and within the required time period. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-006: Special Tests and Provisions – Return of Title IV Funding Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The financial aid personnel and the accounting department and the management accounting systems of each non-Federal entity must provide for, effective controls over, and accountability for all students the withdraws from the University [2 CFR §668.22]. Condition: The return to Title IV funding calculations performed on students withdrawn from the eligibility sample did not include a control process to review and approve the calculations for accuracy prior to changes being made to the student’s award. Questioned Costs: None. Context: During our audit procedures, the calculations that were preformed did not include documentation of the control process to review and approve the calculations prior to changes being made to the student’s award. Cause: The University must maintain adequate data and documentation, but due to change in management and turnover in office, there was a lack of conveying institutional knowledge and processes. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: Yes – 2021-004. Recommendation: We recommend the institution maintain proper documentation in accordance with federal grantor requirements and ensure that the documents are readily available for review upon request, including monitoring of students with triggering events that require a return to Title IV calculation to be completed, reviewed, and approved. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-007: Reporting – Common Origination and Disbursement (COD) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- From the 2022-23 FSA Handbook: to be in compliance with reporting disbursements and disbursement adjustments within 15 days. The date funds are credited to a student’s account in the institution’s general ledger or any subledger of the general ledger or paid to a student directly is the disbursement date the financial aid office reports to COD. The Common Origination and Disbursement (COD) additional requirements are: (1) Schools must use the COD system to request and receive federal student aid funds, including Direct Loans, Pell Grants, and Campus-Based aid programs. Schools must ensure that all disbursements of federal student aid are made through the COD system. (2) Schools must reconcile their records with the COD system to ensure that all disbursements are accurately reported and recorded. (3) Schools must comply with COD reporting requirements, including reporting disbursements, adjustments, and cancellations in a timely and accurate manner. Condition: For one (1) of 33 students tested, the Fall 2022 disbursement dates in COD for Pell did not match the disbursement date on the student ledgers. Questioned Costs: None. Context: The Fall 2022 disbursement dates in COD for the student in question is October 29, 2021, but on the student ledger the date is December 15, 2021. Cause: Employee turnover during the 2021-2022 academic year caused this process to not be completed accurately. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: No Recommendation: We recommend that the entity strengthen its internal controls to ensure that all disbursement dates are reported to COD accurately and timely. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-009: Special Tests and Provisions – The Gramm-Leach-Bliley Act (GLBA) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Material Weakness in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned Costs: None Context: During our audit procedures, it was noted that the University did not conduct a risk assessment that addresses (2) and (3) of the 3 areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University experienced turnover in the department responsible for this process and had a ransomware cyber-attack during the year ended June 30, 2022. Effect: The student personal information could be vulnerable. Repeat Finding: Yes – 2021-002. Recommendation: We recommend the University engage a third party or perform the risk assessment for the two areas required by the Gramm-Leach-Bliley Act that have not been completed and documented and ensure that there are documented safeguards for identified risks. Views of Responsible Officials: There is no disagreement with the audit finding.

2022 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2021-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: No Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022-010: Internal Control and Compliance – Higher Education Emergency Relief Funds (HEERF) Federal Agency: Department of Education Federal Program Title: Education Stabilization Fund (ESF) Assistance Listing Number: 84.425E, 84.425F Award Number and Year: P425E201739 (May 1, 2020 – June 30, 2023), P425F200479 (May 1, 2020 – June 30, 2023), Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The University must comply with the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) – HEERF I for all applicable assistance listing numbers under 84.425E and 84.425F, which were continued under the Coronavirus Response and Relief Supplemental Appropriations Act (CRRSAA) – HEERF II and American Rescue Plan (ARP) – HEERF III as to the use of the funds and required reporting. Condition: During the year 2022, the University continued to utilize the HEERF Student Aid Portion and the HEERF Institutional Portion. Collectively, the HEERF awards (or program) was a major federal program for the year ended June 30, 2022. The internal controls over the compliance and administration of the new program requires management of the University to comply with all direct and material compliance requirements outlined in the federal Compliance Supplement for 2022 for the HEERF program. While the University established a plan to distribute funds to students in accordance with the requirements and to cover qualified expenditures for the institution portion, it failed to properly maintain detailed records of the actual distributions to each student so that a reconciliation of the distributed funds could be reconciled to the subsidiary accounts in the general ledger. In addition, the University failed to properly maintain its documentation of the lost revenue calculation as required by the CARES Act and the expenditure detail for the institution portion. The University also failed to provide complete evidence of the quarterly and annual reporting as required under the CARES Act, CRRSAA, and ARP regulations. Questioned Costs: $518,388 Context: During the audit procedures, the University was unable to provide documentation for required compliance testing, specifically: • Activities Allowed and Unallowed – Institutional Portion • Allowable Costs – Institutional Portion • Cash Management – Student and Institutional Portion • Period of Performance Testing – Institutional Portion • Procurement Testing – Institutional Portion • Suspension and Debarment Testing – Institutional Portion • Reporting Testing Cause: The University experienced turnover in the department responsible for this process. Effect: The University is unable to adequately document its compliance with the requirements of the HEERF program administered. Reports submitted are not in compliance with the reporting and information-sharing requirements established by the Department of Education. Expenditures may be incorrectly charged to the program. Repeat Finding: Yes – 2021-005. Recommendation: We recommend the institutions strengthen their understanding of the compliance and reporting requirements established by grant programs and ensure supporting documentation is maintained to substantiate amounts reported, compliance with requirements is supported by University records, and ensure that federal expenditures are properly identified and classified. Views of Responsible Officials: There is no disagreement with the audit finding.

2022 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2021-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: No Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2022-010: Internal Control and Compliance – Higher Education Emergency Relief Funds (HEERF) Federal Agency: Department of Education Federal Program Title: Education Stabilization Fund (ESF) Assistance Listing Number: 84.425E, 84.425F Award Number and Year: P425E201739 (May 1, 2020 – June 30, 2023), P425F200479 (May 1, 2020 – June 30, 2023), Award Period: July 1, 2021 – June 30, 2022 Type of Finding: Material Weakness in Internal Control over Compliance Material Noncompliance (Modified Opinion) Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The University must comply with the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) – HEERF I for all applicable assistance listing numbers under 84.425E and 84.425F, which were continued under the Coronavirus Response and Relief Supplemental Appropriations Act (CRRSAA) – HEERF II and American Rescue Plan (ARP) – HEERF III as to the use of the funds and required reporting. Condition: During the year 2022, the University continued to utilize the HEERF Student Aid Portion and the HEERF Institutional Portion. Collectively, the HEERF awards (or program) was a major federal program for the year ended June 30, 2022. The internal controls over the compliance and administration of the new program requires management of the University to comply with all direct and material compliance requirements outlined in the federal Compliance Supplement for 2022 for the HEERF program. While the University established a plan to distribute funds to students in accordance with the requirements and to cover qualified expenditures for the institution portion, it failed to properly maintain detailed records of the actual distributions to each student so that a reconciliation of the distributed funds could be reconciled to the subsidiary accounts in the general ledger. In addition, the University failed to properly maintain its documentation of the lost revenue calculation as required by the CARES Act and the expenditure detail for the institution portion. The University also failed to provide complete evidence of the quarterly and annual reporting as required under the CARES Act, CRRSAA, and ARP regulations. Questioned Costs: $518,388 Context: During the audit procedures, the University was unable to provide documentation for required compliance testing, specifically: • Activities Allowed and Unallowed – Institutional Portion • Allowable Costs – Institutional Portion • Cash Management – Student and Institutional Portion • Period of Performance Testing – Institutional Portion • Procurement Testing – Institutional Portion • Suspension and Debarment Testing – Institutional Portion • Reporting Testing Cause: The University experienced turnover in the department responsible for this process. Effect: The University is unable to adequately document its compliance with the requirements of the HEERF program administered. Reports submitted are not in compliance with the reporting and information-sharing requirements established by the Department of Education. Expenditures may be incorrectly charged to the program. Repeat Finding: Yes – 2021-005. Recommendation: We recommend the institutions strengthen their understanding of the compliance and reporting requirements established by grant programs and ensure supporting documentation is maintained to substantiate amounts reported, compliance with requirements is supported by University records, and ensure that federal expenditures are properly identified and classified. Views of Responsible Officials: There is no disagreement with the audit finding.