Audit 324814

2023 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAPP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2022-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2023 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: Yes – 2022-002. Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2023-003: Reporting – FISAP Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The University submitted inaccurate data in its annual FISAP report. Questioned Costs: None. Context: Section A of the Fiscal Operations Report, Part VI shows 65 undergraduate unduplicated recipients, but the support shows 66. Cause: Due to change in management and turnover in office, in completing the data entry, there was no oversight to ensure reporting was accurate to the supporting University records. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: Yes – 2022-003 Recommendation: We recommend the applicable campus revise procedures to ensure that the record retention requirements are met and supporting documentation agrees to the FISAP, including a supervisory review by someone other than the preparer. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-004: Special Tests and Provision – Outstanding Checks over 240 Days Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: Student checks related to student refunds of Title IV federal financial aid was outstanding more than 240 days as of June 30, 2023. Questioned Costs: $44,315. Context: During our audit procedures, it was noted that the University had 84 Title IV outstanding checks at June 30, 2022 that aged over 240 days. The outstanding checks have not been canceled or the funds returned to the Secretary. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures related to Title IV outstanding checks. Effect: The University is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes – 2022-004. Recommendation: We recommend that the University review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-005: Special Tests & Provisions – Enrollment Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34CFR section 682.610 states that all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a Roster file. Rosters must be returned within 15 days and any subsequent error records must be returned within 10 days. Condition: The University is not reporting student information to the Clearinghouse. Students tested did not have their enrollment status properly reported to the Clearinghouse. Questioned Costs: None Context: During our audit procedures, it was noted that 7 of the 8 students' enrollment information per institution records was not reported correctly to NSLDS. Also, during our audit procedures, it was noted that 2 of the 8 students' enrollment status per institution records and NSLDS did not agree. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures to ensure accurate, timely, and complete enrollment reporting. Effect: National Student Loan Database System (NSLDS) is not updated with the student information which can cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes – 2022-005. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all enrollment records are reported correctly and within the required time frame. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-006: Reporting – Common Origination and Disbursement (COD) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- From the 2022-23 FSA Handbook: to be in compliance with reporting disbursements and disbursement adjustments within 15 days. The date funds are credited to a student’s account in the institution’s general ledger or any subledger of the general ledger or paid to a student directly is the disbursement date the financial aid office reports to COD. The Common Origination and Disbursement (COD) additional requirements are: (1) Schools must use the COD system to request and receive federal student aid funds, including Direct Loans, Pell Grants, and Campus-Based aid programs. Schools must ensure that all disbursements of federal student aid are made through the COD system. (2) Schools must reconcile their records with the COD system to ensure that all disbursements are accurately reported and recorded. (3) Schools must comply with COD reporting requirements, including reporting disbursements, adjustments, and cancellations in a timely and accurate manner. Condition: During audit procedures, we noted the following items were incorrectly reported to the COD: Fall 2022 • For 1 of 10 students tested, the Unsubsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 1 of 5 students tested, the Parent Plus Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date Spring 2023 • For 2 of 10 students tested, the PELL applied dates did not fall within the 15 day requirement from the disbursement date. • For 2 of 12 students tested, the Subsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. • For 1 of 10 students tested, the Unsubsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. • For 2 of 5 students tested, the Parent Plus Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. Summer 2023 • For 5 of 10 students tested, the PELL disbursement dates did not match between COD and the student ledgers. • For 3 of 12 students tested, the Subsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 2 of 10 students tested, the Unsubsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 2 of 5 students tested, the Parent Plus Loan disbursement dates did not match between COD and the student ledgers. • For 1 of 10 students tested, the Unsubsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. Questioned Costs: None. Context: During audit procedures, we noted the following items: Fall 2022 • The Unsubsidized Direct Loan disbursement date in COD for the student in question is 09/06/2022, but on the student ledgers the date is 09/21/2021. • The Parent Plus Direct Loan Fall 2022 applied date in COD for the student in question is 6/28/2023, and the disbursement date in COD is 12/5/2022, which is 141 business days. Spring 2023 • The Pell applied dates in COD for the students in question are 04/03/2023, and the disbursement dates in COD are 02/21/2023, which is 30 business days. • The Subsidized Direct Loan applied date in COD for one student in question is 03/10/2023, and the disbursement date in COD is 01/27/23, which is 30 business days. The Subsidized Direct Loan applied date in COD for the other student in question is 02/21/23, and the disbursement date in COD is 01/27/2023, which is 17 business days. • The Unsubsidized Direct Loan applied date in COD for the student in question is 08/18/2023, and the disbursement date in COD is 01/27/2023, which is 141 business days. • The Parent Plus Direct Loan applied date in COD is 05/08/2023 for the student in question, and the disbursement date in COD is 03/31/2023, which is 26 business days. Summer 2023 • The Pell disbursement dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Subsidized Direct Loan dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Unsubsidized Direct Loan disbursement dates in COD for the students in question is 09/06/2022, but on the student ledgers the date is 09/21/2021. • The Parent Plus Direct Loan disbursement dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Unsubsidized Direct Loan applied date in COD for the student in question is 08/18/2023, and the disbursement date in COD is 06/20/2023, which is 43 business days. Cause: Employee turnover during the 2022-2023 academic year caused this process to not be completed accurately. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: Yes – 2022-007. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all disbursement dates are reported to COD accurately and timely. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-008: Special Tests and Provisions – The Gramm-Leach-Bliley Act (GLBA) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned Costs: None Context: During our audit procedures, it was noted that the university did not conduct a risk assessment that addresses (2) and (3) of the 3 areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University experienced turnover in the department responsible for this process. Effect: The student personal information could be vulnerable. Repeat Finding: Yes – 2022-009. Recommendation: We recommend the University engage a third party or perform the risk assessment for the two areas required by the Gramm-Leach-Bliley Act that have not been completed and documented and ensure that there are documented safeguards for identified risks. Views of Responsible Officials: There is no disagreement with the audit finding.

2023 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAPP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2022-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2023 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: Yes – 2022-002. Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2023-003: Reporting – FISAP Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The University submitted inaccurate data in its annual FISAP report. Questioned Costs: None. Context: Section A of the Fiscal Operations Report, Part VI shows 65 undergraduate unduplicated recipients, but the support shows 66. Cause: Due to change in management and turnover in office, in completing the data entry, there was no oversight to ensure reporting was accurate to the supporting University records. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: Yes – 2022-003 Recommendation: We recommend the applicable campus revise procedures to ensure that the record retention requirements are met and supporting documentation agrees to the FISAP, including a supervisory review by someone other than the preparer. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-004: Special Tests and Provision – Outstanding Checks over 240 Days Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: Student checks related to student refunds of Title IV federal financial aid was outstanding more than 240 days as of June 30, 2023. Questioned Costs: $44,315. Context: During our audit procedures, it was noted that the University had 84 Title IV outstanding checks at June 30, 2022 that aged over 240 days. The outstanding checks have not been canceled or the funds returned to the Secretary. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures related to Title IV outstanding checks. Effect: The University is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes – 2022-004. Recommendation: We recommend that the University review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-005: Special Tests & Provisions – Enrollment Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34CFR section 682.610 states that all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a Roster file. Rosters must be returned within 15 days and any subsequent error records must be returned within 10 days. Condition: The University is not reporting student information to the Clearinghouse. Students tested did not have their enrollment status properly reported to the Clearinghouse. Questioned Costs: None Context: During our audit procedures, it was noted that 7 of the 8 students' enrollment information per institution records was not reported correctly to NSLDS. Also, during our audit procedures, it was noted that 2 of the 8 students' enrollment status per institution records and NSLDS did not agree. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures to ensure accurate, timely, and complete enrollment reporting. Effect: National Student Loan Database System (NSLDS) is not updated with the student information which can cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes – 2022-005. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all enrollment records are reported correctly and within the required time frame. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-006: Reporting – Common Origination and Disbursement (COD) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- From the 2022-23 FSA Handbook: to be in compliance with reporting disbursements and disbursement adjustments within 15 days. The date funds are credited to a student’s account in the institution’s general ledger or any subledger of the general ledger or paid to a student directly is the disbursement date the financial aid office reports to COD. The Common Origination and Disbursement (COD) additional requirements are: (1) Schools must use the COD system to request and receive federal student aid funds, including Direct Loans, Pell Grants, and Campus-Based aid programs. Schools must ensure that all disbursements of federal student aid are made through the COD system. (2) Schools must reconcile their records with the COD system to ensure that all disbursements are accurately reported and recorded. (3) Schools must comply with COD reporting requirements, including reporting disbursements, adjustments, and cancellations in a timely and accurate manner. Condition: During audit procedures, we noted the following items were incorrectly reported to the COD: Fall 2022 • For 1 of 10 students tested, the Unsubsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 1 of 5 students tested, the Parent Plus Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date Spring 2023 • For 2 of 10 students tested, the PELL applied dates did not fall within the 15 day requirement from the disbursement date. • For 2 of 12 students tested, the Subsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. • For 1 of 10 students tested, the Unsubsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. • For 2 of 5 students tested, the Parent Plus Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. Summer 2023 • For 5 of 10 students tested, the PELL disbursement dates did not match between COD and the student ledgers. • For 3 of 12 students tested, the Subsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 2 of 10 students tested, the Unsubsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 2 of 5 students tested, the Parent Plus Loan disbursement dates did not match between COD and the student ledgers. • For 1 of 10 students tested, the Unsubsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. Questioned Costs: None. Context: During audit procedures, we noted the following items: Fall 2022 • The Unsubsidized Direct Loan disbursement date in COD for the student in question is 09/06/2022, but on the student ledgers the date is 09/21/2021. • The Parent Plus Direct Loan Fall 2022 applied date in COD for the student in question is 6/28/2023, and the disbursement date in COD is 12/5/2022, which is 141 business days. Spring 2023 • The Pell applied dates in COD for the students in question are 04/03/2023, and the disbursement dates in COD are 02/21/2023, which is 30 business days. • The Subsidized Direct Loan applied date in COD for one student in question is 03/10/2023, and the disbursement date in COD is 01/27/23, which is 30 business days. The Subsidized Direct Loan applied date in COD for the other student in question is 02/21/23, and the disbursement date in COD is 01/27/2023, which is 17 business days. • The Unsubsidized Direct Loan applied date in COD for the student in question is 08/18/2023, and the disbursement date in COD is 01/27/2023, which is 141 business days. • The Parent Plus Direct Loan applied date in COD is 05/08/2023 for the student in question, and the disbursement date in COD is 03/31/2023, which is 26 business days. Summer 2023 • The Pell disbursement dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Subsidized Direct Loan dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Unsubsidized Direct Loan disbursement dates in COD for the students in question is 09/06/2022, but on the student ledgers the date is 09/21/2021. • The Parent Plus Direct Loan disbursement dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Unsubsidized Direct Loan applied date in COD for the student in question is 08/18/2023, and the disbursement date in COD is 06/20/2023, which is 43 business days. Cause: Employee turnover during the 2022-2023 academic year caused this process to not be completed accurately. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: Yes – 2022-007. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all disbursement dates are reported to COD accurately and timely. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-008: Special Tests and Provisions – The Gramm-Leach-Bliley Act (GLBA) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned Costs: None Context: During our audit procedures, it was noted that the university did not conduct a risk assessment that addresses (2) and (3) of the 3 areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University experienced turnover in the department responsible for this process. Effect: The student personal information could be vulnerable. Repeat Finding: Yes – 2022-009. Recommendation: We recommend the University engage a third party or perform the risk assessment for the two areas required by the Gramm-Leach-Bliley Act that have not been completed and documented and ensure that there are documented safeguards for identified risks. Views of Responsible Officials: There is no disagreement with the audit finding.

2023 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAPP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2022-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2023 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: Yes – 2022-002. Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2023-003: Reporting – FISAP Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The University submitted inaccurate data in its annual FISAP report. Questioned Costs: None. Context: Section A of the Fiscal Operations Report, Part VI shows 65 undergraduate unduplicated recipients, but the support shows 66. Cause: Due to change in management and turnover in office, in completing the data entry, there was no oversight to ensure reporting was accurate to the supporting University records. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: Yes – 2022-003 Recommendation: We recommend the applicable campus revise procedures to ensure that the record retention requirements are met and supporting documentation agrees to the FISAP, including a supervisory review by someone other than the preparer. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-004: Special Tests and Provision – Outstanding Checks over 240 Days Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: Student checks related to student refunds of Title IV federal financial aid was outstanding more than 240 days as of June 30, 2023. Questioned Costs: $44,315. Context: During our audit procedures, it was noted that the University had 84 Title IV outstanding checks at June 30, 2022 that aged over 240 days. The outstanding checks have not been canceled or the funds returned to the Secretary. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures related to Title IV outstanding checks. Effect: The University is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes – 2022-004. Recommendation: We recommend that the University review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-005: Special Tests & Provisions – Enrollment Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34CFR section 682.610 states that all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a Roster file. Rosters must be returned within 15 days and any subsequent error records must be returned within 10 days. Condition: The University is not reporting student information to the Clearinghouse. Students tested did not have their enrollment status properly reported to the Clearinghouse. Questioned Costs: None Context: During our audit procedures, it was noted that 7 of the 8 students' enrollment information per institution records was not reported correctly to NSLDS. Also, during our audit procedures, it was noted that 2 of the 8 students' enrollment status per institution records and NSLDS did not agree. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures to ensure accurate, timely, and complete enrollment reporting. Effect: National Student Loan Database System (NSLDS) is not updated with the student information which can cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes – 2022-005. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all enrollment records are reported correctly and within the required time frame. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-006: Reporting – Common Origination and Disbursement (COD) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- From the 2022-23 FSA Handbook: to be in compliance with reporting disbursements and disbursement adjustments within 15 days. The date funds are credited to a student’s account in the institution’s general ledger or any subledger of the general ledger or paid to a student directly is the disbursement date the financial aid office reports to COD. The Common Origination and Disbursement (COD) additional requirements are: (1) Schools must use the COD system to request and receive federal student aid funds, including Direct Loans, Pell Grants, and Campus-Based aid programs. Schools must ensure that all disbursements of federal student aid are made through the COD system. (2) Schools must reconcile their records with the COD system to ensure that all disbursements are accurately reported and recorded. (3) Schools must comply with COD reporting requirements, including reporting disbursements, adjustments, and cancellations in a timely and accurate manner. Condition: During audit procedures, we noted the following items were incorrectly reported to the COD: Fall 2022 • For 1 of 10 students tested, the Unsubsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 1 of 5 students tested, the Parent Plus Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date Spring 2023 • For 2 of 10 students tested, the PELL applied dates did not fall within the 15 day requirement from the disbursement date. • For 2 of 12 students tested, the Subsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. • For 1 of 10 students tested, the Unsubsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. • For 2 of 5 students tested, the Parent Plus Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. Summer 2023 • For 5 of 10 students tested, the PELL disbursement dates did not match between COD and the student ledgers. • For 3 of 12 students tested, the Subsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 2 of 10 students tested, the Unsubsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 2 of 5 students tested, the Parent Plus Loan disbursement dates did not match between COD and the student ledgers. • For 1 of 10 students tested, the Unsubsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. Questioned Costs: None. Context: During audit procedures, we noted the following items: Fall 2022 • The Unsubsidized Direct Loan disbursement date in COD for the student in question is 09/06/2022, but on the student ledgers the date is 09/21/2021. • The Parent Plus Direct Loan Fall 2022 applied date in COD for the student in question is 6/28/2023, and the disbursement date in COD is 12/5/2022, which is 141 business days. Spring 2023 • The Pell applied dates in COD for the students in question are 04/03/2023, and the disbursement dates in COD are 02/21/2023, which is 30 business days. • The Subsidized Direct Loan applied date in COD for one student in question is 03/10/2023, and the disbursement date in COD is 01/27/23, which is 30 business days. The Subsidized Direct Loan applied date in COD for the other student in question is 02/21/23, and the disbursement date in COD is 01/27/2023, which is 17 business days. • The Unsubsidized Direct Loan applied date in COD for the student in question is 08/18/2023, and the disbursement date in COD is 01/27/2023, which is 141 business days. • The Parent Plus Direct Loan applied date in COD is 05/08/2023 for the student in question, and the disbursement date in COD is 03/31/2023, which is 26 business days. Summer 2023 • The Pell disbursement dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Subsidized Direct Loan dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Unsubsidized Direct Loan disbursement dates in COD for the students in question is 09/06/2022, but on the student ledgers the date is 09/21/2021. • The Parent Plus Direct Loan disbursement dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Unsubsidized Direct Loan applied date in COD for the student in question is 08/18/2023, and the disbursement date in COD is 06/20/2023, which is 43 business days. Cause: Employee turnover during the 2022-2023 academic year caused this process to not be completed accurately. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: Yes – 2022-007. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all disbursement dates are reported to COD accurately and timely. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-007: Eligibility – Pell Awarding Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.063 Award Number and Year: P063P213807(March 23, 2021 - August 31, 2027) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- 34 CFR 668.60(c), the institution shall adjust the student's award when an over award or under award is caused by the change in the expected family contribution. That adjustment must be made— (i) Within the same award year—if possible—to correct any overpayment or underpayment; or (ii) During the next award year to correct any overpayment that could not be adjusted during the year in which the student was overpaid. Condition: Students were disbursed Pell funds inaccurately. Questioned Costs: $1,722 Context: During our audit procedures, it was noted that one (1) of ten (10) students tested, the Pell amount disbursed was less than what the student was eligible to receive. Cause: The University experienced turnover in the department responsible for this process. The University does not have any records or notifications on file of the classes being adjusted resulting in a change in eligibility status. Effect: Students are not disbursed correct funds they are eligible to receive during the school year. Repeat Finding: Yes – 2022-008. Recommendation: We recommend the University implement policies to review all student award packages at the start of the academic year to ensure no over and under awards exist. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-008: Special Tests and Provisions – The Gramm-Leach-Bliley Act (GLBA) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned Costs: None Context: During our audit procedures, it was noted that the university did not conduct a risk assessment that addresses (2) and (3) of the 3 areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University experienced turnover in the department responsible for this process. Effect: The student personal information could be vulnerable. Repeat Finding: Yes – 2022-009. Recommendation: We recommend the University engage a third party or perform the risk assessment for the two areas required by the Gramm-Leach-Bliley Act that have not been completed and documented and ensure that there are documented safeguards for identified risks. Views of Responsible Officials: There is no disagreement with the audit finding.

2023 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAPP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2022-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2023 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: Yes – 2022-002. Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2023-003: Reporting – FISAP Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The University submitted inaccurate data in its annual FISAP report. Questioned Costs: None. Context: Section A of the Fiscal Operations Report, Part VI shows 65 undergraduate unduplicated recipients, but the support shows 66. Cause: Due to change in management and turnover in office, in completing the data entry, there was no oversight to ensure reporting was accurate to the supporting University records. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: Yes – 2022-003 Recommendation: We recommend the applicable campus revise procedures to ensure that the record retention requirements are met and supporting documentation agrees to the FISAP, including a supervisory review by someone other than the preparer. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-004: Special Tests and Provision – Outstanding Checks over 240 Days Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: Student checks related to student refunds of Title IV federal financial aid was outstanding more than 240 days as of June 30, 2023. Questioned Costs: $44,315. Context: During our audit procedures, it was noted that the University had 84 Title IV outstanding checks at June 30, 2022 that aged over 240 days. The outstanding checks have not been canceled or the funds returned to the Secretary. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures related to Title IV outstanding checks. Effect: The University is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes – 2022-004. Recommendation: We recommend that the University review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-005: Special Tests & Provisions – Enrollment Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34CFR section 682.610 states that all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a Roster file. Rosters must be returned within 15 days and any subsequent error records must be returned within 10 days. Condition: The University is not reporting student information to the Clearinghouse. Students tested did not have their enrollment status properly reported to the Clearinghouse. Questioned Costs: None Context: During our audit procedures, it was noted that 7 of the 8 students' enrollment information per institution records was not reported correctly to NSLDS. Also, during our audit procedures, it was noted that 2 of the 8 students' enrollment status per institution records and NSLDS did not agree. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures to ensure accurate, timely, and complete enrollment reporting. Effect: National Student Loan Database System (NSLDS) is not updated with the student information which can cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes – 2022-005. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all enrollment records are reported correctly and within the required time frame. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-006: Reporting – Common Origination and Disbursement (COD) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- From the 2022-23 FSA Handbook: to be in compliance with reporting disbursements and disbursement adjustments within 15 days. The date funds are credited to a student’s account in the institution’s general ledger or any subledger of the general ledger or paid to a student directly is the disbursement date the financial aid office reports to COD. The Common Origination and Disbursement (COD) additional requirements are: (1) Schools must use the COD system to request and receive federal student aid funds, including Direct Loans, Pell Grants, and Campus-Based aid programs. Schools must ensure that all disbursements of federal student aid are made through the COD system. (2) Schools must reconcile their records with the COD system to ensure that all disbursements are accurately reported and recorded. (3) Schools must comply with COD reporting requirements, including reporting disbursements, adjustments, and cancellations in a timely and accurate manner. Condition: During audit procedures, we noted the following items were incorrectly reported to the COD: Fall 2022 • For 1 of 10 students tested, the Unsubsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 1 of 5 students tested, the Parent Plus Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date Spring 2023 • For 2 of 10 students tested, the PELL applied dates did not fall within the 15 day requirement from the disbursement date. • For 2 of 12 students tested, the Subsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. • For 1 of 10 students tested, the Unsubsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. • For 2 of 5 students tested, the Parent Plus Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. Summer 2023 • For 5 of 10 students tested, the PELL disbursement dates did not match between COD and the student ledgers. • For 3 of 12 students tested, the Subsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 2 of 10 students tested, the Unsubsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 2 of 5 students tested, the Parent Plus Loan disbursement dates did not match between COD and the student ledgers. • For 1 of 10 students tested, the Unsubsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. Questioned Costs: None. Context: During audit procedures, we noted the following items: Fall 2022 • The Unsubsidized Direct Loan disbursement date in COD for the student in question is 09/06/2022, but on the student ledgers the date is 09/21/2021. • The Parent Plus Direct Loan Fall 2022 applied date in COD for the student in question is 6/28/2023, and the disbursement date in COD is 12/5/2022, which is 141 business days. Spring 2023 • The Pell applied dates in COD for the students in question are 04/03/2023, and the disbursement dates in COD are 02/21/2023, which is 30 business days. • The Subsidized Direct Loan applied date in COD for one student in question is 03/10/2023, and the disbursement date in COD is 01/27/23, which is 30 business days. The Subsidized Direct Loan applied date in COD for the other student in question is 02/21/23, and the disbursement date in COD is 01/27/2023, which is 17 business days. • The Unsubsidized Direct Loan applied date in COD for the student in question is 08/18/2023, and the disbursement date in COD is 01/27/2023, which is 141 business days. • The Parent Plus Direct Loan applied date in COD is 05/08/2023 for the student in question, and the disbursement date in COD is 03/31/2023, which is 26 business days. Summer 2023 • The Pell disbursement dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Subsidized Direct Loan dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Unsubsidized Direct Loan disbursement dates in COD for the students in question is 09/06/2022, but on the student ledgers the date is 09/21/2021. • The Parent Plus Direct Loan disbursement dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Unsubsidized Direct Loan applied date in COD for the student in question is 08/18/2023, and the disbursement date in COD is 06/20/2023, which is 43 business days. Cause: Employee turnover during the 2022-2023 academic year caused this process to not be completed accurately. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: Yes – 2022-007. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all disbursement dates are reported to COD accurately and timely. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-008: Special Tests and Provisions – The Gramm-Leach-Bliley Act (GLBA) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned Costs: None Context: During our audit procedures, it was noted that the university did not conduct a risk assessment that addresses (2) and (3) of the 3 areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University experienced turnover in the department responsible for this process. Effect: The student personal information could be vulnerable. Repeat Finding: Yes – 2022-009. Recommendation: We recommend the University engage a third party or perform the risk assessment for the two areas required by the Gramm-Leach-Bliley Act that have not been completed and documented and ensure that there are documented safeguards for identified risks. Views of Responsible Officials: There is no disagreement with the audit finding.

2023 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAPP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2022-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2023 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: Yes – 2022-002. Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2023-003: Reporting – FISAP Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The University submitted inaccurate data in its annual FISAP report. Questioned Costs: None. Context: Section A of the Fiscal Operations Report, Part VI shows 65 undergraduate unduplicated recipients, but the support shows 66. Cause: Due to change in management and turnover in office, in completing the data entry, there was no oversight to ensure reporting was accurate to the supporting University records. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: Yes – 2022-003 Recommendation: We recommend the applicable campus revise procedures to ensure that the record retention requirements are met and supporting documentation agrees to the FISAP, including a supervisory review by someone other than the preparer. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-004: Special Tests and Provision – Outstanding Checks over 240 Days Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: Student checks related to student refunds of Title IV federal financial aid was outstanding more than 240 days as of June 30, 2023. Questioned Costs: $44,315. Context: During our audit procedures, it was noted that the University had 84 Title IV outstanding checks at June 30, 2022 that aged over 240 days. The outstanding checks have not been canceled or the funds returned to the Secretary. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures related to Title IV outstanding checks. Effect: The University is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes – 2022-004. Recommendation: We recommend that the University review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-005: Special Tests & Provisions – Enrollment Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34CFR section 682.610 states that all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a Roster file. Rosters must be returned within 15 days and any subsequent error records must be returned within 10 days. Condition: The University is not reporting student information to the Clearinghouse. Students tested did not have their enrollment status properly reported to the Clearinghouse. Questioned Costs: None Context: During our audit procedures, it was noted that 7 of the 8 students' enrollment information per institution records was not reported correctly to NSLDS. Also, during our audit procedures, it was noted that 2 of the 8 students' enrollment status per institution records and NSLDS did not agree. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures to ensure accurate, timely, and complete enrollment reporting. Effect: National Student Loan Database System (NSLDS) is not updated with the student information which can cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes – 2022-005. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all enrollment records are reported correctly and within the required time frame. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-006: Reporting – Common Origination and Disbursement (COD) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- From the 2022-23 FSA Handbook: to be in compliance with reporting disbursements and disbursement adjustments within 15 days. The date funds are credited to a student’s account in the institution’s general ledger or any subledger of the general ledger or paid to a student directly is the disbursement date the financial aid office reports to COD. The Common Origination and Disbursement (COD) additional requirements are: (1) Schools must use the COD system to request and receive federal student aid funds, including Direct Loans, Pell Grants, and Campus-Based aid programs. Schools must ensure that all disbursements of federal student aid are made through the COD system. (2) Schools must reconcile their records with the COD system to ensure that all disbursements are accurately reported and recorded. (3) Schools must comply with COD reporting requirements, including reporting disbursements, adjustments, and cancellations in a timely and accurate manner. Condition: During audit procedures, we noted the following items were incorrectly reported to the COD: Fall 2022 • For 1 of 10 students tested, the Unsubsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 1 of 5 students tested, the Parent Plus Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date Spring 2023 • For 2 of 10 students tested, the PELL applied dates did not fall within the 15 day requirement from the disbursement date. • For 2 of 12 students tested, the Subsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. • For 1 of 10 students tested, the Unsubsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. • For 2 of 5 students tested, the Parent Plus Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. Summer 2023 • For 5 of 10 students tested, the PELL disbursement dates did not match between COD and the student ledgers. • For 3 of 12 students tested, the Subsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 2 of 10 students tested, the Unsubsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 2 of 5 students tested, the Parent Plus Loan disbursement dates did not match between COD and the student ledgers. • For 1 of 10 students tested, the Unsubsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. Questioned Costs: None. Context: During audit procedures, we noted the following items: Fall 2022 • The Unsubsidized Direct Loan disbursement date in COD for the student in question is 09/06/2022, but on the student ledgers the date is 09/21/2021. • The Parent Plus Direct Loan Fall 2022 applied date in COD for the student in question is 6/28/2023, and the disbursement date in COD is 12/5/2022, which is 141 business days. Spring 2023 • The Pell applied dates in COD for the students in question are 04/03/2023, and the disbursement dates in COD are 02/21/2023, which is 30 business days. • The Subsidized Direct Loan applied date in COD for one student in question is 03/10/2023, and the disbursement date in COD is 01/27/23, which is 30 business days. The Subsidized Direct Loan applied date in COD for the other student in question is 02/21/23, and the disbursement date in COD is 01/27/2023, which is 17 business days. • The Unsubsidized Direct Loan applied date in COD for the student in question is 08/18/2023, and the disbursement date in COD is 01/27/2023, which is 141 business days. • The Parent Plus Direct Loan applied date in COD is 05/08/2023 for the student in question, and the disbursement date in COD is 03/31/2023, which is 26 business days. Summer 2023 • The Pell disbursement dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Subsidized Direct Loan dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Unsubsidized Direct Loan disbursement dates in COD for the students in question is 09/06/2022, but on the student ledgers the date is 09/21/2021. • The Parent Plus Direct Loan disbursement dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Unsubsidized Direct Loan applied date in COD for the student in question is 08/18/2023, and the disbursement date in COD is 06/20/2023, which is 43 business days. Cause: Employee turnover during the 2022-2023 academic year caused this process to not be completed accurately. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: Yes – 2022-007. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all disbursement dates are reported to COD accurately and timely. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-008: Special Tests and Provisions – The Gramm-Leach-Bliley Act (GLBA) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned Costs: None Context: During our audit procedures, it was noted that the university did not conduct a risk assessment that addresses (2) and (3) of the 3 areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University experienced turnover in the department responsible for this process. Effect: The student personal information could be vulnerable. Repeat Finding: Yes – 2022-009. Recommendation: We recommend the University engage a third party or perform the risk assessment for the two areas required by the Gramm-Leach-Bliley Act that have not been completed and documented and ensure that there are documented safeguards for identified risks. Views of Responsible Officials: There is no disagreement with the audit finding.

2023 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAPP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2022-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2023 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: Yes – 2022-002. Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2023-003: Reporting – FISAP Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The University submitted inaccurate data in its annual FISAP report. Questioned Costs: None. Context: Section A of the Fiscal Operations Report, Part VI shows 65 undergraduate unduplicated recipients, but the support shows 66. Cause: Due to change in management and turnover in office, in completing the data entry, there was no oversight to ensure reporting was accurate to the supporting University records. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: Yes – 2022-003 Recommendation: We recommend the applicable campus revise procedures to ensure that the record retention requirements are met and supporting documentation agrees to the FISAP, including a supervisory review by someone other than the preparer. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-004: Special Tests and Provision – Outstanding Checks over 240 Days Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: Student checks related to student refunds of Title IV federal financial aid was outstanding more than 240 days as of June 30, 2023. Questioned Costs: $44,315. Context: During our audit procedures, it was noted that the University had 84 Title IV outstanding checks at June 30, 2022 that aged over 240 days. The outstanding checks have not been canceled or the funds returned to the Secretary. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures related to Title IV outstanding checks. Effect: The University is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes – 2022-004. Recommendation: We recommend that the University review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-005: Special Tests & Provisions – Enrollment Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34CFR section 682.610 states that all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a Roster file. Rosters must be returned within 15 days and any subsequent error records must be returned within 10 days. Condition: The University is not reporting student information to the Clearinghouse. Students tested did not have their enrollment status properly reported to the Clearinghouse. Questioned Costs: None Context: During our audit procedures, it was noted that 7 of the 8 students' enrollment information per institution records was not reported correctly to NSLDS. Also, during our audit procedures, it was noted that 2 of the 8 students' enrollment status per institution records and NSLDS did not agree. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures to ensure accurate, timely, and complete enrollment reporting. Effect: National Student Loan Database System (NSLDS) is not updated with the student information which can cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes – 2022-005. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all enrollment records are reported correctly and within the required time frame. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-006: Reporting – Common Origination and Disbursement (COD) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- From the 2022-23 FSA Handbook: to be in compliance with reporting disbursements and disbursement adjustments within 15 days. The date funds are credited to a student’s account in the institution’s general ledger or any subledger of the general ledger or paid to a student directly is the disbursement date the financial aid office reports to COD. The Common Origination and Disbursement (COD) additional requirements are: (1) Schools must use the COD system to request and receive federal student aid funds, including Direct Loans, Pell Grants, and Campus-Based aid programs. Schools must ensure that all disbursements of federal student aid are made through the COD system. (2) Schools must reconcile their records with the COD system to ensure that all disbursements are accurately reported and recorded. (3) Schools must comply with COD reporting requirements, including reporting disbursements, adjustments, and cancellations in a timely and accurate manner. Condition: During audit procedures, we noted the following items were incorrectly reported to the COD: Fall 2022 • For 1 of 10 students tested, the Unsubsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 1 of 5 students tested, the Parent Plus Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date Spring 2023 • For 2 of 10 students tested, the PELL applied dates did not fall within the 15 day requirement from the disbursement date. • For 2 of 12 students tested, the Subsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. • For 1 of 10 students tested, the Unsubsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. • For 2 of 5 students tested, the Parent Plus Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. Summer 2023 • For 5 of 10 students tested, the PELL disbursement dates did not match between COD and the student ledgers. • For 3 of 12 students tested, the Subsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 2 of 10 students tested, the Unsubsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 2 of 5 students tested, the Parent Plus Loan disbursement dates did not match between COD and the student ledgers. • For 1 of 10 students tested, the Unsubsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. Questioned Costs: None. Context: During audit procedures, we noted the following items: Fall 2022 • The Unsubsidized Direct Loan disbursement date in COD for the student in question is 09/06/2022, but on the student ledgers the date is 09/21/2021. • The Parent Plus Direct Loan Fall 2022 applied date in COD for the student in question is 6/28/2023, and the disbursement date in COD is 12/5/2022, which is 141 business days. Spring 2023 • The Pell applied dates in COD for the students in question are 04/03/2023, and the disbursement dates in COD are 02/21/2023, which is 30 business days. • The Subsidized Direct Loan applied date in COD for one student in question is 03/10/2023, and the disbursement date in COD is 01/27/23, which is 30 business days. The Subsidized Direct Loan applied date in COD for the other student in question is 02/21/23, and the disbursement date in COD is 01/27/2023, which is 17 business days. • The Unsubsidized Direct Loan applied date in COD for the student in question is 08/18/2023, and the disbursement date in COD is 01/27/2023, which is 141 business days. • The Parent Plus Direct Loan applied date in COD is 05/08/2023 for the student in question, and the disbursement date in COD is 03/31/2023, which is 26 business days. Summer 2023 • The Pell disbursement dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Subsidized Direct Loan dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Unsubsidized Direct Loan disbursement dates in COD for the students in question is 09/06/2022, but on the student ledgers the date is 09/21/2021. • The Parent Plus Direct Loan disbursement dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Unsubsidized Direct Loan applied date in COD for the student in question is 08/18/2023, and the disbursement date in COD is 06/20/2023, which is 43 business days. Cause: Employee turnover during the 2022-2023 academic year caused this process to not be completed accurately. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: Yes – 2022-007. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all disbursement dates are reported to COD accurately and timely. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-008: Special Tests and Provisions – The Gramm-Leach-Bliley Act (GLBA) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned Costs: None Context: During our audit procedures, it was noted that the university did not conduct a risk assessment that addresses (2) and (3) of the 3 areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University experienced turnover in the department responsible for this process. Effect: The student personal information could be vulnerable. Repeat Finding: Yes – 2022-009. Recommendation: We recommend the University engage a third party or perform the risk assessment for the two areas required by the Gramm-Leach-Bliley Act that have not been completed and documented and ensure that there are documented safeguards for identified risks. Views of Responsible Officials: There is no disagreement with the audit finding.

2023 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAPP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2022-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2023 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: Yes – 2022-002. Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2023-003: Reporting – FISAP Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The University submitted inaccurate data in its annual FISAP report. Questioned Costs: None. Context: Section A of the Fiscal Operations Report, Part VI shows 65 undergraduate unduplicated recipients, but the support shows 66. Cause: Due to change in management and turnover in office, in completing the data entry, there was no oversight to ensure reporting was accurate to the supporting University records. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: Yes – 2022-003 Recommendation: We recommend the applicable campus revise procedures to ensure that the record retention requirements are met and supporting documentation agrees to the FISAP, including a supervisory review by someone other than the preparer. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-004: Special Tests and Provision – Outstanding Checks over 240 Days Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: Student checks related to student refunds of Title IV federal financial aid was outstanding more than 240 days as of June 30, 2023. Questioned Costs: $44,315. Context: During our audit procedures, it was noted that the University had 84 Title IV outstanding checks at June 30, 2022 that aged over 240 days. The outstanding checks have not been canceled or the funds returned to the Secretary. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures related to Title IV outstanding checks. Effect: The University is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes – 2022-004. Recommendation: We recommend that the University review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-005: Special Tests & Provisions – Enrollment Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34CFR section 682.610 states that all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a Roster file. Rosters must be returned within 15 days and any subsequent error records must be returned within 10 days. Condition: The University is not reporting student information to the Clearinghouse. Students tested did not have their enrollment status properly reported to the Clearinghouse. Questioned Costs: None Context: During our audit procedures, it was noted that 7 of the 8 students' enrollment information per institution records was not reported correctly to NSLDS. Also, during our audit procedures, it was noted that 2 of the 8 students' enrollment status per institution records and NSLDS did not agree. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures to ensure accurate, timely, and complete enrollment reporting. Effect: National Student Loan Database System (NSLDS) is not updated with the student information which can cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes – 2022-005. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all enrollment records are reported correctly and within the required time frame. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-006: Reporting – Common Origination and Disbursement (COD) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- From the 2022-23 FSA Handbook: to be in compliance with reporting disbursements and disbursement adjustments within 15 days. The date funds are credited to a student’s account in the institution’s general ledger or any subledger of the general ledger or paid to a student directly is the disbursement date the financial aid office reports to COD. The Common Origination and Disbursement (COD) additional requirements are: (1) Schools must use the COD system to request and receive federal student aid funds, including Direct Loans, Pell Grants, and Campus-Based aid programs. Schools must ensure that all disbursements of federal student aid are made through the COD system. (2) Schools must reconcile their records with the COD system to ensure that all disbursements are accurately reported and recorded. (3) Schools must comply with COD reporting requirements, including reporting disbursements, adjustments, and cancellations in a timely and accurate manner. Condition: During audit procedures, we noted the following items were incorrectly reported to the COD: Fall 2022 • For 1 of 10 students tested, the Unsubsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 1 of 5 students tested, the Parent Plus Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date Spring 2023 • For 2 of 10 students tested, the PELL applied dates did not fall within the 15 day requirement from the disbursement date. • For 2 of 12 students tested, the Subsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. • For 1 of 10 students tested, the Unsubsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. • For 2 of 5 students tested, the Parent Plus Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. Summer 2023 • For 5 of 10 students tested, the PELL disbursement dates did not match between COD and the student ledgers. • For 3 of 12 students tested, the Subsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 2 of 10 students tested, the Unsubsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 2 of 5 students tested, the Parent Plus Loan disbursement dates did not match between COD and the student ledgers. • For 1 of 10 students tested, the Unsubsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. Questioned Costs: None. Context: During audit procedures, we noted the following items: Fall 2022 • The Unsubsidized Direct Loan disbursement date in COD for the student in question is 09/06/2022, but on the student ledgers the date is 09/21/2021. • The Parent Plus Direct Loan Fall 2022 applied date in COD for the student in question is 6/28/2023, and the disbursement date in COD is 12/5/2022, which is 141 business days. Spring 2023 • The Pell applied dates in COD for the students in question are 04/03/2023, and the disbursement dates in COD are 02/21/2023, which is 30 business days. • The Subsidized Direct Loan applied date in COD for one student in question is 03/10/2023, and the disbursement date in COD is 01/27/23, which is 30 business days. The Subsidized Direct Loan applied date in COD for the other student in question is 02/21/23, and the disbursement date in COD is 01/27/2023, which is 17 business days. • The Unsubsidized Direct Loan applied date in COD for the student in question is 08/18/2023, and the disbursement date in COD is 01/27/2023, which is 141 business days. • The Parent Plus Direct Loan applied date in COD is 05/08/2023 for the student in question, and the disbursement date in COD is 03/31/2023, which is 26 business days. Summer 2023 • The Pell disbursement dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Subsidized Direct Loan dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Unsubsidized Direct Loan disbursement dates in COD for the students in question is 09/06/2022, but on the student ledgers the date is 09/21/2021. • The Parent Plus Direct Loan disbursement dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Unsubsidized Direct Loan applied date in COD for the student in question is 08/18/2023, and the disbursement date in COD is 06/20/2023, which is 43 business days. Cause: Employee turnover during the 2022-2023 academic year caused this process to not be completed accurately. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: Yes – 2022-007. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all disbursement dates are reported to COD accurately and timely. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-007: Eligibility – Pell Awarding Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.063 Award Number and Year: P063P213807(March 23, 2021 - August 31, 2027) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- 34 CFR 668.60(c), the institution shall adjust the student's award when an over award or under award is caused by the change in the expected family contribution. That adjustment must be made— (i) Within the same award year—if possible—to correct any overpayment or underpayment; or (ii) During the next award year to correct any overpayment that could not be adjusted during the year in which the student was overpaid. Condition: Students were disbursed Pell funds inaccurately. Questioned Costs: $1,722 Context: During our audit procedures, it was noted that one (1) of ten (10) students tested, the Pell amount disbursed was less than what the student was eligible to receive. Cause: The University experienced turnover in the department responsible for this process. The University does not have any records or notifications on file of the classes being adjusted resulting in a change in eligibility status. Effect: Students are not disbursed correct funds they are eligible to receive during the school year. Repeat Finding: Yes – 2022-008. Recommendation: We recommend the University implement policies to review all student award packages at the start of the academic year to ensure no over and under awards exist. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-008: Special Tests and Provisions – The Gramm-Leach-Bliley Act (GLBA) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned Costs: None Context: During our audit procedures, it was noted that the university did not conduct a risk assessment that addresses (2) and (3) of the 3 areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University experienced turnover in the department responsible for this process. Effect: The student personal information could be vulnerable. Repeat Finding: Yes – 2022-009. Recommendation: We recommend the University engage a third party or perform the risk assessment for the two areas required by the Gramm-Leach-Bliley Act that have not been completed and documented and ensure that there are documented safeguards for identified risks. Views of Responsible Officials: There is no disagreement with the audit finding.

2023 – 001: Financial Statement Preparation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The board and management share the ultimate responsibility for the University's internal control system. While it is acceptable to outsource various accounting functions, the responsibility for internal control cannot be outsourced. Various significant audit adjustments were proposed and posted through the audit process. The adjustments were a necessary step in ensuring the financial statements were fairly stated in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Criteria or specific requirement: In an ideal control setting, the University would have a comprehensive control procedure to ensure that the financial statements, including disclosures are complete and accurate. Such review procedures should be performed by an individual possessing a thorough understanding of applicable U.S. GAPP. Context: While performing audit procedures, it was noted that due to staffing turnover and changes, the board and management did not have appropriate procedures in place to provide reasonable assurance that financial statements are prepared in accordance with U.S. GAAP, including retaining supporting documentation and reconciliations. Effect: It is possible that a misstatement of the University's financial statements could occur and not be prevented or detected by the University's internal control. Cause: Due to change in management and turnover in office, the University’s controls were not able to detect the adjustments made as part of the audit. The University does not have a comprehensive review process to ensure that the financial statements, including disclosures, are complete, accurate, and supported by the University’s records. Repeat finding: Yes – 2022-001. Recommendation: We recommend that management review controls related to financial statement preparation review at the end of each period. Financial statement preparation should include a review of reconciliations and balances to ensure that financial statement line items are properly stated and classified. Internally prepared financial statements should also be thoroughly reviewed by members of the board and management outside the finance department on a periodic (monthly or quarterly). Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2023 – 002: Segregation of Duties and Control Documentation Type of Finding: • Material Weakness in Internal Control over Financial Reporting Condition: The University does not have appropriate segregation of duties and review control procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained; therefore, the potential exists that a material misstatement of the annual financial statements could occur and not be prevented, or detected and corrected, by the University’s internal controls. Criteria or specific requirement: Internal controls should be in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Context: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties control and review procedures in place to provide reasonable assurance that financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP Effect: The lack of controls and review procedures in place over the financial reporting function increases the risk of misstatements, fraud, or errors occurring and not being detected and corrected. Cause: While performing audit procedures, it was noted that due to staffing turnover, staffing changes, and operational challenges, management does not have appropriate segregation of duties and review procedures in place. Repeat Finding: Yes – 2022-002. Recommendation: The University should evaluate their financial reporting processes and controls, including the segregation of duties among its internal staff (including number of internal staff), to determine whether additional processes and controls over the financial records of the University are complete, accurate, and retained to support the University’s financial statement prepared in accordance with U.S. GAAP. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding.

2023-003: Reporting – FISAP Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The University submitted inaccurate data in its annual FISAP report. Questioned Costs: None. Context: Section A of the Fiscal Operations Report, Part VI shows 65 undergraduate unduplicated recipients, but the support shows 66. Cause: Due to change in management and turnover in office, in completing the data entry, there was no oversight to ensure reporting was accurate to the supporting University records. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: Yes – 2022-003 Recommendation: We recommend the applicable campus revise procedures to ensure that the record retention requirements are met and supporting documentation agrees to the FISAP, including a supervisory review by someone other than the preparer. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-004: Special Tests and Provision – Outstanding Checks over 240 Days Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: Student checks related to student refunds of Title IV federal financial aid was outstanding more than 240 days as of June 30, 2023. Questioned Costs: $44,315. Context: During our audit procedures, it was noted that the University had 84 Title IV outstanding checks at June 30, 2022 that aged over 240 days. The outstanding checks have not been canceled or the funds returned to the Secretary. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures related to Title IV outstanding checks. Effect: The University is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes – 2022-004. Recommendation: We recommend that the University review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-005: Special Tests & Provisions – Enrollment Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Code of Federal Regulations, 34CFR section 682.610 states that all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a Roster file. Rosters must be returned within 15 days and any subsequent error records must be returned within 10 days. Condition: The University is not reporting student information to the Clearinghouse. Students tested did not have their enrollment status properly reported to the Clearinghouse. Questioned Costs: None Context: During our audit procedures, it was noted that 7 of the 8 students' enrollment information per institution records was not reported correctly to NSLDS. Also, during our audit procedures, it was noted that 2 of the 8 students' enrollment status per institution records and NSLDS did not agree. Cause: Employee turnover in the finance area caused a lapse in the development and implementation of policies and procedures to ensure accurate, timely, and complete enrollment reporting. Effect: National Student Loan Database System (NSLDS) is not updated with the student information which can cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes – 2022-005. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all enrollment records are reported correctly and within the required time frame. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-006: Reporting – Common Origination and Disbursement (COD) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- From the 2022-23 FSA Handbook: to be in compliance with reporting disbursements and disbursement adjustments within 15 days. The date funds are credited to a student’s account in the institution’s general ledger or any subledger of the general ledger or paid to a student directly is the disbursement date the financial aid office reports to COD. The Common Origination and Disbursement (COD) additional requirements are: (1) Schools must use the COD system to request and receive federal student aid funds, including Direct Loans, Pell Grants, and Campus-Based aid programs. Schools must ensure that all disbursements of federal student aid are made through the COD system. (2) Schools must reconcile their records with the COD system to ensure that all disbursements are accurately reported and recorded. (3) Schools must comply with COD reporting requirements, including reporting disbursements, adjustments, and cancellations in a timely and accurate manner. Condition: During audit procedures, we noted the following items were incorrectly reported to the COD: Fall 2022 • For 1 of 10 students tested, the Unsubsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 1 of 5 students tested, the Parent Plus Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date Spring 2023 • For 2 of 10 students tested, the PELL applied dates did not fall within the 15 day requirement from the disbursement date. • For 2 of 12 students tested, the Subsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. • For 1 of 10 students tested, the Unsubsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. • For 2 of 5 students tested, the Parent Plus Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. Summer 2023 • For 5 of 10 students tested, the PELL disbursement dates did not match between COD and the student ledgers. • For 3 of 12 students tested, the Subsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 2 of 10 students tested, the Unsubsidized Direct Loan disbursement dates did not match between COD and the student ledgers. • For 2 of 5 students tested, the Parent Plus Loan disbursement dates did not match between COD and the student ledgers. • For 1 of 10 students tested, the Unsubsidized Direct Loan applied dates did not fall within the 15 day requirement from the disbursement date. Questioned Costs: None. Context: During audit procedures, we noted the following items: Fall 2022 • The Unsubsidized Direct Loan disbursement date in COD for the student in question is 09/06/2022, but on the student ledgers the date is 09/21/2021. • The Parent Plus Direct Loan Fall 2022 applied date in COD for the student in question is 6/28/2023, and the disbursement date in COD is 12/5/2022, which is 141 business days. Spring 2023 • The Pell applied dates in COD for the students in question are 04/03/2023, and the disbursement dates in COD are 02/21/2023, which is 30 business days. • The Subsidized Direct Loan applied date in COD for one student in question is 03/10/2023, and the disbursement date in COD is 01/27/23, which is 30 business days. The Subsidized Direct Loan applied date in COD for the other student in question is 02/21/23, and the disbursement date in COD is 01/27/2023, which is 17 business days. • The Unsubsidized Direct Loan applied date in COD for the student in question is 08/18/2023, and the disbursement date in COD is 01/27/2023, which is 141 business days. • The Parent Plus Direct Loan applied date in COD is 05/08/2023 for the student in question, and the disbursement date in COD is 03/31/2023, which is 26 business days. Summer 2023 • The Pell disbursement dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Subsidized Direct Loan dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Unsubsidized Direct Loan disbursement dates in COD for the students in question is 09/06/2022, but on the student ledgers the date is 09/21/2021. • The Parent Plus Direct Loan disbursement dates in COD for the students in question are 06/16/2023, but on the student ledgers the dates are 06/20/2023. • The Unsubsidized Direct Loan applied date in COD for the student in question is 08/18/2023, and the disbursement date in COD is 06/20/2023, which is 43 business days. Cause: Employee turnover during the 2022-2023 academic year caused this process to not be completed accurately. Effect: The University is not complying with federal requirements of reporting and information-sharing requirements established by the Department of Education. Repeat Finding: Yes – 2022-007. Recommendation: We recommend that the entity strengthen its internal controls to ensure that all disbursement dates are reported to COD accurately and timely. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-008: Special Tests and Provisions – The Gramm-Leach-Bliley Act (GLBA) Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Award Number and Year: P007A215801 (March 25, 2021 - August 31, 2027), P033A215801(July 1, 2021 - August 31, 2027), P063P213807(March 23, 2021 - August 31, 2027), P268K223807(January 1, 2021 - July 31, 2043) Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance- The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned Costs: None Context: During our audit procedures, it was noted that the university did not conduct a risk assessment that addresses (2) and (3) of the 3 areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University experienced turnover in the department responsible for this process. Effect: The student personal information could be vulnerable. Repeat Finding: Yes – 2022-009. Recommendation: We recommend the University engage a third party or perform the risk assessment for the two areas required by the Gramm-Leach-Bliley Act that have not been completed and documented and ensure that there are documented safeguards for identified risks. Views of Responsible Officials: There is no disagreement with the audit finding.