Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
* Other Matters
Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.25(e) states that an institution must notify the Department of Education by way of the ECAR within 10 days of a change in position of an official at the Institution.
Condition: During our testing, we noted the Chief Operating Officer and Financial Aid Manager was not reported timely to the Department of Education.
Questioned costs: None
Context: During our testing, we noted the Chief Operating Officer and Financial Aid Manager had a change in position and it was not updated within 10 days.
Cause: There was not a formal process in place to ensure ECAR updates were made timely to ensure the Academy is in compliance with the regulations.
Effect: The Academy is not in compliance with Department of Education requirements that state the ECAR must have accurately reported information.
Repeat finding: No
Recommendation: We recommend the Academy review its reporting procedures surrounding updating the ECAR to ensure reporting is accurate and completed.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
* Other Matters
Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.25(e) states that an institution must notify the Department of Education by way of the ECAR within 10 days of a change in position of an official at the Institution.
Condition: During our testing, we noted the Chief Operating Officer and Financial Aid Manager was not reported timely to the Department of Education.
Questioned costs: None
Context: During our testing, we noted the Chief Operating Officer and Financial Aid Manager had a change in position and it was not updated within 10 days.
Cause: There was not a formal process in place to ensure ECAR updates were made timely to ensure the Academy is in compliance with the regulations.
Effect: The Academy is not in compliance with Department of Education requirements that state the ECAR must have accurately reported information.
Repeat finding: No
Recommendation: We recommend the Academy review its reporting procedures surrounding updating the ECAR to ensure reporting is accurate and completed.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
* Other Matters
Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.25(e) states that an institution must notify the Department of Education by way of the ECAR within 10 days of a change in position of an official at the Institution.
Condition: During our testing, we noted the Chief Operating Officer and Financial Aid Manager was not reported timely to the Department of Education.
Questioned costs: None
Context: During our testing, we noted the Chief Operating Officer and Financial Aid Manager had a change in position and it was not updated within 10 days.
Cause: There was not a formal process in place to ensure ECAR updates were made timely to ensure the Academy is in compliance with the regulations.
Effect: The Academy is not in compliance with Department of Education requirements that state the ECAR must have accurately reported information.
Repeat finding: No
Recommendation: We recommend the Academy review its reporting procedures surrounding updating the ECAR to ensure reporting is accurate and completed.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
* Other Matters
Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data to the National Student Loan Data System (NSLDS) through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date as well as program enrollment effective date. Changes to a students’ status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days.
Condition: During our testing, we noted 15 out of the 40 students’ enrollment effective report to NSLDS did not match the Academy’s records. Furthermore, we noted 22 out of the 40 students did not have their enrollment certified every 60 days. Lastly, we noted 1 out of 40 students change in status was not reported in a timely manner.
Questioned costs: None
Context: During our testing, it was noted the Academy does not have a process in place to ensure timeliness and accuracy of NSLDS reporting.
Cause: The Academy did not have a process in place to ensure the effective dates reported matched the University’s records as well as that these changes were reported timely.
Effect: The enrollment effective date reported to NSLDS is used to determine when the student’s grace period should begin. By not reporting an incorrect effective date, the grace period begin date for the student will be incorrect. In addition, the Academy did not comply with Department of Education (ED) regulations by reporting student enrollment status changes timely.
Repeat finding: No
Recommendation: We recommend the Academy reevaluate its procedures and review policies surrounding reporting status changes to NSLDS to put a process in place to ensure the student status changes are being reported timely.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
* Other Matters
Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data to the National Student Loan Data System (NSLDS) through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date as well as program enrollment effective date. Changes to a students’ status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days.
Condition: During our testing, we noted 15 out of the 40 students’ enrollment effective report to NSLDS did not match the Academy’s records. Furthermore, we noted 22 out of the 40 students did not have their enrollment certified every 60 days. Lastly, we noted 1 out of 40 students change in status was not reported in a timely manner.
Questioned costs: None
Context: During our testing, it was noted the Academy does not have a process in place to ensure timeliness and accuracy of NSLDS reporting.
Cause: The Academy did not have a process in place to ensure the effective dates reported matched the University’s records as well as that these changes were reported timely.
Effect: The enrollment effective date reported to NSLDS is used to determine when the student’s grace period should begin. By not reporting an incorrect effective date, the grace period begin date for the student will be incorrect. In addition, the Academy did not comply with Department of Education (ED) regulations by reporting student enrollment status changes timely.
Repeat finding: No
Recommendation: We recommend the Academy reevaluate its procedures and review policies surrounding reporting status changes to NSLDS to put a process in place to ensure the student status changes are being reported timely.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
* Other Matters
Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data to the National Student Loan Data System (NSLDS) through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date as well as program enrollment effective date. Changes to a students’ status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days.
Condition: During our testing, we noted 15 out of the 40 students’ enrollment effective report to NSLDS did not match the Academy’s records. Furthermore, we noted 22 out of the 40 students did not have their enrollment certified every 60 days. Lastly, we noted 1 out of 40 students change in status was not reported in a timely manner.
Questioned costs: None
Context: During our testing, it was noted the Academy does not have a process in place to ensure timeliness and accuracy of NSLDS reporting.
Cause: The Academy did not have a process in place to ensure the effective dates reported matched the University’s records as well as that these changes were reported timely.
Effect: The enrollment effective date reported to NSLDS is used to determine when the student’s grace period should begin. By not reporting an incorrect effective date, the grace period begin date for the student will be incorrect. In addition, the Academy did not comply with Department of Education (ED) regulations by reporting student enrollment status changes timely.
Repeat finding: No
Recommendation: We recommend the Academy reevaluate its procedures and review policies surrounding reporting status changes to NSLDS to put a process in place to ensure the student status changes are being reported timely.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
Criteria or specific requirement: The 2 CFR Section 200.303 require that nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal Statues, regulations, and the term and conditions of the federal awards.
Condition: During our testing of Common Origination and Disbursement (COD), Return of Title IV Funds (R2T4) and National Student Loan Data System (NSLDS), we noted there was a review process implemented; however, there was no process in place to retain the review being performed as to provide evidence to ensure the controls are being performed effectively.
Questioned costs: None
Context: During our testing, it was noted the Academy does not have a process in place to ensure controls are being performed effectively.
Cause: The Academy did not have a process in place to ensure controls implemented are being performed effectively.
Effect: There is no way to determine who was involved in the process should an error be present.
Repeat finding: No
Recommendation: We recommend the Academy reevaluate its procedures and review policies surrounding controls implemented for Title IV Aid.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
Criteria or specific requirement: The 2 CFR Section 200.303 require that nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal Statues, regulations, and the term and conditions of the federal awards.
Condition: During our testing of Common Origination and Disbursement (COD), Return of Title IV Funds (R2T4) and National Student Loan Data System (NSLDS), we noted there was a review process implemented; however, there was no process in place to retain the review being performed as to provide evidence to ensure the controls are being performed effectively.
Questioned costs: None
Context: During our testing, it was noted the Academy does not have a process in place to ensure controls are being performed effectively.
Cause: The Academy did not have a process in place to ensure controls implemented are being performed effectively.
Effect: There is no way to determine who was involved in the process should an error be present.
Repeat finding: No
Recommendation: We recommend the Academy reevaluate its procedures and review policies surrounding controls implemented for Title IV Aid.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
Criteria or specific requirement: The 2 CFR Section 200.303 require that nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal Statues, regulations, and the term and conditions of the federal awards.
Condition: During our testing of Common Origination and Disbursement (COD), Return of Title IV Funds (R2T4) and National Student Loan Data System (NSLDS), we noted there was a review process implemented; however, there was no process in place to retain the review being performed as to provide evidence to ensure the controls are being performed effectively.
Questioned costs: None
Context: During our testing, it was noted the Academy does not have a process in place to ensure controls are being performed effectively.
Cause: The Academy did not have a process in place to ensure controls implemented are being performed effectively.
Effect: There is no way to determine who was involved in the process should an error be present.
Repeat finding: No
Recommendation: We recommend the Academy reevaluate its procedures and review policies surrounding controls implemented for Title IV Aid.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
* Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
Condition: During our testing, we noted the Academy did not implement multi-factor authentication (MFA) for anyone accessing customer information on the institution’s system during the year under audit.
Questioned costs: None
Context: Implement MFA is required based on the GLBA requirements that were applicable beginning on June 9, 2023 and was not implemented during the year under audit.
Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance.
Effect: Student personal information could be vulnerable.
Repeat finding: Yes
Recommendation: We recommend the Academy implement MFA for individuals that access sensitive information per GLBA requirements.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
* Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
Condition: During our testing, we noted the Academy did not implement multi-factor authentication (MFA) for anyone accessing customer information on the institution’s system during the year under audit.
Questioned costs: None
Context: Implement MFA is required based on the GLBA requirements that were applicable beginning on June 9, 2023 and was not implemented during the year under audit.
Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance.
Effect: Student personal information could be vulnerable.
Repeat finding: Yes
Recommendation: We recommend the Academy implement MFA for individuals that access sensitive information per GLBA requirements.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
* Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
Condition: During our testing, we noted the Academy did not implement multi-factor authentication (MFA) for anyone accessing customer information on the institution’s system during the year under audit.
Questioned costs: None
Context: Implement MFA is required based on the GLBA requirements that were applicable beginning on June 9, 2023 and was not implemented during the year under audit.
Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance.
Effect: Student personal information could be vulnerable.
Repeat finding: Yes
Recommendation: We recommend the Academy implement MFA for individuals that access sensitive information per GLBA requirements.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
* Other Matters
Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.25(e) states that an institution must notify the Department of Education by way of the ECAR within 10 days of a change in position of an official at the Institution.
Condition: During our testing, we noted the Chief Operating Officer and Financial Aid Manager was not reported timely to the Department of Education.
Questioned costs: None
Context: During our testing, we noted the Chief Operating Officer and Financial Aid Manager had a change in position and it was not updated within 10 days.
Cause: There was not a formal process in place to ensure ECAR updates were made timely to ensure the Academy is in compliance with the regulations.
Effect: The Academy is not in compliance with Department of Education requirements that state the ECAR must have accurately reported information.
Repeat finding: No
Recommendation: We recommend the Academy review its reporting procedures surrounding updating the ECAR to ensure reporting is accurate and completed.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
* Other Matters
Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.25(e) states that an institution must notify the Department of Education by way of the ECAR within 10 days of a change in position of an official at the Institution.
Condition: During our testing, we noted the Chief Operating Officer and Financial Aid Manager was not reported timely to the Department of Education.
Questioned costs: None
Context: During our testing, we noted the Chief Operating Officer and Financial Aid Manager had a change in position and it was not updated within 10 days.
Cause: There was not a formal process in place to ensure ECAR updates were made timely to ensure the Academy is in compliance with the regulations.
Effect: The Academy is not in compliance with Department of Education requirements that state the ECAR must have accurately reported information.
Repeat finding: No
Recommendation: We recommend the Academy review its reporting procedures surrounding updating the ECAR to ensure reporting is accurate and completed.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
* Other Matters
Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.25(e) states that an institution must notify the Department of Education by way of the ECAR within 10 days of a change in position of an official at the Institution.
Condition: During our testing, we noted the Chief Operating Officer and Financial Aid Manager was not reported timely to the Department of Education.
Questioned costs: None
Context: During our testing, we noted the Chief Operating Officer and Financial Aid Manager had a change in position and it was not updated within 10 days.
Cause: There was not a formal process in place to ensure ECAR updates were made timely to ensure the Academy is in compliance with the regulations.
Effect: The Academy is not in compliance with Department of Education requirements that state the ECAR must have accurately reported information.
Repeat finding: No
Recommendation: We recommend the Academy review its reporting procedures surrounding updating the ECAR to ensure reporting is accurate and completed.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
* Other Matters
Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data to the National Student Loan Data System (NSLDS) through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date as well as program enrollment effective date. Changes to a students’ status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days.
Condition: During our testing, we noted 15 out of the 40 students’ enrollment effective report to NSLDS did not match the Academy’s records. Furthermore, we noted 22 out of the 40 students did not have their enrollment certified every 60 days. Lastly, we noted 1 out of 40 students change in status was not reported in a timely manner.
Questioned costs: None
Context: During our testing, it was noted the Academy does not have a process in place to ensure timeliness and accuracy of NSLDS reporting.
Cause: The Academy did not have a process in place to ensure the effective dates reported matched the University’s records as well as that these changes were reported timely.
Effect: The enrollment effective date reported to NSLDS is used to determine when the student’s grace period should begin. By not reporting an incorrect effective date, the grace period begin date for the student will be incorrect. In addition, the Academy did not comply with Department of Education (ED) regulations by reporting student enrollment status changes timely.
Repeat finding: No
Recommendation: We recommend the Academy reevaluate its procedures and review policies surrounding reporting status changes to NSLDS to put a process in place to ensure the student status changes are being reported timely.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
* Other Matters
Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data to the National Student Loan Data System (NSLDS) through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date as well as program enrollment effective date. Changes to a students’ status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days.
Condition: During our testing, we noted 15 out of the 40 students’ enrollment effective report to NSLDS did not match the Academy’s records. Furthermore, we noted 22 out of the 40 students did not have their enrollment certified every 60 days. Lastly, we noted 1 out of 40 students change in status was not reported in a timely manner.
Questioned costs: None
Context: During our testing, it was noted the Academy does not have a process in place to ensure timeliness and accuracy of NSLDS reporting.
Cause: The Academy did not have a process in place to ensure the effective dates reported matched the University’s records as well as that these changes were reported timely.
Effect: The enrollment effective date reported to NSLDS is used to determine when the student’s grace period should begin. By not reporting an incorrect effective date, the grace period begin date for the student will be incorrect. In addition, the Academy did not comply with Department of Education (ED) regulations by reporting student enrollment status changes timely.
Repeat finding: No
Recommendation: We recommend the Academy reevaluate its procedures and review policies surrounding reporting status changes to NSLDS to put a process in place to ensure the student status changes are being reported timely.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
* Other Matters
Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data to the National Student Loan Data System (NSLDS) through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date as well as program enrollment effective date. Changes to a students’ status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days.
Condition: During our testing, we noted 15 out of the 40 students’ enrollment effective report to NSLDS did not match the Academy’s records. Furthermore, we noted 22 out of the 40 students did not have their enrollment certified every 60 days. Lastly, we noted 1 out of 40 students change in status was not reported in a timely manner.
Questioned costs: None
Context: During our testing, it was noted the Academy does not have a process in place to ensure timeliness and accuracy of NSLDS reporting.
Cause: The Academy did not have a process in place to ensure the effective dates reported matched the University’s records as well as that these changes were reported timely.
Effect: The enrollment effective date reported to NSLDS is used to determine when the student’s grace period should begin. By not reporting an incorrect effective date, the grace period begin date for the student will be incorrect. In addition, the Academy did not comply with Department of Education (ED) regulations by reporting student enrollment status changes timely.
Repeat finding: No
Recommendation: We recommend the Academy reevaluate its procedures and review policies surrounding reporting status changes to NSLDS to put a process in place to ensure the student status changes are being reported timely.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
Criteria or specific requirement: The 2 CFR Section 200.303 require that nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal Statues, regulations, and the term and conditions of the federal awards.
Condition: During our testing of Common Origination and Disbursement (COD), Return of Title IV Funds (R2T4) and National Student Loan Data System (NSLDS), we noted there was a review process implemented; however, there was no process in place to retain the review being performed as to provide evidence to ensure the controls are being performed effectively.
Questioned costs: None
Context: During our testing, it was noted the Academy does not have a process in place to ensure controls are being performed effectively.
Cause: The Academy did not have a process in place to ensure controls implemented are being performed effectively.
Effect: There is no way to determine who was involved in the process should an error be present.
Repeat finding: No
Recommendation: We recommend the Academy reevaluate its procedures and review policies surrounding controls implemented for Title IV Aid.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
Criteria or specific requirement: The 2 CFR Section 200.303 require that nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal Statues, regulations, and the term and conditions of the federal awards.
Condition: During our testing of Common Origination and Disbursement (COD), Return of Title IV Funds (R2T4) and National Student Loan Data System (NSLDS), we noted there was a review process implemented; however, there was no process in place to retain the review being performed as to provide evidence to ensure the controls are being performed effectively.
Questioned costs: None
Context: During our testing, it was noted the Academy does not have a process in place to ensure controls are being performed effectively.
Cause: The Academy did not have a process in place to ensure controls implemented are being performed effectively.
Effect: There is no way to determine who was involved in the process should an error be present.
Repeat finding: No
Recommendation: We recommend the Academy reevaluate its procedures and review policies surrounding controls implemented for Title IV Aid.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
Criteria or specific requirement: The 2 CFR Section 200.303 require that nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal Statues, regulations, and the term and conditions of the federal awards.
Condition: During our testing of Common Origination and Disbursement (COD), Return of Title IV Funds (R2T4) and National Student Loan Data System (NSLDS), we noted there was a review process implemented; however, there was no process in place to retain the review being performed as to provide evidence to ensure the controls are being performed effectively.
Questioned costs: None
Context: During our testing, it was noted the Academy does not have a process in place to ensure controls are being performed effectively.
Cause: The Academy did not have a process in place to ensure controls implemented are being performed effectively.
Effect: There is no way to determine who was involved in the process should an error be present.
Repeat finding: No
Recommendation: We recommend the Academy reevaluate its procedures and review policies surrounding controls implemented for Title IV Aid.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
* Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
Condition: During our testing, we noted the Academy did not implement multi-factor authentication (MFA) for anyone accessing customer information on the institution’s system during the year under audit.
Questioned costs: None
Context: Implement MFA is required based on the GLBA requirements that were applicable beginning on June 9, 2023 and was not implemented during the year under audit.
Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance.
Effect: Student personal information could be vulnerable.
Repeat finding: Yes
Recommendation: We recommend the Academy implement MFA for individuals that access sensitive information per GLBA requirements.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
* Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
Condition: During our testing, we noted the Academy did not implement multi-factor authentication (MFA) for anyone accessing customer information on the institution’s system during the year under audit.
Questioned costs: None
Context: Implement MFA is required based on the GLBA requirements that were applicable beginning on June 9, 2023 and was not implemented during the year under audit.
Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance.
Effect: Student personal information could be vulnerable.
Repeat finding: Yes
Recommendation: We recommend the Academy implement MFA for individuals that access sensitive information per GLBA requirements.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: Department of Education
Federal Program Title: Student Financial Aid Cluster – Various
Assistance Listing Numbers: Various
Federal Award Identification Number and Year: Various
Pass-Through Agency: N/A
Pass-Through Number: N/A
Award Period: July 1, 2023, through June 30, 2024
Type of Finding:
* Significant Deficiency in Internal Control Over Compliance
* Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
Condition: During our testing, we noted the Academy did not implement multi-factor authentication (MFA) for anyone accessing customer information on the institution’s system during the year under audit.
Questioned costs: None
Context: Implement MFA is required based on the GLBA requirements that were applicable beginning on June 9, 2023 and was not implemented during the year under audit.
Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance.
Effect: Student personal information could be vulnerable.
Repeat finding: Yes
Recommendation: We recommend the Academy implement MFA for individuals that access sensitive information per GLBA requirements.
Views of responsible officials: There is no disagreement with the audit finding.