Audit 332923

Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: GLBA requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, there was evidence obtained of five procedures being performed during the year; however, these five items were missing from the formally documented Written Information Security Program (WISP). The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were not included in the WISP: 􀁸 Implement and periodically review access controls 􀁸 Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted 􀁸 Encrypt customer information on the institution’s system and when it’s in transit 􀁸 Dispose of customer information securely In addition, we were not able to verify that the WISP provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented. Questioned Costs: N/A Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were five elements missing from the WISP. Cause: The current processes in place did not ensure 100% compliance with the new GLBA requirements. Effect: The student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: GLBA requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, there was evidence obtained of five procedures being performed during the year; however, these five items were missing from the formally documented Written Information Security Program (WISP). The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were not included in the WISP: 􀁸 Implement and periodically review access controls 􀁸 Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted 􀁸 Encrypt customer information on the institution’s system and when it’s in transit 􀁸 Dispose of customer information securely In addition, we were not able to verify that the WISP provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented. Questioned Costs: N/A Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were five elements missing from the WISP. Cause: The current processes in place did not ensure 100% compliance with the new GLBA requirements. Effect: The student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: GLBA requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, there was evidence obtained of five procedures being performed during the year; however, these five items were missing from the formally documented Written Information Security Program (WISP). The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were not included in the WISP: 􀁸 Implement and periodically review access controls 􀁸 Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted 􀁸 Encrypt customer information on the institution’s system and when it’s in transit 􀁸 Dispose of customer information securely In addition, we were not able to verify that the WISP provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented. Questioned Costs: N/A Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were five elements missing from the WISP. Cause: The current processes in place did not ensure 100% compliance with the new GLBA requirements. Effect: The student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: GLBA requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, there was evidence obtained of five procedures being performed during the year; however, these five items were missing from the formally documented Written Information Security Program (WISP). The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were not included in the WISP: 􀁸 Implement and periodically review access controls 􀁸 Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted 􀁸 Encrypt customer information on the institution’s system and when it’s in transit 􀁸 Dispose of customer information securely In addition, we were not able to verify that the WISP provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented. Questioned Costs: N/A Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were five elements missing from the WISP. Cause: The current processes in place did not ensure 100% compliance with the new GLBA requirements. Effect: The student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: GLBA requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, there was evidence obtained of five procedures being performed during the year; however, these five items were missing from the formally documented Written Information Security Program (WISP). The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were not included in the WISP: 􀁸 Implement and periodically review access controls 􀁸 Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted 􀁸 Encrypt customer information on the institution’s system and when it’s in transit 􀁸 Dispose of customer information securely In addition, we were not able to verify that the WISP provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented. Questioned Costs: N/A Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were five elements missing from the WISP. Cause: The current processes in place did not ensure 100% compliance with the new GLBA requirements. Effect: The student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: GLBA requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, there was evidence obtained of five procedures being performed during the year; however, these five items were missing from the formally documented Written Information Security Program (WISP). The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were not included in the WISP: 􀁸 Implement and periodically review access controls 􀁸 Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted 􀁸 Encrypt customer information on the institution’s system and when it’s in transit 􀁸 Dispose of customer information securely In addition, we were not able to verify that the WISP provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented. Questioned Costs: N/A Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were five elements missing from the WISP. Cause: The current processes in place did not ensure 100% compliance with the new GLBA requirements. Effect: The student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Condition: During our testing, we noted for 3 out of the 40 students, the enrollment effective date per NSLDS did not match the University’s records. Questioned Costs: N/A Context: Two of the students were graduated and specifically involved in student teaching and one individual was a withdrawal in between fall and spring term. Cause: The University’s current process in place did not ensure all students were reported accurately. Effect: The University did not comply with Department of Education (ED) regulations by reporting student enrollment status changes accurately. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure that students’ statuses are accurately reported to NSLDS as required by regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Condition: During our testing, we noted for 3 out of the 40 students, the enrollment effective date per NSLDS did not match the University’s records. Questioned Costs: N/A Context: Two of the students were graduated and specifically involved in student teaching and one individual was a withdrawal in between fall and spring term. Cause: The University’s current process in place did not ensure all students were reported accurately. Effect: The University did not comply with Department of Education (ED) regulations by reporting student enrollment status changes accurately. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure that students’ statuses are accurately reported to NSLDS as required by regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Condition: During our testing, we noted for 3 out of the 40 students, the enrollment effective date per NSLDS did not match the University’s records. Questioned Costs: N/A Context: Two of the students were graduated and specifically involved in student teaching and one individual was a withdrawal in between fall and spring term. Cause: The University’s current process in place did not ensure all students were reported accurately. Effect: The University did not comply with Department of Education (ED) regulations by reporting student enrollment status changes accurately. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure that students’ statuses are accurately reported to NSLDS as required by regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Condition: During our testing, we noted for 3 out of the 40 students, the enrollment effective date per NSLDS did not match the University’s records. Questioned Costs: N/A Context: Two of the students were graduated and specifically involved in student teaching and one individual was a withdrawal in between fall and spring term. Cause: The University’s current process in place did not ensure all students were reported accurately. Effect: The University did not comply with Department of Education (ED) regulations by reporting student enrollment status changes accurately. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure that students’ statuses are accurately reported to NSLDS as required by regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Condition: During our testing, we noted for 3 out of the 40 students, the enrollment effective date per NSLDS did not match the University’s records. Questioned Costs: N/A Context: Two of the students were graduated and specifically involved in student teaching and one individual was a withdrawal in between fall and spring term. Cause: The University’s current process in place did not ensure all students were reported accurately. Effect: The University did not comply with Department of Education (ED) regulations by reporting student enrollment status changes accurately. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure that students’ statuses are accurately reported to NSLDS as required by regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Condition: During our testing, we noted for 3 out of the 40 students, the enrollment effective date per NSLDS did not match the University’s records. Questioned Costs: N/A Context: Two of the students were graduated and specifically involved in student teaching and one individual was a withdrawal in between fall and spring term. Cause: The University’s current process in place did not ensure all students were reported accurately. Effect: The University did not comply with Department of Education (ED) regulations by reporting student enrollment status changes accurately. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure that students’ statuses are accurately reported to NSLDS as required by regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: GLBA requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, there was evidence obtained of five procedures being performed during the year; however, these five items were missing from the formally documented Written Information Security Program (WISP). The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were not included in the WISP: 􀁸 Implement and periodically review access controls 􀁸 Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted 􀁸 Encrypt customer information on the institution’s system and when it’s in transit 􀁸 Dispose of customer information securely In addition, we were not able to verify that the WISP provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented. Questioned Costs: N/A Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were five elements missing from the WISP. Cause: The current processes in place did not ensure 100% compliance with the new GLBA requirements. Effect: The student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: GLBA requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, there was evidence obtained of five procedures being performed during the year; however, these five items were missing from the formally documented Written Information Security Program (WISP). The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were not included in the WISP: 􀁸 Implement and periodically review access controls 􀁸 Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted 􀁸 Encrypt customer information on the institution’s system and when it’s in transit 􀁸 Dispose of customer information securely In addition, we were not able to verify that the WISP provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented. Questioned Costs: N/A Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were five elements missing from the WISP. Cause: The current processes in place did not ensure 100% compliance with the new GLBA requirements. Effect: The student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: GLBA requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, there was evidence obtained of five procedures being performed during the year; however, these five items were missing from the formally documented Written Information Security Program (WISP). The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were not included in the WISP: 􀁸 Implement and periodically review access controls 􀁸 Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted 􀁸 Encrypt customer information on the institution’s system and when it’s in transit 􀁸 Dispose of customer information securely In addition, we were not able to verify that the WISP provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented. Questioned Costs: N/A Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were five elements missing from the WISP. Cause: The current processes in place did not ensure 100% compliance with the new GLBA requirements. Effect: The student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: GLBA requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, there was evidence obtained of five procedures being performed during the year; however, these five items were missing from the formally documented Written Information Security Program (WISP). The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were not included in the WISP: 􀁸 Implement and periodically review access controls 􀁸 Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted 􀁸 Encrypt customer information on the institution’s system and when it’s in transit 􀁸 Dispose of customer information securely In addition, we were not able to verify that the WISP provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented. Questioned Costs: N/A Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were five elements missing from the WISP. Cause: The current processes in place did not ensure 100% compliance with the new GLBA requirements. Effect: The student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: GLBA requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, there was evidence obtained of five procedures being performed during the year; however, these five items were missing from the formally documented Written Information Security Program (WISP). The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were not included in the WISP: 􀁸 Implement and periodically review access controls 􀁸 Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted 􀁸 Encrypt customer information on the institution’s system and when it’s in transit 􀁸 Dispose of customer information securely In addition, we were not able to verify that the WISP provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented. Questioned Costs: N/A Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were five elements missing from the WISP. Cause: The current processes in place did not ensure 100% compliance with the new GLBA requirements. Effect: The student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: GLBA requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, there was evidence obtained of five procedures being performed during the year; however, these five items were missing from the formally documented Written Information Security Program (WISP). The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were not included in the WISP: 􀁸 Implement and periodically review access controls 􀁸 Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted 􀁸 Encrypt customer information on the institution’s system and when it’s in transit 􀁸 Dispose of customer information securely In addition, we were not able to verify that the WISP provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented. Questioned Costs: N/A Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were five elements missing from the WISP. Cause: The current processes in place did not ensure 100% compliance with the new GLBA requirements. Effect: The student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Condition: During our testing, we noted for 3 out of the 40 students, the enrollment effective date per NSLDS did not match the University’s records. Questioned Costs: N/A Context: Two of the students were graduated and specifically involved in student teaching and one individual was a withdrawal in between fall and spring term. Cause: The University’s current process in place did not ensure all students were reported accurately. Effect: The University did not comply with Department of Education (ED) regulations by reporting student enrollment status changes accurately. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure that students’ statuses are accurately reported to NSLDS as required by regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Condition: During our testing, we noted for 3 out of the 40 students, the enrollment effective date per NSLDS did not match the University’s records. Questioned Costs: N/A Context: Two of the students were graduated and specifically involved in student teaching and one individual was a withdrawal in between fall and spring term. Cause: The University’s current process in place did not ensure all students were reported accurately. Effect: The University did not comply with Department of Education (ED) regulations by reporting student enrollment status changes accurately. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure that students’ statuses are accurately reported to NSLDS as required by regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Condition: During our testing, we noted for 3 out of the 40 students, the enrollment effective date per NSLDS did not match the University’s records. Questioned Costs: N/A Context: Two of the students were graduated and specifically involved in student teaching and one individual was a withdrawal in between fall and spring term. Cause: The University’s current process in place did not ensure all students were reported accurately. Effect: The University did not comply with Department of Education (ED) regulations by reporting student enrollment status changes accurately. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure that students’ statuses are accurately reported to NSLDS as required by regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Condition: During our testing, we noted for 3 out of the 40 students, the enrollment effective date per NSLDS did not match the University’s records. Questioned Costs: N/A Context: Two of the students were graduated and specifically involved in student teaching and one individual was a withdrawal in between fall and spring term. Cause: The University’s current process in place did not ensure all students were reported accurately. Effect: The University did not comply with Department of Education (ED) regulations by reporting student enrollment status changes accurately. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure that students’ statuses are accurately reported to NSLDS as required by regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Condition: During our testing, we noted for 3 out of the 40 students, the enrollment effective date per NSLDS did not match the University’s records. Questioned Costs: N/A Context: Two of the students were graduated and specifically involved in student teaching and one individual was a withdrawal in between fall and spring term. Cause: The University’s current process in place did not ensure all students were reported accurately. Effect: The University did not comply with Department of Education (ED) regulations by reporting student enrollment status changes accurately. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure that students’ statuses are accurately reported to NSLDS as required by regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2023 to June 30, 2024 Type of Finding: 􀁸 Significant Deficiency in Internal Control over Compliance 􀁸 Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Condition: During our testing, we noted for 3 out of the 40 students, the enrollment effective date per NSLDS did not match the University’s records. Questioned Costs: N/A Context: Two of the students were graduated and specifically involved in student teaching and one individual was a withdrawal in between fall and spring term. Cause: The University’s current process in place did not ensure all students were reported accurately. Effect: The University did not comply with Department of Education (ED) regulations by reporting student enrollment status changes accurately. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure that students’ statuses are accurately reported to NSLDS as required by regulations. Views of Responsible Officials: There is no disagreement with the audit finding.