Audit 343891

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing, we noted one check totaling $419.00 related to student refunds of Title IV federal financial aid were outstanding more than 240 days as of May 31, 2024. Questioned Costs: $419.00 Context: During our testing, it was noted the College does not have a process in place to ensure timeliness and accuracy of checks refunded to ED after 240 days outstanding. Cause: The College did not have a process in place to ensure all outstanding checks over 240 days was properly returned to the ED. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes Auditor’s Recommendation: We recommend that the College review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing, we noted one check totaling $419.00 related to student refunds of Title IV federal financial aid were outstanding more than 240 days as of May 31, 2024. Questioned Costs: $419.00 Context: During our testing, it was noted the College does not have a process in place to ensure timeliness and accuracy of checks refunded to ED after 240 days outstanding. Cause: The College did not have a process in place to ensure all outstanding checks over 240 days was properly returned to the ED. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes Auditor’s Recommendation: We recommend that the College review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing, we noted one check totaling $419.00 related to student refunds of Title IV federal financial aid were outstanding more than 240 days as of May 31, 2024. Questioned Costs: $419.00 Context: During our testing, it was noted the College does not have a process in place to ensure timeliness and accuracy of checks refunded to ED after 240 days outstanding. Cause: The College did not have a process in place to ensure all outstanding checks over 240 days was properly returned to the ED. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes Auditor’s Recommendation: We recommend that the College review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing, we noted one check totaling $419.00 related to student refunds of Title IV federal financial aid were outstanding more than 240 days as of May 31, 2024. Questioned Costs: $419.00 Context: During our testing, it was noted the College does not have a process in place to ensure timeliness and accuracy of checks refunded to ED after 240 days outstanding. Cause: The College did not have a process in place to ensure all outstanding checks over 240 days was properly returned to the ED. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes Auditor’s Recommendation: We recommend that the College review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing, we noted one check totaling $419.00 related to student refunds of Title IV federal financial aid were outstanding more than 240 days as of May 31, 2024. Questioned Costs: $419.00 Context: During our testing, it was noted the College does not have a process in place to ensure timeliness and accuracy of checks refunded to ED after 240 days outstanding. Cause: The College did not have a process in place to ensure all outstanding checks over 240 days was properly returned to the ED. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes Auditor’s Recommendation: We recommend that the College review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 674.16 states that before an institution makes its first disbursement to a student, the student shall sign the promissory note and the institution shall provide the student with certain repayment information. Condition: During our testing, we noted that none of the students tested in the Perkins loan program could be supported as having completed a promissory note or entrance counseling. Questioned Costs: None Context: During our testing, it was noted the College was unable to find MPNs for any student with Perkins that have not been assigned. Cause: The College is not able to locate the MPNs for outstanding Perkins loans that have not already been assigned. Effect: The College cannot provide documentation showing proper completion of promissory note as required by DOE requirements. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review their records to locate the missing promissory notes. If the signed promissory notes cannot be located, the College should assess if there is sufficient documentation to support the loan such as repayment history, documentation showing the original payment was accepted by the student, etc. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 674.16 states that before an institution makes its first disbursement to a student, the student shall sign the promissory note and the institution shall provide the student with certain repayment information. Condition: During our testing, we noted that none of the students tested in the Perkins loan program could be supported as having completed a promissory note or entrance counseling. Questioned Costs: None Context: During our testing, it was noted the College was unable to find MPNs for any student with Perkins that have not been assigned. Cause: The College is not able to locate the MPNs for outstanding Perkins loans that have not already been assigned. Effect: The College cannot provide documentation showing proper completion of promissory note as required by DOE requirements. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review their records to locate the missing promissory notes. If the signed promissory notes cannot be located, the College should assess if there is sufficient documentation to support the loan such as repayment history, documentation showing the original payment was accepted by the student, etc. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 674.16 states that before an institution makes its first disbursement to a student, the student shall sign the promissory note and the institution shall provide the student with certain repayment information. Condition: During our testing, we noted that none of the students tested in the Perkins loan program could be supported as having completed a promissory note or entrance counseling. Questioned Costs: None Context: During our testing, it was noted the College was unable to find MPNs for any student with Perkins that have not been assigned. Cause: The College is not able to locate the MPNs for outstanding Perkins loans that have not already been assigned. Effect: The College cannot provide documentation showing proper completion of promissory note as required by DOE requirements. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review their records to locate the missing promissory notes. If the signed promissory notes cannot be located, the College should assess if there is sufficient documentation to support the loan such as repayment history, documentation showing the original payment was accepted by the student, etc. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 674.16 states that before an institution makes its first disbursement to a student, the student shall sign the promissory note and the institution shall provide the student with certain repayment information. Condition: During our testing, we noted that none of the students tested in the Perkins loan program could be supported as having completed a promissory note or entrance counseling. Questioned Costs: None Context: During our testing, it was noted the College was unable to find MPNs for any student with Perkins that have not been assigned. Cause: The College is not able to locate the MPNs for outstanding Perkins loans that have not already been assigned. Effect: The College cannot provide documentation showing proper completion of promissory note as required by DOE requirements. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review their records to locate the missing promissory notes. If the signed promissory notes cannot be located, the College should assess if there is sufficient documentation to support the loan such as repayment history, documentation showing the original payment was accepted by the student, etc. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 674.16 states that before an institution makes its first disbursement to a student, the student shall sign the promissory note and the institution shall provide the student with certain repayment information. Condition: During our testing, we noted that none of the students tested in the Perkins loan program could be supported as having completed a promissory note or entrance counseling. Questioned Costs: None Context: During our testing, it was noted the College was unable to find MPNs for any student with Perkins that have not been assigned. Cause: The College is not able to locate the MPNs for outstanding Perkins loans that have not already been assigned. Effect: The College cannot provide documentation showing proper completion of promissory note as required by DOE requirements. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review their records to locate the missing promissory notes. If the signed promissory notes cannot be located, the College should assess if there is sufficient documentation to support the loan such as repayment history, documentation showing the original payment was accepted by the student, etc. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. There are two categories of enrollment information; "Campus Level" and "Program Level," both of which need to be reported accurately and have separate record types. Condition: During our testing we noted the following errors, three out of the fourteen student’s enrollment status per institutions records did not match the NSLDS enrollment status. Furthermore, four out of the fourteen student’s enrollment effective date per institutions records did not match the NSLDS enrollment effective date. Lastly, one out of the fourteen students did not have their student change updated timely. Questioned Costs: None Context: The enrollment roster file contained dates that were incorrect for the Enrollment and Program Level effective dates. In the cases of this error the enrollment information should have been the date per institution's records for the Campus and Program Level. There were also instances where the information on the Enrollment and Program level were inconsistent with the University's records. Finally, Updates to NSLDS were not completed in a timely manner and some were not updated at all. Cause: The College did not have a review process in place to ensure that NSLDS reports are being properly reported. Effect: The NSLDS system is not updated with the student information which can cause a student to not properly enter the repayment period. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure the students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. There are two categories of enrollment information; "Campus Level" and "Program Level," both of which need to be reported accurately and have separate record types. Condition: During our testing we noted the following errors, three out of the fourteen student’s enrollment status per institutions records did not match the NSLDS enrollment status. Furthermore, four out of the fourteen student’s enrollment effective date per institutions records did not match the NSLDS enrollment effective date. Lastly, one out of the fourteen students did not have their student change updated timely. Questioned Costs: None Context: The enrollment roster file contained dates that were incorrect for the Enrollment and Program Level effective dates. In the cases of this error the enrollment information should have been the date per institution's records for the Campus and Program Level. There were also instances where the information on the Enrollment and Program level were inconsistent with the University's records. Finally, Updates to NSLDS were not completed in a timely manner and some were not updated at all. Cause: The College did not have a review process in place to ensure that NSLDS reports are being properly reported. Effect: The NSLDS system is not updated with the student information which can cause a student to not properly enter the repayment period. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure the students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. There are two categories of enrollment information; "Campus Level" and "Program Level," both of which need to be reported accurately and have separate record types. Condition: During our testing we noted the following errors, three out of the fourteen student’s enrollment status per institutions records did not match the NSLDS enrollment status. Furthermore, four out of the fourteen student’s enrollment effective date per institutions records did not match the NSLDS enrollment effective date. Lastly, one out of the fourteen students did not have their student change updated timely. Questioned Costs: None Context: The enrollment roster file contained dates that were incorrect for the Enrollment and Program Level effective dates. In the cases of this error the enrollment information should have been the date per institution's records for the Campus and Program Level. There were also instances where the information on the Enrollment and Program level were inconsistent with the University's records. Finally, Updates to NSLDS were not completed in a timely manner and some were not updated at all. Cause: The College did not have a review process in place to ensure that NSLDS reports are being properly reported. Effect: The NSLDS system is not updated with the student information which can cause a student to not properly enter the repayment period. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure the students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. There are two categories of enrollment information; "Campus Level" and "Program Level," both of which need to be reported accurately and have separate record types. Condition: During our testing we noted the following errors, three out of the fourteen student’s enrollment status per institutions records did not match the NSLDS enrollment status. Furthermore, four out of the fourteen student’s enrollment effective date per institutions records did not match the NSLDS enrollment effective date. Lastly, one out of the fourteen students did not have their student change updated timely. Questioned Costs: None Context: The enrollment roster file contained dates that were incorrect for the Enrollment and Program Level effective dates. In the cases of this error the enrollment information should have been the date per institution's records for the Campus and Program Level. There were also instances where the information on the Enrollment and Program level were inconsistent with the University's records. Finally, Updates to NSLDS were not completed in a timely manner and some were not updated at all. Cause: The College did not have a review process in place to ensure that NSLDS reports are being properly reported. Effect: The NSLDS system is not updated with the student information which can cause a student to not properly enter the repayment period. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure the students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. There are two categories of enrollment information; "Campus Level" and "Program Level," both of which need to be reported accurately and have separate record types. Condition: During our testing we noted the following errors, three out of the fourteen student’s enrollment status per institutions records did not match the NSLDS enrollment status. Furthermore, four out of the fourteen student’s enrollment effective date per institutions records did not match the NSLDS enrollment effective date. Lastly, one out of the fourteen students did not have their student change updated timely. Questioned Costs: None Context: The enrollment roster file contained dates that were incorrect for the Enrollment and Program Level effective dates. In the cases of this error the enrollment information should have been the date per institution's records for the Campus and Program Level. There were also instances where the information on the Enrollment and Program level were inconsistent with the University's records. Finally, Updates to NSLDS were not completed in a timely manner and some were not updated at all. Cause: The College did not have a review process in place to ensure that NSLDS reports are being properly reported. Effect: The NSLDS system is not updated with the student information which can cause a student to not properly enter the repayment period. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure the students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing, we noted one check totaling $419.00 related to student refunds of Title IV federal financial aid were outstanding more than 240 days as of May 31, 2024. Questioned Costs: $419.00 Context: During our testing, it was noted the College does not have a process in place to ensure timeliness and accuracy of checks refunded to ED after 240 days outstanding. Cause: The College did not have a process in place to ensure all outstanding checks over 240 days was properly returned to the ED. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes Auditor’s Recommendation: We recommend that the College review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing, we noted one check totaling $419.00 related to student refunds of Title IV federal financial aid were outstanding more than 240 days as of May 31, 2024. Questioned Costs: $419.00 Context: During our testing, it was noted the College does not have a process in place to ensure timeliness and accuracy of checks refunded to ED after 240 days outstanding. Cause: The College did not have a process in place to ensure all outstanding checks over 240 days was properly returned to the ED. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes Auditor’s Recommendation: We recommend that the College review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing, we noted one check totaling $419.00 related to student refunds of Title IV federal financial aid were outstanding more than 240 days as of May 31, 2024. Questioned Costs: $419.00 Context: During our testing, it was noted the College does not have a process in place to ensure timeliness and accuracy of checks refunded to ED after 240 days outstanding. Cause: The College did not have a process in place to ensure all outstanding checks over 240 days was properly returned to the ED. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes Auditor’s Recommendation: We recommend that the College review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing, we noted one check totaling $419.00 related to student refunds of Title IV federal financial aid were outstanding more than 240 days as of May 31, 2024. Questioned Costs: $419.00 Context: During our testing, it was noted the College does not have a process in place to ensure timeliness and accuracy of checks refunded to ED after 240 days outstanding. Cause: The College did not have a process in place to ensure all outstanding checks over 240 days was properly returned to the ED. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes Auditor’s Recommendation: We recommend that the College review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing, we noted one check totaling $419.00 related to student refunds of Title IV federal financial aid were outstanding more than 240 days as of May 31, 2024. Questioned Costs: $419.00 Context: During our testing, it was noted the College does not have a process in place to ensure timeliness and accuracy of checks refunded to ED after 240 days outstanding. Cause: The College did not have a process in place to ensure all outstanding checks over 240 days was properly returned to the ED. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes Auditor’s Recommendation: We recommend that the College review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 674.16 states that before an institution makes its first disbursement to a student, the student shall sign the promissory note and the institution shall provide the student with certain repayment information. Condition: During our testing, we noted that none of the students tested in the Perkins loan program could be supported as having completed a promissory note or entrance counseling. Questioned Costs: None Context: During our testing, it was noted the College was unable to find MPNs for any student with Perkins that have not been assigned. Cause: The College is not able to locate the MPNs for outstanding Perkins loans that have not already been assigned. Effect: The College cannot provide documentation showing proper completion of promissory note as required by DOE requirements. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review their records to locate the missing promissory notes. If the signed promissory notes cannot be located, the College should assess if there is sufficient documentation to support the loan such as repayment history, documentation showing the original payment was accepted by the student, etc. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 674.16 states that before an institution makes its first disbursement to a student, the student shall sign the promissory note and the institution shall provide the student with certain repayment information. Condition: During our testing, we noted that none of the students tested in the Perkins loan program could be supported as having completed a promissory note or entrance counseling. Questioned Costs: None Context: During our testing, it was noted the College was unable to find MPNs for any student with Perkins that have not been assigned. Cause: The College is not able to locate the MPNs for outstanding Perkins loans that have not already been assigned. Effect: The College cannot provide documentation showing proper completion of promissory note as required by DOE requirements. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review their records to locate the missing promissory notes. If the signed promissory notes cannot be located, the College should assess if there is sufficient documentation to support the loan such as repayment history, documentation showing the original payment was accepted by the student, etc. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 674.16 states that before an institution makes its first disbursement to a student, the student shall sign the promissory note and the institution shall provide the student with certain repayment information. Condition: During our testing, we noted that none of the students tested in the Perkins loan program could be supported as having completed a promissory note or entrance counseling. Questioned Costs: None Context: During our testing, it was noted the College was unable to find MPNs for any student with Perkins that have not been assigned. Cause: The College is not able to locate the MPNs for outstanding Perkins loans that have not already been assigned. Effect: The College cannot provide documentation showing proper completion of promissory note as required by DOE requirements. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review their records to locate the missing promissory notes. If the signed promissory notes cannot be located, the College should assess if there is sufficient documentation to support the loan such as repayment history, documentation showing the original payment was accepted by the student, etc. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 674.16 states that before an institution makes its first disbursement to a student, the student shall sign the promissory note and the institution shall provide the student with certain repayment information. Condition: During our testing, we noted that none of the students tested in the Perkins loan program could be supported as having completed a promissory note or entrance counseling. Questioned Costs: None Context: During our testing, it was noted the College was unable to find MPNs for any student with Perkins that have not been assigned. Cause: The College is not able to locate the MPNs for outstanding Perkins loans that have not already been assigned. Effect: The College cannot provide documentation showing proper completion of promissory note as required by DOE requirements. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review their records to locate the missing promissory notes. If the signed promissory notes cannot be located, the College should assess if there is sufficient documentation to support the loan such as repayment history, documentation showing the original payment was accepted by the student, etc. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 674.16 states that before an institution makes its first disbursement to a student, the student shall sign the promissory note and the institution shall provide the student with certain repayment information. Condition: During our testing, we noted that none of the students tested in the Perkins loan program could be supported as having completed a promissory note or entrance counseling. Questioned Costs: None Context: During our testing, it was noted the College was unable to find MPNs for any student with Perkins that have not been assigned. Cause: The College is not able to locate the MPNs for outstanding Perkins loans that have not already been assigned. Effect: The College cannot provide documentation showing proper completion of promissory note as required by DOE requirements. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review their records to locate the missing promissory notes. If the signed promissory notes cannot be located, the College should assess if there is sufficient documentation to support the loan such as repayment history, documentation showing the original payment was accepted by the student, etc. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. There are two categories of enrollment information; "Campus Level" and "Program Level," both of which need to be reported accurately and have separate record types. Condition: During our testing we noted the following errors, three out of the fourteen student’s enrollment status per institutions records did not match the NSLDS enrollment status. Furthermore, four out of the fourteen student’s enrollment effective date per institutions records did not match the NSLDS enrollment effective date. Lastly, one out of the fourteen students did not have their student change updated timely. Questioned Costs: None Context: The enrollment roster file contained dates that were incorrect for the Enrollment and Program Level effective dates. In the cases of this error the enrollment information should have been the date per institution's records for the Campus and Program Level. There were also instances where the information on the Enrollment and Program level were inconsistent with the University's records. Finally, Updates to NSLDS were not completed in a timely manner and some were not updated at all. Cause: The College did not have a review process in place to ensure that NSLDS reports are being properly reported. Effect: The NSLDS system is not updated with the student information which can cause a student to not properly enter the repayment period. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure the students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. There are two categories of enrollment information; "Campus Level" and "Program Level," both of which need to be reported accurately and have separate record types. Condition: During our testing we noted the following errors, three out of the fourteen student’s enrollment status per institutions records did not match the NSLDS enrollment status. Furthermore, four out of the fourteen student’s enrollment effective date per institutions records did not match the NSLDS enrollment effective date. Lastly, one out of the fourteen students did not have their student change updated timely. Questioned Costs: None Context: The enrollment roster file contained dates that were incorrect for the Enrollment and Program Level effective dates. In the cases of this error the enrollment information should have been the date per institution's records for the Campus and Program Level. There were also instances where the information on the Enrollment and Program level were inconsistent with the University's records. Finally, Updates to NSLDS were not completed in a timely manner and some were not updated at all. Cause: The College did not have a review process in place to ensure that NSLDS reports are being properly reported. Effect: The NSLDS system is not updated with the student information which can cause a student to not properly enter the repayment period. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure the students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. There are two categories of enrollment information; "Campus Level" and "Program Level," both of which need to be reported accurately and have separate record types. Condition: During our testing we noted the following errors, three out of the fourteen student’s enrollment status per institutions records did not match the NSLDS enrollment status. Furthermore, four out of the fourteen student’s enrollment effective date per institutions records did not match the NSLDS enrollment effective date. Lastly, one out of the fourteen students did not have their student change updated timely. Questioned Costs: None Context: The enrollment roster file contained dates that were incorrect for the Enrollment and Program Level effective dates. In the cases of this error the enrollment information should have been the date per institution's records for the Campus and Program Level. There were also instances where the information on the Enrollment and Program level were inconsistent with the University's records. Finally, Updates to NSLDS were not completed in a timely manner and some were not updated at all. Cause: The College did not have a review process in place to ensure that NSLDS reports are being properly reported. Effect: The NSLDS system is not updated with the student information which can cause a student to not properly enter the repayment period. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure the students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. There are two categories of enrollment information; "Campus Level" and "Program Level," both of which need to be reported accurately and have separate record types. Condition: During our testing we noted the following errors, three out of the fourteen student’s enrollment status per institutions records did not match the NSLDS enrollment status. Furthermore, four out of the fourteen student’s enrollment effective date per institutions records did not match the NSLDS enrollment effective date. Lastly, one out of the fourteen students did not have their student change updated timely. Questioned Costs: None Context: The enrollment roster file contained dates that were incorrect for the Enrollment and Program Level effective dates. In the cases of this error the enrollment information should have been the date per institution's records for the Campus and Program Level. There were also instances where the information on the Enrollment and Program level were inconsistent with the University's records. Finally, Updates to NSLDS were not completed in a timely manner and some were not updated at all. Cause: The College did not have a review process in place to ensure that NSLDS reports are being properly reported. Effect: The NSLDS system is not updated with the student information which can cause a student to not properly enter the repayment period. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure the students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. There are two categories of enrollment information; "Campus Level" and "Program Level," both of which need to be reported accurately and have separate record types. Condition: During our testing we noted the following errors, three out of the fourteen student’s enrollment status per institutions records did not match the NSLDS enrollment status. Furthermore, four out of the fourteen student’s enrollment effective date per institutions records did not match the NSLDS enrollment effective date. Lastly, one out of the fourteen students did not have their student change updated timely. Questioned Costs: None Context: The enrollment roster file contained dates that were incorrect for the Enrollment and Program Level effective dates. In the cases of this error the enrollment information should have been the date per institution's records for the Campus and Program Level. There were also instances where the information on the Enrollment and Program level were inconsistent with the University's records. Finally, Updates to NSLDS were not completed in a timely manner and some were not updated at all. Cause: The College did not have a review process in place to ensure that NSLDS reports are being properly reported. Effect: The NSLDS system is not updated with the student information which can cause a student to not properly enter the repayment period. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure the students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.