Audit 344056

Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their informationsharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: Yes, finding 2023-002. Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 4 instances where the student's enrollment status was not certified within 60 days and 4 instances where the date of the student’s status change did not match between the University’s records and NSLDS. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: Yes, finding 2023-003. Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their informationsharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: Yes, finding 2023-002. Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 4 instances where the student's enrollment status was not certified within 60 days and 4 instances where the date of the student’s status change did not match between the University’s records and NSLDS. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: Yes, finding 2023-003. Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their informationsharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: Yes, finding 2023-002. Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 4 instances where the student's enrollment status was not certified within 60 days and 4 instances where the date of the student’s status change did not match between the University’s records and NSLDS. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: Yes, finding 2023-003. Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their informationsharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: Yes, finding 2023-002. Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 4 instances where the student's enrollment status was not certified within 60 days and 4 instances where the date of the student’s status change did not match between the University’s records and NSLDS. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: Yes, finding 2023-003. Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their informationsharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: Yes, finding 2023-002. Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 4 instances where the student's enrollment status was not certified within 60 days and 4 instances where the date of the student’s status change did not match between the University’s records and NSLDS. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: Yes, finding 2023-003. Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their informationsharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: Yes, finding 2023-002. Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 4 instances where the student's enrollment status was not certified within 60 days and 4 instances where the date of the student’s status change did not match between the University’s records and NSLDS. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: Yes, finding 2023-003. Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their informationsharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: Yes, finding 2023-002. Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 4 instances where the student's enrollment status was not certified within 60 days and 4 instances where the date of the student’s status change did not match between the University’s records and NSLDS. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: Yes, finding 2023-003. Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their informationsharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: Yes, finding 2023-002. Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 4 instances where the student's enrollment status was not certified within 60 days and 4 instances where the date of the student’s status change did not match between the University’s records and NSLDS. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: Yes, finding 2023-003. Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their informationsharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: Yes, finding 2023-002. Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 4 instances where the student's enrollment status was not certified within 60 days and 4 instances where the date of the student’s status change did not match between the University’s records and NSLDS. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: Yes, finding 2023-003. Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: For recipients of research and development grants, payment methods must minimize the time elapsing between the transfer of funds from the Federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. When the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper (2 CFR 200.305(b)(3)). The University must develop its own control activities. Requests for reimbursement are to be reviewed and authorized prior to submission by reviewing supporting documents/schedules/reports to ensure amounts have been paid with the University's funds prior to the reimbursement request. Condition/Context: During our testing of 5 reimbursement requests made during the fiscal year, we noted 4 instances that did not include documentation of review and approval by a representative of the University. Questioned Costs: None. Cause: The University’s internal controls did not include a control for review and approval by an individual other than the person performing the drawdown calculation and request from the federal agency. Effect: Incorrect drawdown requests could be made of the federal agency. Repeat Finding: No. Recommendation: We recommend the University review its internal controls around the reimbursement process for all federal grants to ensure the necessary review and approval controls are in place and performed by an individual other than the one performing the drawdown calculation and request from the federal agency. Views of Responsible Officials: Please refer to the attached corrective action plan.

Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires institutions to explain their informationsharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)). Condition: Under an institution’s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the University did not perform and document a risk assessment that addresses certain of the elements noted in 16 CFR 314.4 (b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The University did not perform an IT risk assessment tailored specifically to the University, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The students’ personal information could be vulnerable. Repeat Finding: Yes, finding 2023-002. Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: Please refer to the attached corrective action plan.

Criteria or Specific Requirement: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in its next scheduled enrollment submission if the scheduled submission is within 60 days. Condition/Context: During our testing of 40 students, which is a statistically valid sample, we noted 4 instances where the student's enrollment status was not certified within 60 days and 4 instances where the date of the student’s status change did not match between the University’s records and NSLDS. Questioned Costs: None. Cause: The University's internal controls did not identify the errors for compliance with the criteria mentioned above. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Repeat Finding: Yes, finding 2023-003. Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of Responsible Officials: Please refer to the attached corrective action plan.