Audit 344285

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.