Audit 344312

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). We also noted that the College’s WISP was in draft form and was not formally approved. Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). We also noted that the College’s WISP was in draft form and was not formally approved. Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). We also noted that the College’s WISP was in draft form and was not formally approved. Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). We also noted that the College’s WISP was in draft form and was not formally approved. Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). We also noted that the College’s WISP was in draft form and was not formally approved. Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal Statues, regulations, and the term and conditions of the federal awards. Condition: During our testing of Return of Title IV Funds (R2T4), federal loan reconciliations, and award packaging, we noted there was not a review process implemented. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure controls are being performed effectively. Cause: The College did not have a process in place to ensure controls implemented are being performed effectively Effect: There is no way to determine who was involved in the process should an error be present. Repeat Finding: No Recommendation: We recommend the College reevaluate its procedures and review policies surrounding controls implemented for Title IV Aid. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal Statues, regulations, and the term and conditions of the federal awards. Condition: During our testing of Return of Title IV Funds (R2T4), federal loan reconciliations, and award packaging, we noted there was not a review process implemented. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure controls are being performed effectively. Cause: The College did not have a process in place to ensure controls implemented are being performed effectively Effect: There is no way to determine who was involved in the process should an error be present. Repeat Finding: No Recommendation: We recommend the College reevaluate its procedures and review policies surrounding controls implemented for Title IV Aid. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal Statues, regulations, and the term and conditions of the federal awards. Condition: During our testing of Return of Title IV Funds (R2T4), federal loan reconciliations, and award packaging, we noted there was not a review process implemented. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure controls are being performed effectively. Cause: The College did not have a process in place to ensure controls implemented are being performed effectively Effect: There is no way to determine who was involved in the process should an error be present. Repeat Finding: No Recommendation: We recommend the College reevaluate its procedures and review policies surrounding controls implemented for Title IV Aid. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal Statues, regulations, and the term and conditions of the federal awards. Condition: During our testing of Return of Title IV Funds (R2T4), federal loan reconciliations, and award packaging, we noted there was not a review process implemented. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure controls are being performed effectively. Cause: The College did not have a process in place to ensure controls implemented are being performed effectively Effect: There is no way to determine who was involved in the process should an error be present. Repeat Finding: No Recommendation: We recommend the College reevaluate its procedures and review policies surrounding controls implemented for Title IV Aid. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal Statues, regulations, and the term and conditions of the federal awards. Condition: During our testing of Return of Title IV Funds (R2T4), federal loan reconciliations, and award packaging, we noted there was not a review process implemented. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure controls are being performed effectively. Cause: The College did not have a process in place to ensure controls implemented are being performed effectively Effect: There is no way to determine who was involved in the process should an error be present. Repeat Finding: No Recommendation: We recommend the College reevaluate its procedures and review policies surrounding controls implemented for Title IV Aid. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The College is required to submit ED Form 646-1, Fiscal Operations Report and Application to Participate (FISAP) (OMB No. 1845-0030) – This electronic report is submitted annually to receive funds for the campus-based programs. The institution uses the Fiscal Operations Report portion to report its expenditures in the previous award year and the Application to Participate portion to apply for the following year. By October 1, the institution should submit its FISAP that includes the Fiscal Operations Report for the award year and the Application to Participate for the subsequent award year (FWS, FSEOG 34 CFR 673.3; Fiscal Operations Report and Application to Participate Instructions). Condition: The College did not have the proper procedures in place to reconcile its Perkin’s accounts. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure Perkins accounts are being reconciled on a timely basis. Cause: The College received multiple versions of reports from their third-party Perkins loan servicer related to the information used to prepare the Perkins loan section of the annual FISAP report. The College's internal controls were not effective in identifying errors in the reporting on the FISAP on a timely basis. Effect: The College may have reported incorrect Perkins loan information on the FISAP report submitted to the Department of Education. Repeat Finding: Yes – 2023-003 Recommendation: It is recommended that the College review procedures in place to ensure accurate reporting of Perkins loan information to comply with Title IV regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The College is required to submit ED Form 646-1, Fiscal Operations Report and Application to Participate (FISAP) (OMB No. 1845-0030) – This electronic report is submitted annually to receive funds for the campus-based programs. The institution uses the Fiscal Operations Report portion to report its expenditures in the previous award year and the Application to Participate portion to apply for the following year. By October 1, the institution should submit its FISAP that includes the Fiscal Operations Report for the award year and the Application to Participate for the subsequent award year (FWS, FSEOG 34 CFR 673.3; Fiscal Operations Report and Application to Participate Instructions). Condition: The College did not have the proper procedures in place to reconcile its Perkin’s accounts. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure Perkins accounts are being reconciled on a timely basis. Cause: The College received multiple versions of reports from their third-party Perkins loan servicer related to the information used to prepare the Perkins loan section of the annual FISAP report. The College's internal controls were not effective in identifying errors in the reporting on the FISAP on a timely basis. Effect: The College may have reported incorrect Perkins loan information on the FISAP report submitted to the Department of Education. Repeat Finding: Yes – 2023-003 Recommendation: It is recommended that the College review procedures in place to ensure accurate reporting of Perkins loan information to comply with Title IV regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The College is required to submit ED Form 646-1, Fiscal Operations Report and Application to Participate (FISAP) (OMB No. 1845-0030) – This electronic report is submitted annually to receive funds for the campus-based programs. The institution uses the Fiscal Operations Report portion to report its expenditures in the previous award year and the Application to Participate portion to apply for the following year. By October 1, the institution should submit its FISAP that includes the Fiscal Operations Report for the award year and the Application to Participate for the subsequent award year (FWS, FSEOG 34 CFR 673.3; Fiscal Operations Report and Application to Participate Instructions). Condition: The College did not have the proper procedures in place to reconcile its Perkin’s accounts. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure Perkins accounts are being reconciled on a timely basis. Cause: The College received multiple versions of reports from their third-party Perkins loan servicer related to the information used to prepare the Perkins loan section of the annual FISAP report. The College's internal controls were not effective in identifying errors in the reporting on the FISAP on a timely basis. Effect: The College may have reported incorrect Perkins loan information on the FISAP report submitted to the Department of Education. Repeat Finding: Yes – 2023-003 Recommendation: It is recommended that the College review procedures in place to ensure accurate reporting of Perkins loan information to comply with Title IV regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The College is required to submit ED Form 646-1, Fiscal Operations Report and Application to Participate (FISAP) (OMB No. 1845-0030) – This electronic report is submitted annually to receive funds for the campus-based programs. The institution uses the Fiscal Operations Report portion to report its expenditures in the previous award year and the Application to Participate portion to apply for the following year. By October 1, the institution should submit its FISAP that includes the Fiscal Operations Report for the award year and the Application to Participate for the subsequent award year (FWS, FSEOG 34 CFR 673.3; Fiscal Operations Report and Application to Participate Instructions). Condition: The College did not have the proper procedures in place to reconcile its Perkin’s accounts. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure Perkins accounts are being reconciled on a timely basis. Cause: The College received multiple versions of reports from their third-party Perkins loan servicer related to the information used to prepare the Perkins loan section of the annual FISAP report. The College's internal controls were not effective in identifying errors in the reporting on the FISAP on a timely basis. Effect: The College may have reported incorrect Perkins loan information on the FISAP report submitted to the Department of Education. Repeat Finding: Yes – 2023-003 Recommendation: It is recommended that the College review procedures in place to ensure accurate reporting of Perkins loan information to comply with Title IV regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The College is required to submit ED Form 646-1, Fiscal Operations Report and Application to Participate (FISAP) (OMB No. 1845-0030) – This electronic report is submitted annually to receive funds for the campus-based programs. The institution uses the Fiscal Operations Report portion to report its expenditures in the previous award year and the Application to Participate portion to apply for the following year. By October 1, the institution should submit its FISAP that includes the Fiscal Operations Report for the award year and the Application to Participate for the subsequent award year (FWS, FSEOG 34 CFR 673.3; Fiscal Operations Report and Application to Participate Instructions). Condition: The College did not have the proper procedures in place to reconcile its Perkin’s accounts. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure Perkins accounts are being reconciled on a timely basis. Cause: The College received multiple versions of reports from their third-party Perkins loan servicer related to the information used to prepare the Perkins loan section of the annual FISAP report. The College's internal controls were not effective in identifying errors in the reporting on the FISAP on a timely basis. Effect: The College may have reported incorrect Perkins loan information on the FISAP report submitted to the Department of Education. Repeat Finding: Yes – 2023-003 Recommendation: It is recommended that the College review procedures in place to ensure accurate reporting of Perkins loan information to comply with Title IV regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.203(a) outline the maximum subsidized and unsubsidized loan amounts for students based on their dependency status, year of education, and other factors. Condition: During our testing, we noted 1 instance out of 40 students tested where the unsubsidized Stafford loan awarded to the student was over the maximum amount they were eligible for. Questioned Costs: We identified $5,000 was over-awarded. Context: The College did not have procedures in place to detect this overaward. Cause: The College did not appropriately determine the student's level of education when awarding the Unsubsidized Stafford Loan. Effect: The student was awarded incorrectly as they were not eligible for the specific awarded amount. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and a policy around how level of education is determined and verified when packaging and awarding students. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.203(a) outline the maximum subsidized and unsubsidized loan amounts for students based on their dependency status, year of education, and other factors. Condition: During our testing, we noted 1 instance out of 40 students tested where the unsubsidized Stafford loan awarded to the student was over the maximum amount they were eligible for. Questioned Costs: We identified $5,000 was over-awarded. Context: The College did not have procedures in place to detect this overaward. Cause: The College did not appropriately determine the student's level of education when awarding the Unsubsidized Stafford Loan. Effect: The student was awarded incorrectly as they were not eligible for the specific awarded amount. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and a policy around how level of education is determined and verified when packaging and awarding students. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.203(a) outline the maximum subsidized and unsubsidized loan amounts for students based on their dependency status, year of education, and other factors. Condition: During our testing, we noted 1 instance out of 40 students tested where the unsubsidized Stafford loan awarded to the student was over the maximum amount they were eligible for. Questioned Costs: We identified $5,000 was over-awarded. Context: The College did not have procedures in place to detect this overaward. Cause: The College did not appropriately determine the student's level of education when awarding the Unsubsidized Stafford Loan. Effect: The student was awarded incorrectly as they were not eligible for the specific awarded amount. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and a policy around how level of education is determined and verified when packaging and awarding students. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.203(a) outline the maximum subsidized and unsubsidized loan amounts for students based on their dependency status, year of education, and other factors. Condition: During our testing, we noted 1 instance out of 40 students tested where the unsubsidized Stafford loan awarded to the student was over the maximum amount they were eligible for. Questioned Costs: We identified $5,000 was over-awarded. Context: The College did not have procedures in place to detect this overaward. Cause: The College did not appropriately determine the student's level of education when awarding the Unsubsidized Stafford Loan. Effect: The student was awarded incorrectly as they were not eligible for the specific awarded amount. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and a policy around how level of education is determined and verified when packaging and awarding students. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.203(a) outline the maximum subsidized and unsubsidized loan amounts for students based on their dependency status, year of education, and other factors. Condition: During our testing, we noted 1 instance out of 40 students tested where the unsubsidized Stafford loan awarded to the student was over the maximum amount they were eligible for. Questioned Costs: We identified $5,000 was over-awarded. Context: The College did not have procedures in place to detect this overaward. Cause: The College did not appropriately determine the student's level of education when awarding the Unsubsidized Stafford Loan. Effect: The student was awarded incorrectly as they were not eligible for the specific awarded amount. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and a policy around how level of education is determined and verified when packaging and awarding students. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.165(a)(2) requires notification be sent to students no earlier than 30 days before the disbursement and no later than 30 days after the Direct Loans are disbursed to their accounts if the College obtains active confirmation. If the College does not obtain active confirmation, notifications are required to be sent no earlier than 30 days before the disbursement and not later than seven days to the student when loan funds are disbursed to their accounts. Condition: During our testing, we noted that 40 of 40 students tested did not receive disbursement notifications before the required deadline established by the Department of Education. Questioned Costs: None Context: The College’s processes and controls did not ensure that notifications of disbursements were performed or did not retain proper support to indicate this process took place. Cause: Lack of oversight by management to verify the notifications were sent within the required timeframe. Effect: Student may not have been aware of when their federal aid was disbursed and therefore may not know their rights to be able to return loan funds. The Institute is not in compliance with Department of Education requirements. Repeat Finding: No Recommendation: We recommend the College review and strengthen its procedures for notifying students of their Direct Loan disbursements within the required time frame and that documentation of the letters sent is maintained. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.165(a)(2) requires notification be sent to students no earlier than 30 days before the disbursement and no later than 30 days after the Direct Loans are disbursed to their accounts if the College obtains active confirmation. If the College does not obtain active confirmation, notifications are required to be sent no earlier than 30 days before the disbursement and not later than seven days to the student when loan funds are disbursed to their accounts. Condition: During our testing, we noted that 40 of 40 students tested did not receive disbursement notifications before the required deadline established by the Department of Education. Questioned Costs: None Context: The College’s processes and controls did not ensure that notifications of disbursements were performed or did not retain proper support to indicate this process took place. Cause: Lack of oversight by management to verify the notifications were sent within the required timeframe. Effect: Student may not have been aware of when their federal aid was disbursed and therefore may not know their rights to be able to return loan funds. The Institute is not in compliance with Department of Education requirements. Repeat Finding: No Recommendation: We recommend the College review and strengthen its procedures for notifying students of their Direct Loan disbursements within the required time frame and that documentation of the letters sent is maintained. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.165(a)(2) requires notification be sent to students no earlier than 30 days before the disbursement and no later than 30 days after the Direct Loans are disbursed to their accounts if the College obtains active confirmation. If the College does not obtain active confirmation, notifications are required to be sent no earlier than 30 days before the disbursement and not later than seven days to the student when loan funds are disbursed to their accounts. Condition: During our testing, we noted that 40 of 40 students tested did not receive disbursement notifications before the required deadline established by the Department of Education. Questioned Costs: None Context: The College’s processes and controls did not ensure that notifications of disbursements were performed or did not retain proper support to indicate this process took place. Cause: Lack of oversight by management to verify the notifications were sent within the required timeframe. Effect: Student may not have been aware of when their federal aid was disbursed and therefore may not know their rights to be able to return loan funds. The Institute is not in compliance with Department of Education requirements. Repeat Finding: No Recommendation: We recommend the College review and strengthen its procedures for notifying students of their Direct Loan disbursements within the required time frame and that documentation of the letters sent is maintained. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.165(a)(2) requires notification be sent to students no earlier than 30 days before the disbursement and no later than 30 days after the Direct Loans are disbursed to their accounts if the College obtains active confirmation. If the College does not obtain active confirmation, notifications are required to be sent no earlier than 30 days before the disbursement and not later than seven days to the student when loan funds are disbursed to their accounts. Condition: During our testing, we noted that 40 of 40 students tested did not receive disbursement notifications before the required deadline established by the Department of Education. Questioned Costs: None Context: The College’s processes and controls did not ensure that notifications of disbursements were performed or did not retain proper support to indicate this process took place. Cause: Lack of oversight by management to verify the notifications were sent within the required timeframe. Effect: Student may not have been aware of when their federal aid was disbursed and therefore may not know their rights to be able to return loan funds. The Institute is not in compliance with Department of Education requirements. Repeat Finding: No Recommendation: We recommend the College review and strengthen its procedures for notifying students of their Direct Loan disbursements within the required time frame and that documentation of the letters sent is maintained. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.165(a)(2) requires notification be sent to students no earlier than 30 days before the disbursement and no later than 30 days after the Direct Loans are disbursed to their accounts if the College obtains active confirmation. If the College does not obtain active confirmation, notifications are required to be sent no earlier than 30 days before the disbursement and not later than seven days to the student when loan funds are disbursed to their accounts. Condition: During our testing, we noted that 40 of 40 students tested did not receive disbursement notifications before the required deadline established by the Department of Education. Questioned Costs: None Context: The College’s processes and controls did not ensure that notifications of disbursements were performed or did not retain proper support to indicate this process took place. Cause: Lack of oversight by management to verify the notifications were sent within the required timeframe. Effect: Student may not have been aware of when their federal aid was disbursed and therefore may not know their rights to be able to return loan funds. The Institute is not in compliance with Department of Education requirements. Repeat Finding: No Recommendation: We recommend the College review and strengthen its procedures for notifying students of their Direct Loan disbursements within the required time frame and that documentation of the letters sent is maintained. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). We also noted that the College’s WISP was in draft form and was not formally approved. Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). We also noted that the College’s WISP was in draft form and was not formally approved. Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). We also noted that the College’s WISP was in draft form and was not formally approved. Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). We also noted that the College’s WISP was in draft form and was not formally approved. Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). We also noted that the College’s WISP was in draft form and was not formally approved. Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal Statues, regulations, and the term and conditions of the federal awards. Condition: During our testing of Return of Title IV Funds (R2T4), federal loan reconciliations, and award packaging, we noted there was not a review process implemented. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure controls are being performed effectively. Cause: The College did not have a process in place to ensure controls implemented are being performed effectively Effect: There is no way to determine who was involved in the process should an error be present. Repeat Finding: No Recommendation: We recommend the College reevaluate its procedures and review policies surrounding controls implemented for Title IV Aid. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal Statues, regulations, and the term and conditions of the federal awards. Condition: During our testing of Return of Title IV Funds (R2T4), federal loan reconciliations, and award packaging, we noted there was not a review process implemented. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure controls are being performed effectively. Cause: The College did not have a process in place to ensure controls implemented are being performed effectively Effect: There is no way to determine who was involved in the process should an error be present. Repeat Finding: No Recommendation: We recommend the College reevaluate its procedures and review policies surrounding controls implemented for Title IV Aid. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal Statues, regulations, and the term and conditions of the federal awards. Condition: During our testing of Return of Title IV Funds (R2T4), federal loan reconciliations, and award packaging, we noted there was not a review process implemented. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure controls are being performed effectively. Cause: The College did not have a process in place to ensure controls implemented are being performed effectively Effect: There is no way to determine who was involved in the process should an error be present. Repeat Finding: No Recommendation: We recommend the College reevaluate its procedures and review policies surrounding controls implemented for Title IV Aid. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal Statues, regulations, and the term and conditions of the federal awards. Condition: During our testing of Return of Title IV Funds (R2T4), federal loan reconciliations, and award packaging, we noted there was not a review process implemented. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure controls are being performed effectively. Cause: The College did not have a process in place to ensure controls implemented are being performed effectively Effect: There is no way to determine who was involved in the process should an error be present. Repeat Finding: No Recommendation: We recommend the College reevaluate its procedures and review policies surrounding controls implemented for Title IV Aid. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal Statues, regulations, and the term and conditions of the federal awards. Condition: During our testing of Return of Title IV Funds (R2T4), federal loan reconciliations, and award packaging, we noted there was not a review process implemented. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure controls are being performed effectively. Cause: The College did not have a process in place to ensure controls implemented are being performed effectively Effect: There is no way to determine who was involved in the process should an error be present. Repeat Finding: No Recommendation: We recommend the College reevaluate its procedures and review policies surrounding controls implemented for Title IV Aid. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The College is required to submit ED Form 646-1, Fiscal Operations Report and Application to Participate (FISAP) (OMB No. 1845-0030) – This electronic report is submitted annually to receive funds for the campus-based programs. The institution uses the Fiscal Operations Report portion to report its expenditures in the previous award year and the Application to Participate portion to apply for the following year. By October 1, the institution should submit its FISAP that includes the Fiscal Operations Report for the award year and the Application to Participate for the subsequent award year (FWS, FSEOG 34 CFR 673.3; Fiscal Operations Report and Application to Participate Instructions). Condition: The College did not have the proper procedures in place to reconcile its Perkin’s accounts. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure Perkins accounts are being reconciled on a timely basis. Cause: The College received multiple versions of reports from their third-party Perkins loan servicer related to the information used to prepare the Perkins loan section of the annual FISAP report. The College's internal controls were not effective in identifying errors in the reporting on the FISAP on a timely basis. Effect: The College may have reported incorrect Perkins loan information on the FISAP report submitted to the Department of Education. Repeat Finding: Yes – 2023-003 Recommendation: It is recommended that the College review procedures in place to ensure accurate reporting of Perkins loan information to comply with Title IV regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The College is required to submit ED Form 646-1, Fiscal Operations Report and Application to Participate (FISAP) (OMB No. 1845-0030) – This electronic report is submitted annually to receive funds for the campus-based programs. The institution uses the Fiscal Operations Report portion to report its expenditures in the previous award year and the Application to Participate portion to apply for the following year. By October 1, the institution should submit its FISAP that includes the Fiscal Operations Report for the award year and the Application to Participate for the subsequent award year (FWS, FSEOG 34 CFR 673.3; Fiscal Operations Report and Application to Participate Instructions). Condition: The College did not have the proper procedures in place to reconcile its Perkin’s accounts. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure Perkins accounts are being reconciled on a timely basis. Cause: The College received multiple versions of reports from their third-party Perkins loan servicer related to the information used to prepare the Perkins loan section of the annual FISAP report. The College's internal controls were not effective in identifying errors in the reporting on the FISAP on a timely basis. Effect: The College may have reported incorrect Perkins loan information on the FISAP report submitted to the Department of Education. Repeat Finding: Yes – 2023-003 Recommendation: It is recommended that the College review procedures in place to ensure accurate reporting of Perkins loan information to comply with Title IV regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The College is required to submit ED Form 646-1, Fiscal Operations Report and Application to Participate (FISAP) (OMB No. 1845-0030) – This electronic report is submitted annually to receive funds for the campus-based programs. The institution uses the Fiscal Operations Report portion to report its expenditures in the previous award year and the Application to Participate portion to apply for the following year. By October 1, the institution should submit its FISAP that includes the Fiscal Operations Report for the award year and the Application to Participate for the subsequent award year (FWS, FSEOG 34 CFR 673.3; Fiscal Operations Report and Application to Participate Instructions). Condition: The College did not have the proper procedures in place to reconcile its Perkin’s accounts. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure Perkins accounts are being reconciled on a timely basis. Cause: The College received multiple versions of reports from their third-party Perkins loan servicer related to the information used to prepare the Perkins loan section of the annual FISAP report. The College's internal controls were not effective in identifying errors in the reporting on the FISAP on a timely basis. Effect: The College may have reported incorrect Perkins loan information on the FISAP report submitted to the Department of Education. Repeat Finding: Yes – 2023-003 Recommendation: It is recommended that the College review procedures in place to ensure accurate reporting of Perkins loan information to comply with Title IV regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The College is required to submit ED Form 646-1, Fiscal Operations Report and Application to Participate (FISAP) (OMB No. 1845-0030) – This electronic report is submitted annually to receive funds for the campus-based programs. The institution uses the Fiscal Operations Report portion to report its expenditures in the previous award year and the Application to Participate portion to apply for the following year. By October 1, the institution should submit its FISAP that includes the Fiscal Operations Report for the award year and the Application to Participate for the subsequent award year (FWS, FSEOG 34 CFR 673.3; Fiscal Operations Report and Application to Participate Instructions). Condition: The College did not have the proper procedures in place to reconcile its Perkin’s accounts. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure Perkins accounts are being reconciled on a timely basis. Cause: The College received multiple versions of reports from their third-party Perkins loan servicer related to the information used to prepare the Perkins loan section of the annual FISAP report. The College's internal controls were not effective in identifying errors in the reporting on the FISAP on a timely basis. Effect: The College may have reported incorrect Perkins loan information on the FISAP report submitted to the Department of Education. Repeat Finding: Yes – 2023-003 Recommendation: It is recommended that the College review procedures in place to ensure accurate reporting of Perkins loan information to comply with Title IV regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The College is required to submit ED Form 646-1, Fiscal Operations Report and Application to Participate (FISAP) (OMB No. 1845-0030) – This electronic report is submitted annually to receive funds for the campus-based programs. The institution uses the Fiscal Operations Report portion to report its expenditures in the previous award year and the Application to Participate portion to apply for the following year. By October 1, the institution should submit its FISAP that includes the Fiscal Operations Report for the award year and the Application to Participate for the subsequent award year (FWS, FSEOG 34 CFR 673.3; Fiscal Operations Report and Application to Participate Instructions). Condition: The College did not have the proper procedures in place to reconcile its Perkin’s accounts. Questioned Costs: None. Context: During our testing, it was noted the College does not have a process in place to ensure Perkins accounts are being reconciled on a timely basis. Cause: The College received multiple versions of reports from their third-party Perkins loan servicer related to the information used to prepare the Perkins loan section of the annual FISAP report. The College's internal controls were not effective in identifying errors in the reporting on the FISAP on a timely basis. Effect: The College may have reported incorrect Perkins loan information on the FISAP report submitted to the Department of Education. Repeat Finding: Yes – 2023-003 Recommendation: It is recommended that the College review procedures in place to ensure accurate reporting of Perkins loan information to comply with Title IV regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.203(a) outline the maximum subsidized and unsubsidized loan amounts for students based on their dependency status, year of education, and other factors. Condition: During our testing, we noted 1 instance out of 40 students tested where the unsubsidized Stafford loan awarded to the student was over the maximum amount they were eligible for. Questioned Costs: We identified $5,000 was over-awarded. Context: The College did not have procedures in place to detect this overaward. Cause: The College did not appropriately determine the student's level of education when awarding the Unsubsidized Stafford Loan. Effect: The student was awarded incorrectly as they were not eligible for the specific awarded amount. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and a policy around how level of education is determined and verified when packaging and awarding students. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.203(a) outline the maximum subsidized and unsubsidized loan amounts for students based on their dependency status, year of education, and other factors. Condition: During our testing, we noted 1 instance out of 40 students tested where the unsubsidized Stafford loan awarded to the student was over the maximum amount they were eligible for. Questioned Costs: We identified $5,000 was over-awarded. Context: The College did not have procedures in place to detect this overaward. Cause: The College did not appropriately determine the student's level of education when awarding the Unsubsidized Stafford Loan. Effect: The student was awarded incorrectly as they were not eligible for the specific awarded amount. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and a policy around how level of education is determined and verified when packaging and awarding students. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.203(a) outline the maximum subsidized and unsubsidized loan amounts for students based on their dependency status, year of education, and other factors. Condition: During our testing, we noted 1 instance out of 40 students tested where the unsubsidized Stafford loan awarded to the student was over the maximum amount they were eligible for. Questioned Costs: We identified $5,000 was over-awarded. Context: The College did not have procedures in place to detect this overaward. Cause: The College did not appropriately determine the student's level of education when awarding the Unsubsidized Stafford Loan. Effect: The student was awarded incorrectly as they were not eligible for the specific awarded amount. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and a policy around how level of education is determined and verified when packaging and awarding students. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.203(a) outline the maximum subsidized and unsubsidized loan amounts for students based on their dependency status, year of education, and other factors. Condition: During our testing, we noted 1 instance out of 40 students tested where the unsubsidized Stafford loan awarded to the student was over the maximum amount they were eligible for. Questioned Costs: We identified $5,000 was over-awarded. Context: The College did not have procedures in place to detect this overaward. Cause: The College did not appropriately determine the student's level of education when awarding the Unsubsidized Stafford Loan. Effect: The student was awarded incorrectly as they were not eligible for the specific awarded amount. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and a policy around how level of education is determined and verified when packaging and awarding students. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.203(a) outline the maximum subsidized and unsubsidized loan amounts for students based on their dependency status, year of education, and other factors. Condition: During our testing, we noted 1 instance out of 40 students tested where the unsubsidized Stafford loan awarded to the student was over the maximum amount they were eligible for. Questioned Costs: We identified $5,000 was over-awarded. Context: The College did not have procedures in place to detect this overaward. Cause: The College did not appropriately determine the student's level of education when awarding the Unsubsidized Stafford Loan. Effect: The student was awarded incorrectly as they were not eligible for the specific awarded amount. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and a policy around how level of education is determined and verified when packaging and awarding students. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.165(a)(2) requires notification be sent to students no earlier than 30 days before the disbursement and no later than 30 days after the Direct Loans are disbursed to their accounts if the College obtains active confirmation. If the College does not obtain active confirmation, notifications are required to be sent no earlier than 30 days before the disbursement and not later than seven days to the student when loan funds are disbursed to their accounts. Condition: During our testing, we noted that 40 of 40 students tested did not receive disbursement notifications before the required deadline established by the Department of Education. Questioned Costs: None Context: The College’s processes and controls did not ensure that notifications of disbursements were performed or did not retain proper support to indicate this process took place. Cause: Lack of oversight by management to verify the notifications were sent within the required timeframe. Effect: Student may not have been aware of when their federal aid was disbursed and therefore may not know their rights to be able to return loan funds. The Institute is not in compliance with Department of Education requirements. Repeat Finding: No Recommendation: We recommend the College review and strengthen its procedures for notifying students of their Direct Loan disbursements within the required time frame and that documentation of the letters sent is maintained. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.165(a)(2) requires notification be sent to students no earlier than 30 days before the disbursement and no later than 30 days after the Direct Loans are disbursed to their accounts if the College obtains active confirmation. If the College does not obtain active confirmation, notifications are required to be sent no earlier than 30 days before the disbursement and not later than seven days to the student when loan funds are disbursed to their accounts. Condition: During our testing, we noted that 40 of 40 students tested did not receive disbursement notifications before the required deadline established by the Department of Education. Questioned Costs: None Context: The College’s processes and controls did not ensure that notifications of disbursements were performed or did not retain proper support to indicate this process took place. Cause: Lack of oversight by management to verify the notifications were sent within the required timeframe. Effect: Student may not have been aware of when their federal aid was disbursed and therefore may not know their rights to be able to return loan funds. The Institute is not in compliance with Department of Education requirements. Repeat Finding: No Recommendation: We recommend the College review and strengthen its procedures for notifying students of their Direct Loan disbursements within the required time frame and that documentation of the letters sent is maintained. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.165(a)(2) requires notification be sent to students no earlier than 30 days before the disbursement and no later than 30 days after the Direct Loans are disbursed to their accounts if the College obtains active confirmation. If the College does not obtain active confirmation, notifications are required to be sent no earlier than 30 days before the disbursement and not later than seven days to the student when loan funds are disbursed to their accounts. Condition: During our testing, we noted that 40 of 40 students tested did not receive disbursement notifications before the required deadline established by the Department of Education. Questioned Costs: None Context: The College’s processes and controls did not ensure that notifications of disbursements were performed or did not retain proper support to indicate this process took place. Cause: Lack of oversight by management to verify the notifications were sent within the required timeframe. Effect: Student may not have been aware of when their federal aid was disbursed and therefore may not know their rights to be able to return loan funds. The Institute is not in compliance with Department of Education requirements. Repeat Finding: No Recommendation: We recommend the College review and strengthen its procedures for notifying students of their Direct Loan disbursements within the required time frame and that documentation of the letters sent is maintained. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.165(a)(2) requires notification be sent to students no earlier than 30 days before the disbursement and no later than 30 days after the Direct Loans are disbursed to their accounts if the College obtains active confirmation. If the College does not obtain active confirmation, notifications are required to be sent no earlier than 30 days before the disbursement and not later than seven days to the student when loan funds are disbursed to their accounts. Condition: During our testing, we noted that 40 of 40 students tested did not receive disbursement notifications before the required deadline established by the Department of Education. Questioned Costs: None Context: The College’s processes and controls did not ensure that notifications of disbursements were performed or did not retain proper support to indicate this process took place. Cause: Lack of oversight by management to verify the notifications were sent within the required timeframe. Effect: Student may not have been aware of when their federal aid was disbursed and therefore may not know their rights to be able to return loan funds. The Institute is not in compliance with Department of Education requirements. Repeat Finding: No Recommendation: We recommend the College review and strengthen its procedures for notifying students of their Direct Loan disbursements within the required time frame and that documentation of the letters sent is maintained. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: June 1, 2023 through May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.165(a)(2) requires notification be sent to students no earlier than 30 days before the disbursement and no later than 30 days after the Direct Loans are disbursed to their accounts if the College obtains active confirmation. If the College does not obtain active confirmation, notifications are required to be sent no earlier than 30 days before the disbursement and not later than seven days to the student when loan funds are disbursed to their accounts. Condition: During our testing, we noted that 40 of 40 students tested did not receive disbursement notifications before the required deadline established by the Department of Education. Questioned Costs: None Context: The College’s processes and controls did not ensure that notifications of disbursements were performed or did not retain proper support to indicate this process took place. Cause: Lack of oversight by management to verify the notifications were sent within the required timeframe. Effect: Student may not have been aware of when their federal aid was disbursed and therefore may not know their rights to be able to return loan funds. The Institute is not in compliance with Department of Education requirements. Repeat Finding: No Recommendation: We recommend the College review and strengthen its procedures for notifying students of their Direct Loan disbursements within the required time frame and that documentation of the letters sent is maintained. Views of Responsible Officials: There is no disagreement with the audit finding.