Federal Program – Student Financial Assistance Cluster – Assistance Listing Numbers 84.063, 84.007, 84.033, and 84.268 – U.S. Department of Education Program Year 2023-2024
Criteria or Specific Requirement – Gramm-Leach-Bliley Act (GLBA) – Student Information Security – 16 CFR §314
Condition – The University’s written information security program did not adequately include three of the six required minimum elements.Questioned Costs – N/A
Context – Out of the six elements that are required to be included in the written information security program, all six were tested. Of these elements, three were not adequately included in the written program.
Effect – The University failed to include the minimum elements in its written information security program to meet GLBA requirements, as agreed to within its Program Participation Agreement with the Department of Education (ED). This could potentially result in the failure to secure student financial aid information.
Cause – The University did not have appropriate controls in place to ensure compliance with relevant requirements.
Identification as a Repeat Finding, if Applicable – N/A
Recommendation – The University should ensure the design and appropriate operating effectiveness of controls surrounding GLBA compliance to ensure that all required elements are included in the information security program.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the finding. Policies are being reviewed and approved to add the documentation and testing that was not covered in previous policies.
Federal Program – Student Financial Assistance Cluster – Assistance Listing Numbers 84.063 and 84.268 – U.S. Department of Education Program Year 2023-2024
Criteria or Specific Requirement – Special Tests and Provision – Enrollment Reporting – 34 CFR §690.83 and 34 CFR §685.309
Condition – Three address changes and one student status change were not reported timely and one student had incorrect enrollment information.
Questioned Costs – N/A
Context – Out of a population of 1,393 students with status changes during the Spring and Fall semesters of the 2024 aid year, 25 were selected for testing. Of those students, three had status or address changes during the period that were not reported timely, and one had both an address change that was not reported timely and the incorrect CIP code reported. Our sample was not, and was not intended to be, statistically valid.
Effect – The University reported inaccurate information or failed to report changes within the required time frame and, as such, ED was not provided accurate and timely information.
Cause – The University did not have appropriate controls in place to ensure timely and accurate reporting.
Identification as a Repeat Finding, if Applicable – N/A
Recommendation – The University should ensure the design and appropriate operating effectiveness of controls surrounding enrollment reporting to ensure that all status and address changes are reported timely and that all enrollment information is reported accurately.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the findings and has put the following in place. The Registrar will report enrollment changes during the summer semesters. The Registrar will also send the Director of Student Financial
Services notifications when enrollment changes are submitted through the National Student
Clearinghouse.
Federal Program – Student Financial Assistance Cluster – Assistance Listing Numbers 84.063, 84.007 and 84.268 – U.S. Department of Education Program Year 2023-2024
Criteria or Specific Requirement – 2 CFR 200.516(a), Paragraph 13.39(e) – Known or Likely Fraud Affecting a Federal Award
Condition – Financial aid funds were provided to six fraudulent student accounts; the issue was identified by the school and reported to the U.S. Department of Education.
Questioned Costs – $54,112
Context – During a review of the awards population for fiscal year 2024, the University identified six accounts that had duplicate contact and bank information. After further investigation, these accounts were determined to be fraudulently created. In total, $54,112 in funds were paid out. The school worked with the U.S. Department of Education’s CyberIncident Division to inform the Department of the fraudulent activity.
Effect – The University allowed refunds to be made from financial aid awarded to fraudulent student accounts resulting in questioned costs.
Cause – The University had detective rather than preventative controls in place regarding distributions of financial aid funds to repeating accounts or individuals.
Identification as a Repeat Finding, if Applicable – N/A
Recommendation – The University should implement procedures to identify duplicate contact and bank information across student accounts automatically or a process to check for duplicates prior to financial aid distribution.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the findings and has put the following in place. The Bursar will work with ITS to perform a scan of all students’ accounts for duplicate contact and banking information. If duplicates are found, students will be notified and accounts frozen until students are identified. This will be
critical before refund checks are dispersed to students every semester. The amount of
$54,112 will be paid back with the next draw down before February 28, 2025.
Federal Program – Student Financial Assistance Cluster – Assistance Listing Numbers 84.063, 84.007, 84.033, and 84.268 – U.S. Department of Education Program Year 2023-2024
Criteria or Specific Requirement – Gramm-Leach-Bliley Act (GLBA) – Student Information Security – 16 CFR §314
Condition – The University’s written information security program did not adequately include three of the six required minimum elements.Questioned Costs – N/A
Context – Out of the six elements that are required to be included in the written information security program, all six were tested. Of these elements, three were not adequately included in the written program.
Effect – The University failed to include the minimum elements in its written information security program to meet GLBA requirements, as agreed to within its Program Participation Agreement with the Department of Education (ED). This could potentially result in the failure to secure student financial aid information.
Cause – The University did not have appropriate controls in place to ensure compliance with relevant requirements.
Identification as a Repeat Finding, if Applicable – N/A
Recommendation – The University should ensure the design and appropriate operating effectiveness of controls surrounding GLBA compliance to ensure that all required elements are included in the information security program.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the finding. Policies are being reviewed and approved to add the documentation and testing that was not covered in previous policies.
Federal Program – Student Financial Assistance Cluster – Assistance Listing Numbers 84.063, 84.007 and 84.268 – U.S. Department of Education Program Year 2023-2024
Criteria or Specific Requirement – 2 CFR 200.516(a), Paragraph 13.39(e) – Known or Likely Fraud Affecting a Federal Award
Condition – Financial aid funds were provided to six fraudulent student accounts; the issue was identified by the school and reported to the U.S. Department of Education.
Questioned Costs – $54,112
Context – During a review of the awards population for fiscal year 2024, the University identified six accounts that had duplicate contact and bank information. After further investigation, these accounts were determined to be fraudulently created. In total, $54,112 in funds were paid out. The school worked with the U.S. Department of Education’s CyberIncident Division to inform the Department of the fraudulent activity.
Effect – The University allowed refunds to be made from financial aid awarded to fraudulent student accounts resulting in questioned costs.
Cause – The University had detective rather than preventative controls in place regarding distributions of financial aid funds to repeating accounts or individuals.
Identification as a Repeat Finding, if Applicable – N/A
Recommendation – The University should implement procedures to identify duplicate contact and bank information across student accounts automatically or a process to check for duplicates prior to financial aid distribution.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the findings and has put the following in place. The Bursar will work with ITS to perform a scan of all students’ accounts for duplicate contact and banking information. If duplicates are found, students will be notified and accounts frozen until students are identified. This will be
critical before refund checks are dispersed to students every semester. The amount of
$54,112 will be paid back with the next draw down before February 28, 2025.
Federal Program – Student Financial Assistance Cluster – Assistance Listing Numbers 84.063, 84.007, 84.033, and 84.268 – U.S. Department of Education Program Year 2023-2024
Criteria or Specific Requirement – Gramm-Leach-Bliley Act (GLBA) – Student Information Security – 16 CFR §314
Condition – The University’s written information security program did not adequately include three of the six required minimum elements.Questioned Costs – N/A
Context – Out of the six elements that are required to be included in the written information security program, all six were tested. Of these elements, three were not adequately included in the written program.
Effect – The University failed to include the minimum elements in its written information security program to meet GLBA requirements, as agreed to within its Program Participation Agreement with the Department of Education (ED). This could potentially result in the failure to secure student financial aid information.
Cause – The University did not have appropriate controls in place to ensure compliance with relevant requirements.
Identification as a Repeat Finding, if Applicable – N/A
Recommendation – The University should ensure the design and appropriate operating effectiveness of controls surrounding GLBA compliance to ensure that all required elements are included in the information security program.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the finding. Policies are being reviewed and approved to add the documentation and testing that was not covered in previous policies.
Federal Program – Student Financial Assistance Cluster – Assistance Listing Numbers 84.063, 84.007, 84.033, and 84.268 – U.S. Department of Education Program Year 2023-2024
Criteria or Specific Requirement – Gramm-Leach-Bliley Act (GLBA) – Student Information Security – 16 CFR §314
Condition – The University’s written information security program did not adequately include three of the six required minimum elements.Questioned Costs – N/A
Context – Out of the six elements that are required to be included in the written information security program, all six were tested. Of these elements, three were not adequately included in the written program.
Effect – The University failed to include the minimum elements in its written information security program to meet GLBA requirements, as agreed to within its Program Participation Agreement with the Department of Education (ED). This could potentially result in the failure to secure student financial aid information.
Cause – The University did not have appropriate controls in place to ensure compliance with relevant requirements.
Identification as a Repeat Finding, if Applicable – N/A
Recommendation – The University should ensure the design and appropriate operating effectiveness of controls surrounding GLBA compliance to ensure that all required elements are included in the information security program.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the finding. Policies are being reviewed and approved to add the documentation and testing that was not covered in previous policies.
Federal Program – Student Financial Assistance Cluster – Assistance Listing Numbers 84.063 and 84.268 – U.S. Department of Education Program Year 2023-2024
Criteria or Specific Requirement – Special Tests and Provision – Enrollment Reporting – 34 CFR §690.83 and 34 CFR §685.309
Condition – Three address changes and one student status change were not reported timely and one student had incorrect enrollment information.
Questioned Costs – N/A
Context – Out of a population of 1,393 students with status changes during the Spring and Fall semesters of the 2024 aid year, 25 were selected for testing. Of those students, three had status or address changes during the period that were not reported timely, and one had both an address change that was not reported timely and the incorrect CIP code reported. Our sample was not, and was not intended to be, statistically valid.
Effect – The University reported inaccurate information or failed to report changes within the required time frame and, as such, ED was not provided accurate and timely information.
Cause – The University did not have appropriate controls in place to ensure timely and accurate reporting.
Identification as a Repeat Finding, if Applicable – N/A
Recommendation – The University should ensure the design and appropriate operating effectiveness of controls surrounding enrollment reporting to ensure that all status and address changes are reported timely and that all enrollment information is reported accurately.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the findings and has put the following in place. The Registrar will report enrollment changes during the summer semesters. The Registrar will also send the Director of Student Financial
Services notifications when enrollment changes are submitted through the National Student
Clearinghouse.
Federal Program – Student Financial Assistance Cluster – Assistance Listing Numbers 84.063, 84.007 and 84.268 – U.S. Department of Education Program Year 2023-2024
Criteria or Specific Requirement – 2 CFR 200.516(a), Paragraph 13.39(e) – Known or Likely Fraud Affecting a Federal Award
Condition – Financial aid funds were provided to six fraudulent student accounts; the issue was identified by the school and reported to the U.S. Department of Education.
Questioned Costs – $54,112
Context – During a review of the awards population for fiscal year 2024, the University identified six accounts that had duplicate contact and bank information. After further investigation, these accounts were determined to be fraudulently created. In total, $54,112 in funds were paid out. The school worked with the U.S. Department of Education’s CyberIncident Division to inform the Department of the fraudulent activity.
Effect – The University allowed refunds to be made from financial aid awarded to fraudulent student accounts resulting in questioned costs.
Cause – The University had detective rather than preventative controls in place regarding distributions of financial aid funds to repeating accounts or individuals.
Identification as a Repeat Finding, if Applicable – N/A
Recommendation – The University should implement procedures to identify duplicate contact and bank information across student accounts automatically or a process to check for duplicates prior to financial aid distribution.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the findings and has put the following in place. The Bursar will work with ITS to perform a scan of all students’ accounts for duplicate contact and banking information. If duplicates are found, students will be notified and accounts frozen until students are identified. This will be
critical before refund checks are dispersed to students every semester. The amount of
$54,112 will be paid back with the next draw down before February 28, 2025.
Federal Program – Student Financial Assistance Cluster – Assistance Listing Numbers 84.063, 84.007, 84.033, and 84.268 – U.S. Department of Education Program Year 2023-2024
Criteria or Specific Requirement – Gramm-Leach-Bliley Act (GLBA) – Student Information Security – 16 CFR §314
Condition – The University’s written information security program did not adequately include three of the six required minimum elements.Questioned Costs – N/A
Context – Out of the six elements that are required to be included in the written information security program, all six were tested. Of these elements, three were not adequately included in the written program.
Effect – The University failed to include the minimum elements in its written information security program to meet GLBA requirements, as agreed to within its Program Participation Agreement with the Department of Education (ED). This could potentially result in the failure to secure student financial aid information.
Cause – The University did not have appropriate controls in place to ensure compliance with relevant requirements.
Identification as a Repeat Finding, if Applicable – N/A
Recommendation – The University should ensure the design and appropriate operating effectiveness of controls surrounding GLBA compliance to ensure that all required elements are included in the information security program.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the finding. Policies are being reviewed and approved to add the documentation and testing that was not covered in previous policies.
Federal Program – Student Financial Assistance Cluster – Assistance Listing Numbers 84.063 and 84.268 – U.S. Department of Education Program Year 2023-2024
Criteria or Specific Requirement – Special Tests and Provision – Enrollment Reporting – 34 CFR §690.83 and 34 CFR §685.309
Condition – Three address changes and one student status change were not reported timely and one student had incorrect enrollment information.
Questioned Costs – N/A
Context – Out of a population of 1,393 students with status changes during the Spring and Fall semesters of the 2024 aid year, 25 were selected for testing. Of those students, three had status or address changes during the period that were not reported timely, and one had both an address change that was not reported timely and the incorrect CIP code reported. Our sample was not, and was not intended to be, statistically valid.
Effect – The University reported inaccurate information or failed to report changes within the required time frame and, as such, ED was not provided accurate and timely information.
Cause – The University did not have appropriate controls in place to ensure timely and accurate reporting.
Identification as a Repeat Finding, if Applicable – N/A
Recommendation – The University should ensure the design and appropriate operating effectiveness of controls surrounding enrollment reporting to ensure that all status and address changes are reported timely and that all enrollment information is reported accurately.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the findings and has put the following in place. The Registrar will report enrollment changes during the summer semesters. The Registrar will also send the Director of Student Financial
Services notifications when enrollment changes are submitted through the National Student
Clearinghouse.
Federal Program – Student Financial Assistance Cluster – Assistance Listing Numbers 84.063, 84.007 and 84.268 – U.S. Department of Education Program Year 2023-2024
Criteria or Specific Requirement – 2 CFR 200.516(a), Paragraph 13.39(e) – Known or Likely Fraud Affecting a Federal Award
Condition – Financial aid funds were provided to six fraudulent student accounts; the issue was identified by the school and reported to the U.S. Department of Education.
Questioned Costs – $54,112
Context – During a review of the awards population for fiscal year 2024, the University identified six accounts that had duplicate contact and bank information. After further investigation, these accounts were determined to be fraudulently created. In total, $54,112 in funds were paid out. The school worked with the U.S. Department of Education’s CyberIncident Division to inform the Department of the fraudulent activity.
Effect – The University allowed refunds to be made from financial aid awarded to fraudulent student accounts resulting in questioned costs.
Cause – The University had detective rather than preventative controls in place regarding distributions of financial aid funds to repeating accounts or individuals.
Identification as a Repeat Finding, if Applicable – N/A
Recommendation – The University should implement procedures to identify duplicate contact and bank information across student accounts automatically or a process to check for duplicates prior to financial aid distribution.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the findings and has put the following in place. The Bursar will work with ITS to perform a scan of all students’ accounts for duplicate contact and banking information. If duplicates are found, students will be notified and accounts frozen until students are identified. This will be
critical before refund checks are dispersed to students every semester. The amount of
$54,112 will be paid back with the next draw down before February 28, 2025.
Federal Program – Student Financial Assistance Cluster – Assistance Listing Numbers 84.063, 84.007, 84.033, and 84.268 – U.S. Department of Education Program Year 2023-2024
Criteria or Specific Requirement – Gramm-Leach-Bliley Act (GLBA) – Student Information Security – 16 CFR §314
Condition – The University’s written information security program did not adequately include three of the six required minimum elements.Questioned Costs – N/A
Context – Out of the six elements that are required to be included in the written information security program, all six were tested. Of these elements, three were not adequately included in the written program.
Effect – The University failed to include the minimum elements in its written information security program to meet GLBA requirements, as agreed to within its Program Participation Agreement with the Department of Education (ED). This could potentially result in the failure to secure student financial aid information.
Cause – The University did not have appropriate controls in place to ensure compliance with relevant requirements.
Identification as a Repeat Finding, if Applicable – N/A
Recommendation – The University should ensure the design and appropriate operating effectiveness of controls surrounding GLBA compliance to ensure that all required elements are included in the information security program.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the finding. Policies are being reviewed and approved to add the documentation and testing that was not covered in previous policies.
Federal Program – Student Financial Assistance Cluster – Assistance Listing Numbers 84.063, 84.007 and 84.268 – U.S. Department of Education Program Year 2023-2024
Criteria or Specific Requirement – 2 CFR 200.516(a), Paragraph 13.39(e) – Known or Likely Fraud Affecting a Federal Award
Condition – Financial aid funds were provided to six fraudulent student accounts; the issue was identified by the school and reported to the U.S. Department of Education.
Questioned Costs – $54,112
Context – During a review of the awards population for fiscal year 2024, the University identified six accounts that had duplicate contact and bank information. After further investigation, these accounts were determined to be fraudulently created. In total, $54,112 in funds were paid out. The school worked with the U.S. Department of Education’s CyberIncident Division to inform the Department of the fraudulent activity.
Effect – The University allowed refunds to be made from financial aid awarded to fraudulent student accounts resulting in questioned costs.
Cause – The University had detective rather than preventative controls in place regarding distributions of financial aid funds to repeating accounts or individuals.
Identification as a Repeat Finding, if Applicable – N/A
Recommendation – The University should implement procedures to identify duplicate contact and bank information across student accounts automatically or a process to check for duplicates prior to financial aid distribution.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the findings and has put the following in place. The Bursar will work with ITS to perform a scan of all students’ accounts for duplicate contact and banking information. If duplicates are found, students will be notified and accounts frozen until students are identified. This will be
critical before refund checks are dispersed to students every semester. The amount of
$54,112 will be paid back with the next draw down before February 28, 2025.
Federal Program – Student Financial Assistance Cluster – Assistance Listing Numbers 84.063, 84.007, 84.033, and 84.268 – U.S. Department of Education Program Year 2023-2024
Criteria or Specific Requirement – Gramm-Leach-Bliley Act (GLBA) – Student Information Security – 16 CFR §314
Condition – The University’s written information security program did not adequately include three of the six required minimum elements.Questioned Costs – N/A
Context – Out of the six elements that are required to be included in the written information security program, all six were tested. Of these elements, three were not adequately included in the written program.
Effect – The University failed to include the minimum elements in its written information security program to meet GLBA requirements, as agreed to within its Program Participation Agreement with the Department of Education (ED). This could potentially result in the failure to secure student financial aid information.
Cause – The University did not have appropriate controls in place to ensure compliance with relevant requirements.
Identification as a Repeat Finding, if Applicable – N/A
Recommendation – The University should ensure the design and appropriate operating effectiveness of controls surrounding GLBA compliance to ensure that all required elements are included in the information security program.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the finding. Policies are being reviewed and approved to add the documentation and testing that was not covered in previous policies.
Federal Program – Student Financial Assistance Cluster – Assistance Listing Numbers 84.063, 84.007, 84.033, and 84.268 – U.S. Department of Education Program Year 2023-2024
Criteria or Specific Requirement – Gramm-Leach-Bliley Act (GLBA) – Student Information Security – 16 CFR §314
Condition – The University’s written information security program did not adequately include three of the six required minimum elements.Questioned Costs – N/A
Context – Out of the six elements that are required to be included in the written information security program, all six were tested. Of these elements, three were not adequately included in the written program.
Effect – The University failed to include the minimum elements in its written information security program to meet GLBA requirements, as agreed to within its Program Participation Agreement with the Department of Education (ED). This could potentially result in the failure to secure student financial aid information.
Cause – The University did not have appropriate controls in place to ensure compliance with relevant requirements.
Identification as a Repeat Finding, if Applicable – N/A
Recommendation – The University should ensure the design and appropriate operating effectiveness of controls surrounding GLBA compliance to ensure that all required elements are included in the information security program.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the finding. Policies are being reviewed and approved to add the documentation and testing that was not covered in previous policies.
Federal Program – Student Financial Assistance Cluster – Assistance Listing Numbers 84.063 and 84.268 – U.S. Department of Education Program Year 2023-2024
Criteria or Specific Requirement – Special Tests and Provision – Enrollment Reporting – 34 CFR §690.83 and 34 CFR §685.309
Condition – Three address changes and one student status change were not reported timely and one student had incorrect enrollment information.
Questioned Costs – N/A
Context – Out of a population of 1,393 students with status changes during the Spring and Fall semesters of the 2024 aid year, 25 were selected for testing. Of those students, three had status or address changes during the period that were not reported timely, and one had both an address change that was not reported timely and the incorrect CIP code reported. Our sample was not, and was not intended to be, statistically valid.
Effect – The University reported inaccurate information or failed to report changes within the required time frame and, as such, ED was not provided accurate and timely information.
Cause – The University did not have appropriate controls in place to ensure timely and accurate reporting.
Identification as a Repeat Finding, if Applicable – N/A
Recommendation – The University should ensure the design and appropriate operating effectiveness of controls surrounding enrollment reporting to ensure that all status and address changes are reported timely and that all enrollment information is reported accurately.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the findings and has put the following in place. The Registrar will report enrollment changes during the summer semesters. The Registrar will also send the Director of Student Financial
Services notifications when enrollment changes are submitted through the National Student
Clearinghouse.
Federal Program – Student Financial Assistance Cluster – Assistance Listing Numbers 84.063, 84.007 and 84.268 – U.S. Department of Education Program Year 2023-2024
Criteria or Specific Requirement – 2 CFR 200.516(a), Paragraph 13.39(e) – Known or Likely Fraud Affecting a Federal Award
Condition – Financial aid funds were provided to six fraudulent student accounts; the issue was identified by the school and reported to the U.S. Department of Education.
Questioned Costs – $54,112
Context – During a review of the awards population for fiscal year 2024, the University identified six accounts that had duplicate contact and bank information. After further investigation, these accounts were determined to be fraudulently created. In total, $54,112 in funds were paid out. The school worked with the U.S. Department of Education’s CyberIncident Division to inform the Department of the fraudulent activity.
Effect – The University allowed refunds to be made from financial aid awarded to fraudulent student accounts resulting in questioned costs.
Cause – The University had detective rather than preventative controls in place regarding distributions of financial aid funds to repeating accounts or individuals.
Identification as a Repeat Finding, if Applicable – N/A
Recommendation – The University should implement procedures to identify duplicate contact and bank information across student accounts automatically or a process to check for duplicates prior to financial aid distribution.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the findings and has put the following in place. The Bursar will work with ITS to perform a scan of all students’ accounts for duplicate contact and banking information. If duplicates are found, students will be notified and accounts frozen until students are identified. This will be
critical before refund checks are dispersed to students every semester. The amount of
$54,112 will be paid back with the next draw down before February 28, 2025.