Audit 348052

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268 Federal Award Identification Number: P063P221568, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance: 1. The Code of Federal Regulations, consisting of 34 CFR 685.309 and 34 CFR 690.83(b)(2), requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Additionally, schools are required to certify enrollment at a minimum of every 60 days or every other month. 2. The Code of Federal Regulations, consisting of 34 CFR 685.309 and 34 CFR 690.83(b)(2), requires certain student enrollment information be reported to the Department of Education. Information provided to the Department of Education should agree to the institution’s records. Condition: The change in status was not reported timely and the program begin date per the institution’s records did not agree to information in the NSLDS. Questioned costs: None Context: This condition occurred in our statistically valid sample as follows: 1. The status was not reported timely for 4 out of 36 students 2. The Program Begin Date was incorrectly reported for 7 out of 35 students Cause: The Registrar's Office has been through several transitions over the past five years and training has been inadequate during this period. Specifically, there was not sufficient training on enrollment submissions, error resolutions, and timely updates. Effect: 1. The published program length reported to NSLDS is used to determine the student’s maximum and remaining eligibility periods under the 150% limit. By not reporting the correct length, the calculation of the 150% would be incorrect and the grace period begin date would be incorrect. 2. The NSLDS system is not updated timely with the student information which may cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes, 2023-001 Recommendation: We recommend the College review its reporting procedures to ensure that students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268 Federal Award Identification Number: P063P221568, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance: 1. The Code of Federal Regulations, consisting of 34 CFR 685.309 and 34 CFR 690.83(b)(2), requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Additionally, schools are required to certify enrollment at a minimum of every 60 days or every other month. 2. The Code of Federal Regulations, consisting of 34 CFR 685.309 and 34 CFR 690.83(b)(2), requires certain student enrollment information be reported to the Department of Education. Information provided to the Department of Education should agree to the institution’s records. Condition: The change in status was not reported timely and the program begin date per the institution’s records did not agree to information in the NSLDS. Questioned costs: None Context: This condition occurred in our statistically valid sample as follows: 1. The status was not reported timely for 4 out of 36 students 2. The Program Begin Date was incorrectly reported for 7 out of 35 students Cause: The Registrar's Office has been through several transitions over the past five years and training has been inadequate during this period. Specifically, there was not sufficient training on enrollment submissions, error resolutions, and timely updates. Effect: 1. The published program length reported to NSLDS is used to determine the student’s maximum and remaining eligibility periods under the 150% limit. By not reporting the correct length, the calculation of the 150% would be incorrect and the grace period begin date would be incorrect. 2. The NSLDS system is not updated timely with the student information which may cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes, 2023-001 Recommendation: We recommend the College review its reporting procedures to ensure that students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P007A221791, P007A231791, P007A241791, P033A221791, P063P221568, P033A231791, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). Cause: The gaps in the College’s information security program, during the specified audit period, stemmed from prior deficiencies in documentation and procedural enforcement, which were exacerbated by staff turnover and resource constraints. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: Yes, 2023-002 Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P007A221791, P007A231791, P007A241791, P033A221791, P063P221568, P033A231791, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). Cause: The gaps in the College’s information security program, during the specified audit period, stemmed from prior deficiencies in documentation and procedural enforcement, which were exacerbated by staff turnover and resource constraints. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: Yes, 2023-002 Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P007A221791, P007A231791, P007A241791, P033A221791, P063P221568, P033A231791, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). Cause: The gaps in the College’s information security program, during the specified audit period, stemmed from prior deficiencies in documentation and procedural enforcement, which were exacerbated by staff turnover and resource constraints. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: Yes, 2023-002 Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P007A221791, P007A231791, P007A241791, P033A221791, P063P221568, P033A231791, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). Cause: The gaps in the College’s information security program, during the specified audit period, stemmed from prior deficiencies in documentation and procedural enforcement, which were exacerbated by staff turnover and resource constraints. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: Yes, 2023-002 Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Number: 84.063 Federal Award Identification Number and Year: P063P221568, P063P231568, P063Q221568, P063Q231568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - Per 34 CFR 690.83(a)(2), an institution must submit Pell grant payment data to the Department of Education that reflects information reported at the institution. Condition: The amount of Pell grant paid to the student per the institution’s records as of a certain date did not match the payment amounted reported in COD as of that same date. The difference was reported to COD as of a later date. Questioned costs: None Context: This condition occurred for one out of 16 students tested. Cause: The transmittal report was not reviewed closely enough to find that Pell Grant for one student had not fully transmitted. Effect: Accurate information is not provided to the Department of Education, as required. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and policies around reporting Pell disbursements to COD to ensure that student information is reported accurately and timely. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268, 84.033 Federal Award Identification Number: P007A241791, P033A221791, P063P221568, P033A231791, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - Per 34 CFR 668.54(a)(1), an institution must verify information required by the Department of Education for applicants selected for verification by the Department of Education. Condition: Verification procedures were not completed for an applicant who was selected for verification by the Department of Education and who received Title IV aid. Questioned costs: $11,766 Context: This condition occurred for 1 out of 40 students selected for testing. Cause: A previous staff member indicated that verification had been completed by changing the status in Ellucian Colleague to complete. Therefore, it was not identified in reports that are reviewed for incomplete files. Effect: The student is awarded aid who is otherwise ineligible until verification procedures are completed. Repeat Finding: No Recommendation: The College should review the procedures surrounding the verification process to ensure all necessary support and documentation is obtained and retained in the student files. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268, 84.033 Federal Award Identification Number: P007A241791, P033A221791, P063P221568, P033A231791, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - Per 34 CFR 668.54(a)(1), an institution must verify information required by the Department of Education for applicants selected for verification by the Department of Education. Condition: Verification procedures were not completed for an applicant who was selected for verification by the Department of Education and who received Title IV aid. Questioned costs: $11,766 Context: This condition occurred for 1 out of 40 students selected for testing. Cause: A previous staff member indicated that verification had been completed by changing the status in Ellucian Colleague to complete. Therefore, it was not identified in reports that are reviewed for incomplete files. Effect: The student is awarded aid who is otherwise ineligible until verification procedures are completed. Repeat Finding: No Recommendation: The College should review the procedures surrounding the verification process to ensure all necessary support and documentation is obtained and retained in the student files. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268, 84.033 Federal Award Identification Number: P007A241791, P033A221791, P063P221568, P033A231791, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - Per 34 CFR 668.54(a)(1), an institution must verify information required by the Department of Education for applicants selected for verification by the Department of Education. Condition: Verification procedures were not completed for an applicant who was selected for verification by the Department of Education and who received Title IV aid. Questioned costs: $11,766 Context: This condition occurred for 1 out of 40 students selected for testing. Cause: A previous staff member indicated that verification had been completed by changing the status in Ellucian Colleague to complete. Therefore, it was not identified in reports that are reviewed for incomplete files. Effect: The student is awarded aid who is otherwise ineligible until verification procedures are completed. Repeat Finding: No Recommendation: The College should review the procedures surrounding the verification process to ensure all necessary support and documentation is obtained and retained in the student files. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.268 Federal Award Identification Number: P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.164(h) requires that credit balances on a student's ledger account derived from title IV funds must be returned to the student or parent as soon as possible, but no later than 14 days after the credit balance occurred. Condition: A credit balance was paid after 15 days, which exceeds the 14-day requirement to return the credit balance to the student. Questioned costs: None Context: This condition occurred for 1 out of 2 credit balances selected for testing. Cause: The voucher was inadvertently missed in our accounts payable process. As soon as the error was discovered, payment was remitted. We have implemented processes going forward to verify that all Parent Plus loans are paid out within 14 days. Effect: The College did not refund the student within 14 days for credit balances that arose from federal funds as required by regulations. Repeat Finding: No Recommendation: We recommend the College review and revise its policies for identifying and paying credit balances to ensure that it is paid to the student or parent as soon as possible, but no more than 14 days after the occurrence. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268 Federal Award Identification Number: P063P221568, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance: 1. The Code of Federal Regulations, consisting of 34 CFR 685.309 and 34 CFR 690.83(b)(2), requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Additionally, schools are required to certify enrollment at a minimum of every 60 days or every other month. 2. The Code of Federal Regulations, consisting of 34 CFR 685.309 and 34 CFR 690.83(b)(2), requires certain student enrollment information be reported to the Department of Education. Information provided to the Department of Education should agree to the institution’s records. Condition: The change in status was not reported timely and the program begin date per the institution’s records did not agree to information in the NSLDS. Questioned costs: None Context: This condition occurred in our statistically valid sample as follows: 1. The status was not reported timely for 4 out of 36 students 2. The Program Begin Date was incorrectly reported for 7 out of 35 students Cause: The Registrar's Office has been through several transitions over the past five years and training has been inadequate during this period. Specifically, there was not sufficient training on enrollment submissions, error resolutions, and timely updates. Effect: 1. The published program length reported to NSLDS is used to determine the student’s maximum and remaining eligibility periods under the 150% limit. By not reporting the correct length, the calculation of the 150% would be incorrect and the grace period begin date would be incorrect. 2. The NSLDS system is not updated timely with the student information which may cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes, 2023-001 Recommendation: We recommend the College review its reporting procedures to ensure that students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268 Federal Award Identification Number: P063P221568, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance: 1. The Code of Federal Regulations, consisting of 34 CFR 685.309 and 34 CFR 690.83(b)(2), requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Additionally, schools are required to certify enrollment at a minimum of every 60 days or every other month. 2. The Code of Federal Regulations, consisting of 34 CFR 685.309 and 34 CFR 690.83(b)(2), requires certain student enrollment information be reported to the Department of Education. Information provided to the Department of Education should agree to the institution’s records. Condition: The change in status was not reported timely and the program begin date per the institution’s records did not agree to information in the NSLDS. Questioned costs: None Context: This condition occurred in our statistically valid sample as follows: 1. The status was not reported timely for 4 out of 36 students 2. The Program Begin Date was incorrectly reported for 7 out of 35 students Cause: The Registrar's Office has been through several transitions over the past five years and training has been inadequate during this period. Specifically, there was not sufficient training on enrollment submissions, error resolutions, and timely updates. Effect: 1. The published program length reported to NSLDS is used to determine the student’s maximum and remaining eligibility periods under the 150% limit. By not reporting the correct length, the calculation of the 150% would be incorrect and the grace period begin date would be incorrect. 2. The NSLDS system is not updated timely with the student information which may cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes, 2023-001 Recommendation: We recommend the College review its reporting procedures to ensure that students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P007A221791, P007A231791, P007A241791, P033A221791, P063P221568, P033A231791, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). Cause: The gaps in the College’s information security program, during the specified audit period, stemmed from prior deficiencies in documentation and procedural enforcement, which were exacerbated by staff turnover and resource constraints. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: Yes, 2023-002 Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P007A221791, P007A231791, P007A241791, P033A221791, P063P221568, P033A231791, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). Cause: The gaps in the College’s information security program, during the specified audit period, stemmed from prior deficiencies in documentation and procedural enforcement, which were exacerbated by staff turnover and resource constraints. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: Yes, 2023-002 Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P007A221791, P007A231791, P007A241791, P033A221791, P063P221568, P033A231791, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). Cause: The gaps in the College’s information security program, during the specified audit period, stemmed from prior deficiencies in documentation and procedural enforcement, which were exacerbated by staff turnover and resource constraints. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: Yes, 2023-002 Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P007A221791, P007A231791, P007A241791, P033A221791, P063P221568, P033A231791, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). Cause: The gaps in the College’s information security program, during the specified audit period, stemmed from prior deficiencies in documentation and procedural enforcement, which were exacerbated by staff turnover and resource constraints. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: Yes, 2023-002 Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Number: 84.063 Federal Award Identification Number and Year: P063P221568, P063P231568, P063Q221568, P063Q231568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - Per 34 CFR 690.83(a)(2), an institution must submit Pell grant payment data to the Department of Education that reflects information reported at the institution. Condition: The amount of Pell grant paid to the student per the institution’s records as of a certain date did not match the payment amounted reported in COD as of that same date. The difference was reported to COD as of a later date. Questioned costs: None Context: This condition occurred for one out of 16 students tested. Cause: The transmittal report was not reviewed closely enough to find that Pell Grant for one student had not fully transmitted. Effect: Accurate information is not provided to the Department of Education, as required. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and policies around reporting Pell disbursements to COD to ensure that student information is reported accurately and timely. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268, 84.033 Federal Award Identification Number: P007A241791, P033A221791, P063P221568, P033A231791, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - Per 34 CFR 668.54(a)(1), an institution must verify information required by the Department of Education for applicants selected for verification by the Department of Education. Condition: Verification procedures were not completed for an applicant who was selected for verification by the Department of Education and who received Title IV aid. Questioned costs: $11,766 Context: This condition occurred for 1 out of 40 students selected for testing. Cause: A previous staff member indicated that verification had been completed by changing the status in Ellucian Colleague to complete. Therefore, it was not identified in reports that are reviewed for incomplete files. Effect: The student is awarded aid who is otherwise ineligible until verification procedures are completed. Repeat Finding: No Recommendation: The College should review the procedures surrounding the verification process to ensure all necessary support and documentation is obtained and retained in the student files. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268, 84.033 Federal Award Identification Number: P007A241791, P033A221791, P063P221568, P033A231791, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - Per 34 CFR 668.54(a)(1), an institution must verify information required by the Department of Education for applicants selected for verification by the Department of Education. Condition: Verification procedures were not completed for an applicant who was selected for verification by the Department of Education and who received Title IV aid. Questioned costs: $11,766 Context: This condition occurred for 1 out of 40 students selected for testing. Cause: A previous staff member indicated that verification had been completed by changing the status in Ellucian Colleague to complete. Therefore, it was not identified in reports that are reviewed for incomplete files. Effect: The student is awarded aid who is otherwise ineligible until verification procedures are completed. Repeat Finding: No Recommendation: The College should review the procedures surrounding the verification process to ensure all necessary support and documentation is obtained and retained in the student files. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268, 84.033 Federal Award Identification Number: P007A241791, P033A221791, P063P221568, P033A231791, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - Per 34 CFR 668.54(a)(1), an institution must verify information required by the Department of Education for applicants selected for verification by the Department of Education. Condition: Verification procedures were not completed for an applicant who was selected for verification by the Department of Education and who received Title IV aid. Questioned costs: $11,766 Context: This condition occurred for 1 out of 40 students selected for testing. Cause: A previous staff member indicated that verification had been completed by changing the status in Ellucian Colleague to complete. Therefore, it was not identified in reports that are reviewed for incomplete files. Effect: The student is awarded aid who is otherwise ineligible until verification procedures are completed. Repeat Finding: No Recommendation: The College should review the procedures surrounding the verification process to ensure all necessary support and documentation is obtained and retained in the student files. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.268 Federal Award Identification Number: P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.164(h) requires that credit balances on a student's ledger account derived from title IV funds must be returned to the student or parent as soon as possible, but no later than 14 days after the credit balance occurred. Condition: A credit balance was paid after 15 days, which exceeds the 14-day requirement to return the credit balance to the student. Questioned costs: None Context: This condition occurred for 1 out of 2 credit balances selected for testing. Cause: The voucher was inadvertently missed in our accounts payable process. As soon as the error was discovered, payment was remitted. We have implemented processes going forward to verify that all Parent Plus loans are paid out within 14 days. Effect: The College did not refund the student within 14 days for credit balances that arose from federal funds as required by regulations. Repeat Finding: No Recommendation: We recommend the College review and revise its policies for identifying and paying credit balances to ensure that it is paid to the student or parent as soon as possible, but no more than 14 days after the occurrence. Views of responsible officials: There is no disagreement with the audit finding.