Audit 350256

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 16 CFR Part 314 requires the University to implement information safeguard standards prescribed by the Gramm-Leach-Bliley Act (GLBA). GLBA requires institutions and servicers to develop, implement, and maintain a written, comprehensive information security program which contains administrative, technical, and physical safeguards that are appropriate to the size and complexity of the institution or servicer, the nature and scope of their activities, and the sensitivity of any student information. An institution’s written information security program must include the following elements: • Element 1: Designates a Qualified Individual responsible for overseeing and implementing the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)). • Element 2: Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)). • Element 3: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8). • Element 4: Provides for the institution or servicer to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 C.F.R. 314.4(d)). • Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)) • Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)). • Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)). • Element 8: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the establishment of an incident response plan (16 C.F.R. 314.4(h)). • Element 9: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the requirement for its Qualified Individual to report regularly and at least annually to those with control over the institution on the institution’s information security program (16 C.F.R. 314.4(i)). Context: We conducted inquiries with the University’s Information Security Officer to determine whether the University had a written information security program that addressed the elements required by GLBA. Although the University has a designated security officer (i.e. Qualified Individual), management confirmed that the University did not have a written comprehensive program in place as prescribed by the GLBA. Cause: Management indicated there was a lack of awareness regarding the requirement to establish an information security program that addressed the required elements. Effect: The University was not in compliance with the GLBA requirement which could result in administrative action by the Department of Education and may impact the University’s participation in Title IV programs. Questioned Costs: None Identification of repeat finding: N/A. Recommendations: We recommend the University develop and implement an Information Security Program that includes the required elements prescribed by GLBA. The University should develop and retain documentation supporting the completion and implementation of each of the required elements. Once completed, the University should conduct periodic internal assessments of the Information Security Programs’ compliance or consider engaging a third-party consultant to conduct such a review. Views of responsible officials: The Information Security Officer has developed a comprehensive project plan to implement the core 9 elements as listed under FTC Safeguards. The plan is backed by HPU’s 3rd party risk assessment conducted in November of 2024. The addition of a new hire and a part-time resource has facilitated significant progress. Budget for necessary tools, software, and services such as penetration testing are being actively quoted for review by the Budget Office and CFO for both current and future fiscal years. Checkpoints have been established every two weeks to review and confirm substantial progress towards meeting all requirements and address any barriers or setbacks that may occur. The Vice President of Operations and CIO will review the progress support efforts to meet the requirements and targeted delivery date. The HPU Cybersecurity Committee will be provided with the 2024 Risk Assessment and the Information Security Program documentation and policies for both initial and ongoing review of the programs with the objective to further strengthen the program beyond minimum requirement.

Criteria: 34 CFR 668.22(j)(1) requires the University to return the amount of Title IV funds for which it is responsible as soon as possible, but no later than 45 days after the date of the University’s determination that the student withdrew. Condition: The University did not return all Title IV funds in a timely manner. Context: We selected a non-statistical sample of 8 students out of a population of 68 students who withdrew during the year and had Title IV funds disbursed. We noted 6 out of 8 students required a return of Title IV funds and for 5 out of the 6 students, the University did not return funds to the Department of Education within the required time frame. Cause: Although the University has policies and procedures in place over the return of Title IV funds, management indicated that staff turnover, including the resignation of the Director of Financial Aid, resulted in the remaining staff being required to take on additional responsibilities to ensure the continuity of day-to-day functions of the office. In addition, the changes required by the FAFSA simplification act caused the team to be unable to timely comply with the existing policies. Effect: Failure to timely return Title IV funds resulted in noncompliance with the special tests and provisions – return of Title IV funds requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University be more diligent in complying with its established policies and procedures for the return of Title IV funds. Where staffing shortages exist, consider crosstraining staff or temporarily engaging external resources. Views of responsible officials: This issue was initially identified by the University through HPU’s internal monitoring processes. The cause was significant staff turnover within a 6-month period (including the resignation of the Director of Financial Aid). The difficulties of temporarily reduced staffing and loss of institutional knowledge were compounded by the challenges brought by the FAFSA Simplification Act, which required many changes, placing an additional burden on a strained team. Although the University attempted to adhere to its policies and procedures to ensure that R2T4 is processed within the allotted time, the team did not succeed in completing this function. The University replaced key staff, recruited a new Director, and shifted responsibilities so that a specific staff member is responsible for R2T4 processing. These changes have enabled the University to resume processingR2T4 timely, as was accomplished in previous years.

Criteria: 34 CFR 668.164(h)(2) requires that a Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than – (i) 14 days after the balance occurred if the credit balance occurred after the first day of class or a payment period; or (ii) 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition: The University did not pay Title IV credit balances to 3 students or parents in a timely manner. Context: We selected a non-statistical sample of 60 students with disbursements for special tests and provisions – disbursements to or on behalf of students testing, of which 41 students had Title IV credit balances. For 3 out of the 41 credit balances, payments to the student or parent were made after the 14-day requirement. The 3 instances were related to credit balances that were created in December 2023 and paid out in January 2024. Cause: Although the University has policies and procedures in place for the payment of Title IV credit balances, there was a failure to follow its policies and procedures. Management indicated that the credit balances were created in December, directly preceding the University’s holiday break. The University is closed during this period and staffing is generally limited. Management followed its ordinary procedures to pause disbursements prior to break to ensure the credit balances are paid to students or parents in a timely manner. However, one staff member was unaware of this requirement and manually disbursed aid resulting in credit balances for 3 students which required repayment during the holiday break. Effect: Failure to timely pay Title IV credit balances to students or parents resulted in noncompliance with the special tests and provisions – disbursements to or on behalf of students requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University establish clear procedures to ensure timely and effective communication with staff regarding alternative disbursement schedules. Views of responsible officials: The University has an automated process in place to disburse aid daily. That process is set to stop on a certain day before the University’s scheduled Winter Break to allow the refund processing team time to generate and distribute refunds within the allotted timeframe and maintain compliant with related regulations despite the University’s scheduled closure. According to established procedures, the process was stopped as scheduled. However, one of the University’s Financial Aid Counselors manually authorized and disbursed aid for a small number of students after the process was halted for the semester because they were unaware of the reason why aid was not disbursing, and they were attempting to help students who were calling the Financial Aid office. Once management became aware of this issue, the Director of Financial Aid immediately approached the staff member and explained the reason why the University stopped making disbursements. The Director instructed the team member to not override these established controls and explained the importance of adhering to the policies in place. The staff member acknowledged that they understood the consequences of their actions and the need to adhere to policies. In the future, the University will take extra steps to communicate with all team members when this control is initiated prior to Winter Break to ensure collective understanding of the reason for pausing disbursement.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 16 CFR Part 314 requires the University to implement information safeguard standards prescribed by the Gramm-Leach-Bliley Act (GLBA). GLBA requires institutions and servicers to develop, implement, and maintain a written, comprehensive information security program which contains administrative, technical, and physical safeguards that are appropriate to the size and complexity of the institution or servicer, the nature and scope of their activities, and the sensitivity of any student information. An institution’s written information security program must include the following elements: • Element 1: Designates a Qualified Individual responsible for overseeing and implementing the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)). • Element 2: Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)). • Element 3: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8). • Element 4: Provides for the institution or servicer to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 C.F.R. 314.4(d)). • Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)) • Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)). • Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)). • Element 8: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the establishment of an incident response plan (16 C.F.R. 314.4(h)). • Element 9: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the requirement for its Qualified Individual to report regularly and at least annually to those with control over the institution on the institution’s information security program (16 C.F.R. 314.4(i)). Context: We conducted inquiries with the University’s Information Security Officer to determine whether the University had a written information security program that addressed the elements required by GLBA. Although the University has a designated security officer (i.e. Qualified Individual), management confirmed that the University did not have a written comprehensive program in place as prescribed by the GLBA. Cause: Management indicated there was a lack of awareness regarding the requirement to establish an information security program that addressed the required elements. Effect: The University was not in compliance with the GLBA requirement which could result in administrative action by the Department of Education and may impact the University’s participation in Title IV programs. Questioned Costs: None Identification of repeat finding: N/A. Recommendations: We recommend the University develop and implement an Information Security Program that includes the required elements prescribed by GLBA. The University should develop and retain documentation supporting the completion and implementation of each of the required elements. Once completed, the University should conduct periodic internal assessments of the Information Security Programs’ compliance or consider engaging a third-party consultant to conduct such a review. Views of responsible officials: The Information Security Officer has developed a comprehensive project plan to implement the core 9 elements as listed under FTC Safeguards. The plan is backed by HPU’s 3rd party risk assessment conducted in November of 2024. The addition of a new hire and a part-time resource has facilitated significant progress. Budget for necessary tools, software, and services such as penetration testing are being actively quoted for review by the Budget Office and CFO for both current and future fiscal years. Checkpoints have been established every two weeks to review and confirm substantial progress towards meeting all requirements and address any barriers or setbacks that may occur. The Vice President of Operations and CIO will review the progress support efforts to meet the requirements and targeted delivery date. The HPU Cybersecurity Committee will be provided with the 2024 Risk Assessment and the Information Security Program documentation and policies for both initial and ongoing review of the programs with the objective to further strengthen the program beyond minimum requirement.

Criteria: 34 CFR 668.22(j)(1) requires the University to return the amount of Title IV funds for which it is responsible as soon as possible, but no later than 45 days after the date of the University’s determination that the student withdrew. Condition: The University did not return all Title IV funds in a timely manner. Context: We selected a non-statistical sample of 8 students out of a population of 68 students who withdrew during the year and had Title IV funds disbursed. We noted 6 out of 8 students required a return of Title IV funds and for 5 out of the 6 students, the University did not return funds to the Department of Education within the required time frame. Cause: Although the University has policies and procedures in place over the return of Title IV funds, management indicated that staff turnover, including the resignation of the Director of Financial Aid, resulted in the remaining staff being required to take on additional responsibilities to ensure the continuity of day-to-day functions of the office. In addition, the changes required by the FAFSA simplification act caused the team to be unable to timely comply with the existing policies. Effect: Failure to timely return Title IV funds resulted in noncompliance with the special tests and provisions – return of Title IV funds requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University be more diligent in complying with its established policies and procedures for the return of Title IV funds. Where staffing shortages exist, consider crosstraining staff or temporarily engaging external resources. Views of responsible officials: This issue was initially identified by the University through HPU’s internal monitoring processes. The cause was significant staff turnover within a 6-month period (including the resignation of the Director of Financial Aid). The difficulties of temporarily reduced staffing and loss of institutional knowledge were compounded by the challenges brought by the FAFSA Simplification Act, which required many changes, placing an additional burden on a strained team. Although the University attempted to adhere to its policies and procedures to ensure that R2T4 is processed within the allotted time, the team did not succeed in completing this function. The University replaced key staff, recruited a new Director, and shifted responsibilities so that a specific staff member is responsible for R2T4 processing. These changes have enabled the University to resume processingR2T4 timely, as was accomplished in previous years.

Criteria: 34 CFR 668.164(h)(2) requires that a Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than – (i) 14 days after the balance occurred if the credit balance occurred after the first day of class or a payment period; or (ii) 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition: The University did not pay Title IV credit balances to 3 students or parents in a timely manner. Context: We selected a non-statistical sample of 60 students with disbursements for special tests and provisions – disbursements to or on behalf of students testing, of which 41 students had Title IV credit balances. For 3 out of the 41 credit balances, payments to the student or parent were made after the 14-day requirement. The 3 instances were related to credit balances that were created in December 2023 and paid out in January 2024. Cause: Although the University has policies and procedures in place for the payment of Title IV credit balances, there was a failure to follow its policies and procedures. Management indicated that the credit balances were created in December, directly preceding the University’s holiday break. The University is closed during this period and staffing is generally limited. Management followed its ordinary procedures to pause disbursements prior to break to ensure the credit balances are paid to students or parents in a timely manner. However, one staff member was unaware of this requirement and manually disbursed aid resulting in credit balances for 3 students which required repayment during the holiday break. Effect: Failure to timely pay Title IV credit balances to students or parents resulted in noncompliance with the special tests and provisions – disbursements to or on behalf of students requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University establish clear procedures to ensure timely and effective communication with staff regarding alternative disbursement schedules. Views of responsible officials: The University has an automated process in place to disburse aid daily. That process is set to stop on a certain day before the University’s scheduled Winter Break to allow the refund processing team time to generate and distribute refunds within the allotted timeframe and maintain compliant with related regulations despite the University’s scheduled closure. According to established procedures, the process was stopped as scheduled. However, one of the University’s Financial Aid Counselors manually authorized and disbursed aid for a small number of students after the process was halted for the semester because they were unaware of the reason why aid was not disbursing, and they were attempting to help students who were calling the Financial Aid office. Once management became aware of this issue, the Director of Financial Aid immediately approached the staff member and explained the reason why the University stopped making disbursements. The Director instructed the team member to not override these established controls and explained the importance of adhering to the policies in place. The staff member acknowledged that they understood the consequences of their actions and the need to adhere to policies. In the future, the University will take extra steps to communicate with all team members when this control is initiated prior to Winter Break to ensure collective understanding of the reason for pausing disbursement.

Criteria: 16 CFR Part 314 requires the University to implement information safeguard standards prescribed by the Gramm-Leach-Bliley Act (GLBA). GLBA requires institutions and servicers to develop, implement, and maintain a written, comprehensive information security program which contains administrative, technical, and physical safeguards that are appropriate to the size and complexity of the institution or servicer, the nature and scope of their activities, and the sensitivity of any student information. An institution’s written information security program must include the following elements: • Element 1: Designates a Qualified Individual responsible for overseeing and implementing the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)). • Element 2: Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)). • Element 3: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8). • Element 4: Provides for the institution or servicer to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 C.F.R. 314.4(d)). • Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)) • Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)). • Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)). • Element 8: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the establishment of an incident response plan (16 C.F.R. 314.4(h)). • Element 9: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the requirement for its Qualified Individual to report regularly and at least annually to those with control over the institution on the institution’s information security program (16 C.F.R. 314.4(i)). Context: We conducted inquiries with the University’s Information Security Officer to determine whether the University had a written information security program that addressed the elements required by GLBA. Although the University has a designated security officer (i.e. Qualified Individual), management confirmed that the University did not have a written comprehensive program in place as prescribed by the GLBA. Cause: Management indicated there was a lack of awareness regarding the requirement to establish an information security program that addressed the required elements. Effect: The University was not in compliance with the GLBA requirement which could result in administrative action by the Department of Education and may impact the University’s participation in Title IV programs. Questioned Costs: None Identification of repeat finding: N/A. Recommendations: We recommend the University develop and implement an Information Security Program that includes the required elements prescribed by GLBA. The University should develop and retain documentation supporting the completion and implementation of each of the required elements. Once completed, the University should conduct periodic internal assessments of the Information Security Programs’ compliance or consider engaging a third-party consultant to conduct such a review. Views of responsible officials: The Information Security Officer has developed a comprehensive project plan to implement the core 9 elements as listed under FTC Safeguards. The plan is backed by HPU’s 3rd party risk assessment conducted in November of 2024. The addition of a new hire and a part-time resource has facilitated significant progress. Budget for necessary tools, software, and services such as penetration testing are being actively quoted for review by the Budget Office and CFO for both current and future fiscal years. Checkpoints have been established every two weeks to review and confirm substantial progress towards meeting all requirements and address any barriers or setbacks that may occur. The Vice President of Operations and CIO will review the progress support efforts to meet the requirements and targeted delivery date. The HPU Cybersecurity Committee will be provided with the 2024 Risk Assessment and the Information Security Program documentation and policies for both initial and ongoing review of the programs with the objective to further strengthen the program beyond minimum requirement.

Criteria: 34 CFR 668.22(j)(1) requires the University to return the amount of Title IV funds for which it is responsible as soon as possible, but no later than 45 days after the date of the University’s determination that the student withdrew. Condition: The University did not return all Title IV funds in a timely manner. Context: We selected a non-statistical sample of 8 students out of a population of 68 students who withdrew during the year and had Title IV funds disbursed. We noted 6 out of 8 students required a return of Title IV funds and for 5 out of the 6 students, the University did not return funds to the Department of Education within the required time frame. Cause: Although the University has policies and procedures in place over the return of Title IV funds, management indicated that staff turnover, including the resignation of the Director of Financial Aid, resulted in the remaining staff being required to take on additional responsibilities to ensure the continuity of day-to-day functions of the office. In addition, the changes required by the FAFSA simplification act caused the team to be unable to timely comply with the existing policies. Effect: Failure to timely return Title IV funds resulted in noncompliance with the special tests and provisions – return of Title IV funds requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University be more diligent in complying with its established policies and procedures for the return of Title IV funds. Where staffing shortages exist, consider crosstraining staff or temporarily engaging external resources. Views of responsible officials: This issue was initially identified by the University through HPU’s internal monitoring processes. The cause was significant staff turnover within a 6-month period (including the resignation of the Director of Financial Aid). The difficulties of temporarily reduced staffing and loss of institutional knowledge were compounded by the challenges brought by the FAFSA Simplification Act, which required many changes, placing an additional burden on a strained team. Although the University attempted to adhere to its policies and procedures to ensure that R2T4 is processed within the allotted time, the team did not succeed in completing this function. The University replaced key staff, recruited a new Director, and shifted responsibilities so that a specific staff member is responsible for R2T4 processing. These changes have enabled the University to resume processingR2T4 timely, as was accomplished in previous years.

Criteria: 34 CFR 668.164(h)(2) requires that a Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than – (i) 14 days after the balance occurred if the credit balance occurred after the first day of class or a payment period; or (ii) 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition: The University did not pay Title IV credit balances to 3 students or parents in a timely manner. Context: We selected a non-statistical sample of 60 students with disbursements for special tests and provisions – disbursements to or on behalf of students testing, of which 41 students had Title IV credit balances. For 3 out of the 41 credit balances, payments to the student or parent were made after the 14-day requirement. The 3 instances were related to credit balances that were created in December 2023 and paid out in January 2024. Cause: Although the University has policies and procedures in place for the payment of Title IV credit balances, there was a failure to follow its policies and procedures. Management indicated that the credit balances were created in December, directly preceding the University’s holiday break. The University is closed during this period and staffing is generally limited. Management followed its ordinary procedures to pause disbursements prior to break to ensure the credit balances are paid to students or parents in a timely manner. However, one staff member was unaware of this requirement and manually disbursed aid resulting in credit balances for 3 students which required repayment during the holiday break. Effect: Failure to timely pay Title IV credit balances to students or parents resulted in noncompliance with the special tests and provisions – disbursements to or on behalf of students requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University establish clear procedures to ensure timely and effective communication with staff regarding alternative disbursement schedules. Views of responsible officials: The University has an automated process in place to disburse aid daily. That process is set to stop on a certain day before the University’s scheduled Winter Break to allow the refund processing team time to generate and distribute refunds within the allotted timeframe and maintain compliant with related regulations despite the University’s scheduled closure. According to established procedures, the process was stopped as scheduled. However, one of the University’s Financial Aid Counselors manually authorized and disbursed aid for a small number of students after the process was halted for the semester because they were unaware of the reason why aid was not disbursing, and they were attempting to help students who were calling the Financial Aid office. Once management became aware of this issue, the Director of Financial Aid immediately approached the staff member and explained the reason why the University stopped making disbursements. The Director instructed the team member to not override these established controls and explained the importance of adhering to the policies in place. The staff member acknowledged that they understood the consequences of their actions and the need to adhere to policies. In the future, the University will take extra steps to communicate with all team members when this control is initiated prior to Winter Break to ensure collective understanding of the reason for pausing disbursement.

Criteria: 16 CFR Part 314 requires the University to implement information safeguard standards prescribed by the Gramm-Leach-Bliley Act (GLBA). GLBA requires institutions and servicers to develop, implement, and maintain a written, comprehensive information security program which contains administrative, technical, and physical safeguards that are appropriate to the size and complexity of the institution or servicer, the nature and scope of their activities, and the sensitivity of any student information. An institution’s written information security program must include the following elements: • Element 1: Designates a Qualified Individual responsible for overseeing and implementing the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)). • Element 2: Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)). • Element 3: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8). • Element 4: Provides for the institution or servicer to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 C.F.R. 314.4(d)). • Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)) • Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)). • Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)). • Element 8: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the establishment of an incident response plan (16 C.F.R. 314.4(h)). • Element 9: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the requirement for its Qualified Individual to report regularly and at least annually to those with control over the institution on the institution’s information security program (16 C.F.R. 314.4(i)). Context: We conducted inquiries with the University’s Information Security Officer to determine whether the University had a written information security program that addressed the elements required by GLBA. Although the University has a designated security officer (i.e. Qualified Individual), management confirmed that the University did not have a written comprehensive program in place as prescribed by the GLBA. Cause: Management indicated there was a lack of awareness regarding the requirement to establish an information security program that addressed the required elements. Effect: The University was not in compliance with the GLBA requirement which could result in administrative action by the Department of Education and may impact the University’s participation in Title IV programs. Questioned Costs: None Identification of repeat finding: N/A. Recommendations: We recommend the University develop and implement an Information Security Program that includes the required elements prescribed by GLBA. The University should develop and retain documentation supporting the completion and implementation of each of the required elements. Once completed, the University should conduct periodic internal assessments of the Information Security Programs’ compliance or consider engaging a third-party consultant to conduct such a review. Views of responsible officials: The Information Security Officer has developed a comprehensive project plan to implement the core 9 elements as listed under FTC Safeguards. The plan is backed by HPU’s 3rd party risk assessment conducted in November of 2024. The addition of a new hire and a part-time resource has facilitated significant progress. Budget for necessary tools, software, and services such as penetration testing are being actively quoted for review by the Budget Office and CFO for both current and future fiscal years. Checkpoints have been established every two weeks to review and confirm substantial progress towards meeting all requirements and address any barriers or setbacks that may occur. The Vice President of Operations and CIO will review the progress support efforts to meet the requirements and targeted delivery date. The HPU Cybersecurity Committee will be provided with the 2024 Risk Assessment and the Information Security Program documentation and policies for both initial and ongoing review of the programs with the objective to further strengthen the program beyond minimum requirement.

Criteria: 34 CFR 668.22(j)(1) requires the University to return the amount of Title IV funds for which it is responsible as soon as possible, but no later than 45 days after the date of the University’s determination that the student withdrew. Condition: The University did not return all Title IV funds in a timely manner. Context: We selected a non-statistical sample of 8 students out of a population of 68 students who withdrew during the year and had Title IV funds disbursed. We noted 6 out of 8 students required a return of Title IV funds and for 5 out of the 6 students, the University did not return funds to the Department of Education within the required time frame. Cause: Although the University has policies and procedures in place over the return of Title IV funds, management indicated that staff turnover, including the resignation of the Director of Financial Aid, resulted in the remaining staff being required to take on additional responsibilities to ensure the continuity of day-to-day functions of the office. In addition, the changes required by the FAFSA simplification act caused the team to be unable to timely comply with the existing policies. Effect: Failure to timely return Title IV funds resulted in noncompliance with the special tests and provisions – return of Title IV funds requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University be more diligent in complying with its established policies and procedures for the return of Title IV funds. Where staffing shortages exist, consider crosstraining staff or temporarily engaging external resources. Views of responsible officials: This issue was initially identified by the University through HPU’s internal monitoring processes. The cause was significant staff turnover within a 6-month period (including the resignation of the Director of Financial Aid). The difficulties of temporarily reduced staffing and loss of institutional knowledge were compounded by the challenges brought by the FAFSA Simplification Act, which required many changes, placing an additional burden on a strained team. Although the University attempted to adhere to its policies and procedures to ensure that R2T4 is processed within the allotted time, the team did not succeed in completing this function. The University replaced key staff, recruited a new Director, and shifted responsibilities so that a specific staff member is responsible for R2T4 processing. These changes have enabled the University to resume processingR2T4 timely, as was accomplished in previous years.

Criteria: 34 CFR 668.164(h)(2) requires that a Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than – (i) 14 days after the balance occurred if the credit balance occurred after the first day of class or a payment period; or (ii) 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition: The University did not pay Title IV credit balances to 3 students or parents in a timely manner. Context: We selected a non-statistical sample of 60 students with disbursements for special tests and provisions – disbursements to or on behalf of students testing, of which 41 students had Title IV credit balances. For 3 out of the 41 credit balances, payments to the student or parent were made after the 14-day requirement. The 3 instances were related to credit balances that were created in December 2023 and paid out in January 2024. Cause: Although the University has policies and procedures in place for the payment of Title IV credit balances, there was a failure to follow its policies and procedures. Management indicated that the credit balances were created in December, directly preceding the University’s holiday break. The University is closed during this period and staffing is generally limited. Management followed its ordinary procedures to pause disbursements prior to break to ensure the credit balances are paid to students or parents in a timely manner. However, one staff member was unaware of this requirement and manually disbursed aid resulting in credit balances for 3 students which required repayment during the holiday break. Effect: Failure to timely pay Title IV credit balances to students or parents resulted in noncompliance with the special tests and provisions – disbursements to or on behalf of students requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University establish clear procedures to ensure timely and effective communication with staff regarding alternative disbursement schedules. Views of responsible officials: The University has an automated process in place to disburse aid daily. That process is set to stop on a certain day before the University’s scheduled Winter Break to allow the refund processing team time to generate and distribute refunds within the allotted timeframe and maintain compliant with related regulations despite the University’s scheduled closure. According to established procedures, the process was stopped as scheduled. However, one of the University’s Financial Aid Counselors manually authorized and disbursed aid for a small number of students after the process was halted for the semester because they were unaware of the reason why aid was not disbursing, and they were attempting to help students who were calling the Financial Aid office. Once management became aware of this issue, the Director of Financial Aid immediately approached the staff member and explained the reason why the University stopped making disbursements. The Director instructed the team member to not override these established controls and explained the importance of adhering to the policies in place. The staff member acknowledged that they understood the consequences of their actions and the need to adhere to policies. In the future, the University will take extra steps to communicate with all team members when this control is initiated prior to Winter Break to ensure collective understanding of the reason for pausing disbursement.

Criteria: 16 CFR Part 314 requires the University to implement information safeguard standards prescribed by the Gramm-Leach-Bliley Act (GLBA). GLBA requires institutions and servicers to develop, implement, and maintain a written, comprehensive information security program which contains administrative, technical, and physical safeguards that are appropriate to the size and complexity of the institution or servicer, the nature and scope of their activities, and the sensitivity of any student information. An institution’s written information security program must include the following elements: • Element 1: Designates a Qualified Individual responsible for overseeing and implementing the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)). • Element 2: Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)). • Element 3: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8). • Element 4: Provides for the institution or servicer to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 C.F.R. 314.4(d)). • Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)) • Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)). • Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)). • Element 8: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the establishment of an incident response plan (16 C.F.R. 314.4(h)). • Element 9: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the requirement for its Qualified Individual to report regularly and at least annually to those with control over the institution on the institution’s information security program (16 C.F.R. 314.4(i)). Context: We conducted inquiries with the University’s Information Security Officer to determine whether the University had a written information security program that addressed the elements required by GLBA. Although the University has a designated security officer (i.e. Qualified Individual), management confirmed that the University did not have a written comprehensive program in place as prescribed by the GLBA. Cause: Management indicated there was a lack of awareness regarding the requirement to establish an information security program that addressed the required elements. Effect: The University was not in compliance with the GLBA requirement which could result in administrative action by the Department of Education and may impact the University’s participation in Title IV programs. Questioned Costs: None Identification of repeat finding: N/A. Recommendations: We recommend the University develop and implement an Information Security Program that includes the required elements prescribed by GLBA. The University should develop and retain documentation supporting the completion and implementation of each of the required elements. Once completed, the University should conduct periodic internal assessments of the Information Security Programs’ compliance or consider engaging a third-party consultant to conduct such a review. Views of responsible officials: The Information Security Officer has developed a comprehensive project plan to implement the core 9 elements as listed under FTC Safeguards. The plan is backed by HPU’s 3rd party risk assessment conducted in November of 2024. The addition of a new hire and a part-time resource has facilitated significant progress. Budget for necessary tools, software, and services such as penetration testing are being actively quoted for review by the Budget Office and CFO for both current and future fiscal years. Checkpoints have been established every two weeks to review and confirm substantial progress towards meeting all requirements and address any barriers or setbacks that may occur. The Vice President of Operations and CIO will review the progress support efforts to meet the requirements and targeted delivery date. The HPU Cybersecurity Committee will be provided with the 2024 Risk Assessment and the Information Security Program documentation and policies for both initial and ongoing review of the programs with the objective to further strengthen the program beyond minimum requirement.

Criteria: 34 CFR 668.22(j)(1) requires the University to return the amount of Title IV funds for which it is responsible as soon as possible, but no later than 45 days after the date of the University’s determination that the student withdrew. Condition: The University did not return all Title IV funds in a timely manner. Context: We selected a non-statistical sample of 8 students out of a population of 68 students who withdrew during the year and had Title IV funds disbursed. We noted 6 out of 8 students required a return of Title IV funds and for 5 out of the 6 students, the University did not return funds to the Department of Education within the required time frame. Cause: Although the University has policies and procedures in place over the return of Title IV funds, management indicated that staff turnover, including the resignation of the Director of Financial Aid, resulted in the remaining staff being required to take on additional responsibilities to ensure the continuity of day-to-day functions of the office. In addition, the changes required by the FAFSA simplification act caused the team to be unable to timely comply with the existing policies. Effect: Failure to timely return Title IV funds resulted in noncompliance with the special tests and provisions – return of Title IV funds requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University be more diligent in complying with its established policies and procedures for the return of Title IV funds. Where staffing shortages exist, consider crosstraining staff or temporarily engaging external resources. Views of responsible officials: This issue was initially identified by the University through HPU’s internal monitoring processes. The cause was significant staff turnover within a 6-month period (including the resignation of the Director of Financial Aid). The difficulties of temporarily reduced staffing and loss of institutional knowledge were compounded by the challenges brought by the FAFSA Simplification Act, which required many changes, placing an additional burden on a strained team. Although the University attempted to adhere to its policies and procedures to ensure that R2T4 is processed within the allotted time, the team did not succeed in completing this function. The University replaced key staff, recruited a new Director, and shifted responsibilities so that a specific staff member is responsible for R2T4 processing. These changes have enabled the University to resume processingR2T4 timely, as was accomplished in previous years.

Criteria: 34 CFR 668.164(h)(2) requires that a Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than – (i) 14 days after the balance occurred if the credit balance occurred after the first day of class or a payment period; or (ii) 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition: The University did not pay Title IV credit balances to 3 students or parents in a timely manner. Context: We selected a non-statistical sample of 60 students with disbursements for special tests and provisions – disbursements to or on behalf of students testing, of which 41 students had Title IV credit balances. For 3 out of the 41 credit balances, payments to the student or parent were made after the 14-day requirement. The 3 instances were related to credit balances that were created in December 2023 and paid out in January 2024. Cause: Although the University has policies and procedures in place for the payment of Title IV credit balances, there was a failure to follow its policies and procedures. Management indicated that the credit balances were created in December, directly preceding the University’s holiday break. The University is closed during this period and staffing is generally limited. Management followed its ordinary procedures to pause disbursements prior to break to ensure the credit balances are paid to students or parents in a timely manner. However, one staff member was unaware of this requirement and manually disbursed aid resulting in credit balances for 3 students which required repayment during the holiday break. Effect: Failure to timely pay Title IV credit balances to students or parents resulted in noncompliance with the special tests and provisions – disbursements to or on behalf of students requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University establish clear procedures to ensure timely and effective communication with staff regarding alternative disbursement schedules. Views of responsible officials: The University has an automated process in place to disburse aid daily. That process is set to stop on a certain day before the University’s scheduled Winter Break to allow the refund processing team time to generate and distribute refunds within the allotted timeframe and maintain compliant with related regulations despite the University’s scheduled closure. According to established procedures, the process was stopped as scheduled. However, one of the University’s Financial Aid Counselors manually authorized and disbursed aid for a small number of students after the process was halted for the semester because they were unaware of the reason why aid was not disbursing, and they were attempting to help students who were calling the Financial Aid office. Once management became aware of this issue, the Director of Financial Aid immediately approached the staff member and explained the reason why the University stopped making disbursements. The Director instructed the team member to not override these established controls and explained the importance of adhering to the policies in place. The staff member acknowledged that they understood the consequences of their actions and the need to adhere to policies. In the future, the University will take extra steps to communicate with all team members when this control is initiated prior to Winter Break to ensure collective understanding of the reason for pausing disbursement.

Criteria: 16 CFR Part 314 requires the University to implement information safeguard standards prescribed by the Gramm-Leach-Bliley Act (GLBA). GLBA requires institutions and servicers to develop, implement, and maintain a written, comprehensive information security program which contains administrative, technical, and physical safeguards that are appropriate to the size and complexity of the institution or servicer, the nature and scope of their activities, and the sensitivity of any student information. An institution’s written information security program must include the following elements: • Element 1: Designates a Qualified Individual responsible for overseeing and implementing the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)). • Element 2: Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)). • Element 3: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8). • Element 4: Provides for the institution or servicer to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 C.F.R. 314.4(d)). • Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)) • Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)). • Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)). • Element 8: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the establishment of an incident response plan (16 C.F.R. 314.4(h)). • Element 9: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the requirement for its Qualified Individual to report regularly and at least annually to those with control over the institution on the institution’s information security program (16 C.F.R. 314.4(i)). Context: We conducted inquiries with the University’s Information Security Officer to determine whether the University had a written information security program that addressed the elements required by GLBA. Although the University has a designated security officer (i.e. Qualified Individual), management confirmed that the University did not have a written comprehensive program in place as prescribed by the GLBA. Cause: Management indicated there was a lack of awareness regarding the requirement to establish an information security program that addressed the required elements. Effect: The University was not in compliance with the GLBA requirement which could result in administrative action by the Department of Education and may impact the University’s participation in Title IV programs. Questioned Costs: None Identification of repeat finding: N/A. Recommendations: We recommend the University develop and implement an Information Security Program that includes the required elements prescribed by GLBA. The University should develop and retain documentation supporting the completion and implementation of each of the required elements. Once completed, the University should conduct periodic internal assessments of the Information Security Programs’ compliance or consider engaging a third-party consultant to conduct such a review. Views of responsible officials: The Information Security Officer has developed a comprehensive project plan to implement the core 9 elements as listed under FTC Safeguards. The plan is backed by HPU’s 3rd party risk assessment conducted in November of 2024. The addition of a new hire and a part-time resource has facilitated significant progress. Budget for necessary tools, software, and services such as penetration testing are being actively quoted for review by the Budget Office and CFO for both current and future fiscal years. Checkpoints have been established every two weeks to review and confirm substantial progress towards meeting all requirements and address any barriers or setbacks that may occur. The Vice President of Operations and CIO will review the progress support efforts to meet the requirements and targeted delivery date. The HPU Cybersecurity Committee will be provided with the 2024 Risk Assessment and the Information Security Program documentation and policies for both initial and ongoing review of the programs with the objective to further strengthen the program beyond minimum requirement.

Criteria: 34 CFR 668.22(j)(1) requires the University to return the amount of Title IV funds for which it is responsible as soon as possible, but no later than 45 days after the date of the University’s determination that the student withdrew. Condition: The University did not return all Title IV funds in a timely manner. Context: We selected a non-statistical sample of 8 students out of a population of 68 students who withdrew during the year and had Title IV funds disbursed. We noted 6 out of 8 students required a return of Title IV funds and for 5 out of the 6 students, the University did not return funds to the Department of Education within the required time frame. Cause: Although the University has policies and procedures in place over the return of Title IV funds, management indicated that staff turnover, including the resignation of the Director of Financial Aid, resulted in the remaining staff being required to take on additional responsibilities to ensure the continuity of day-to-day functions of the office. In addition, the changes required by the FAFSA simplification act caused the team to be unable to timely comply with the existing policies. Effect: Failure to timely return Title IV funds resulted in noncompliance with the special tests and provisions – return of Title IV funds requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University be more diligent in complying with its established policies and procedures for the return of Title IV funds. Where staffing shortages exist, consider crosstraining staff or temporarily engaging external resources. Views of responsible officials: This issue was initially identified by the University through HPU’s internal monitoring processes. The cause was significant staff turnover within a 6-month period (including the resignation of the Director of Financial Aid). The difficulties of temporarily reduced staffing and loss of institutional knowledge were compounded by the challenges brought by the FAFSA Simplification Act, which required many changes, placing an additional burden on a strained team. Although the University attempted to adhere to its policies and procedures to ensure that R2T4 is processed within the allotted time, the team did not succeed in completing this function. The University replaced key staff, recruited a new Director, and shifted responsibilities so that a specific staff member is responsible for R2T4 processing. These changes have enabled the University to resume processingR2T4 timely, as was accomplished in previous years.

Criteria: 34 CFR 668.164(h)(2) requires that a Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than – (i) 14 days after the balance occurred if the credit balance occurred after the first day of class or a payment period; or (ii) 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition: The University did not pay Title IV credit balances to 3 students or parents in a timely manner. Context: We selected a non-statistical sample of 60 students with disbursements for special tests and provisions – disbursements to or on behalf of students testing, of which 41 students had Title IV credit balances. For 3 out of the 41 credit balances, payments to the student or parent were made after the 14-day requirement. The 3 instances were related to credit balances that were created in December 2023 and paid out in January 2024. Cause: Although the University has policies and procedures in place for the payment of Title IV credit balances, there was a failure to follow its policies and procedures. Management indicated that the credit balances were created in December, directly preceding the University’s holiday break. The University is closed during this period and staffing is generally limited. Management followed its ordinary procedures to pause disbursements prior to break to ensure the credit balances are paid to students or parents in a timely manner. However, one staff member was unaware of this requirement and manually disbursed aid resulting in credit balances for 3 students which required repayment during the holiday break. Effect: Failure to timely pay Title IV credit balances to students or parents resulted in noncompliance with the special tests and provisions – disbursements to or on behalf of students requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University establish clear procedures to ensure timely and effective communication with staff regarding alternative disbursement schedules. Views of responsible officials: The University has an automated process in place to disburse aid daily. That process is set to stop on a certain day before the University’s scheduled Winter Break to allow the refund processing team time to generate and distribute refunds within the allotted timeframe and maintain compliant with related regulations despite the University’s scheduled closure. According to established procedures, the process was stopped as scheduled. However, one of the University’s Financial Aid Counselors manually authorized and disbursed aid for a small number of students after the process was halted for the semester because they were unaware of the reason why aid was not disbursing, and they were attempting to help students who were calling the Financial Aid office. Once management became aware of this issue, the Director of Financial Aid immediately approached the staff member and explained the reason why the University stopped making disbursements. The Director instructed the team member to not override these established controls and explained the importance of adhering to the policies in place. The staff member acknowledged that they understood the consequences of their actions and the need to adhere to policies. In the future, the University will take extra steps to communicate with all team members when this control is initiated prior to Winter Break to ensure collective understanding of the reason for pausing disbursement.

Criteria: 16 CFR Part 314 requires the University to implement information safeguard standards prescribed by the Gramm-Leach-Bliley Act (GLBA). GLBA requires institutions and servicers to develop, implement, and maintain a written, comprehensive information security program which contains administrative, technical, and physical safeguards that are appropriate to the size and complexity of the institution or servicer, the nature and scope of their activities, and the sensitivity of any student information. An institution’s written information security program must include the following elements: • Element 1: Designates a Qualified Individual responsible for overseeing and implementing the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)). • Element 2: Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)). • Element 3: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8). • Element 4: Provides for the institution or servicer to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 C.F.R. 314.4(d)). • Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)) • Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)). • Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)). • Element 8: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the establishment of an incident response plan (16 C.F.R. 314.4(h)). • Element 9: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the requirement for its Qualified Individual to report regularly and at least annually to those with control over the institution on the institution’s information security program (16 C.F.R. 314.4(i)). Context: We conducted inquiries with the University’s Information Security Officer to determine whether the University had a written information security program that addressed the elements required by GLBA. Although the University has a designated security officer (i.e. Qualified Individual), management confirmed that the University did not have a written comprehensive program in place as prescribed by the GLBA. Cause: Management indicated there was a lack of awareness regarding the requirement to establish an information security program that addressed the required elements. Effect: The University was not in compliance with the GLBA requirement which could result in administrative action by the Department of Education and may impact the University’s participation in Title IV programs. Questioned Costs: None Identification of repeat finding: N/A. Recommendations: We recommend the University develop and implement an Information Security Program that includes the required elements prescribed by GLBA. The University should develop and retain documentation supporting the completion and implementation of each of the required elements. Once completed, the University should conduct periodic internal assessments of the Information Security Programs’ compliance or consider engaging a third-party consultant to conduct such a review. Views of responsible officials: The Information Security Officer has developed a comprehensive project plan to implement the core 9 elements as listed under FTC Safeguards. The plan is backed by HPU’s 3rd party risk assessment conducted in November of 2024. The addition of a new hire and a part-time resource has facilitated significant progress. Budget for necessary tools, software, and services such as penetration testing are being actively quoted for review by the Budget Office and CFO for both current and future fiscal years. Checkpoints have been established every two weeks to review and confirm substantial progress towards meeting all requirements and address any barriers or setbacks that may occur. The Vice President of Operations and CIO will review the progress support efforts to meet the requirements and targeted delivery date. The HPU Cybersecurity Committee will be provided with the 2024 Risk Assessment and the Information Security Program documentation and policies for both initial and ongoing review of the programs with the objective to further strengthen the program beyond minimum requirement.

Criteria: 34 CFR 668.22(j)(1) requires the University to return the amount of Title IV funds for which it is responsible as soon as possible, but no later than 45 days after the date of the University’s determination that the student withdrew. Condition: The University did not return all Title IV funds in a timely manner. Context: We selected a non-statistical sample of 8 students out of a population of 68 students who withdrew during the year and had Title IV funds disbursed. We noted 6 out of 8 students required a return of Title IV funds and for 5 out of the 6 students, the University did not return funds to the Department of Education within the required time frame. Cause: Although the University has policies and procedures in place over the return of Title IV funds, management indicated that staff turnover, including the resignation of the Director of Financial Aid, resulted in the remaining staff being required to take on additional responsibilities to ensure the continuity of day-to-day functions of the office. In addition, the changes required by the FAFSA simplification act caused the team to be unable to timely comply with the existing policies. Effect: Failure to timely return Title IV funds resulted in noncompliance with the special tests and provisions – return of Title IV funds requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University be more diligent in complying with its established policies and procedures for the return of Title IV funds. Where staffing shortages exist, consider crosstraining staff or temporarily engaging external resources. Views of responsible officials: This issue was initially identified by the University through HPU’s internal monitoring processes. The cause was significant staff turnover within a 6-month period (including the resignation of the Director of Financial Aid). The difficulties of temporarily reduced staffing and loss of institutional knowledge were compounded by the challenges brought by the FAFSA Simplification Act, which required many changes, placing an additional burden on a strained team. Although the University attempted to adhere to its policies and procedures to ensure that R2T4 is processed within the allotted time, the team did not succeed in completing this function. The University replaced key staff, recruited a new Director, and shifted responsibilities so that a specific staff member is responsible for R2T4 processing. These changes have enabled the University to resume processingR2T4 timely, as was accomplished in previous years.

Criteria: 34 CFR 668.164(h)(2) requires that a Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than – (i) 14 days after the balance occurred if the credit balance occurred after the first day of class or a payment period; or (ii) 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition: The University did not pay Title IV credit balances to 3 students or parents in a timely manner. Context: We selected a non-statistical sample of 60 students with disbursements for special tests and provisions – disbursements to or on behalf of students testing, of which 41 students had Title IV credit balances. For 3 out of the 41 credit balances, payments to the student or parent were made after the 14-day requirement. The 3 instances were related to credit balances that were created in December 2023 and paid out in January 2024. Cause: Although the University has policies and procedures in place for the payment of Title IV credit balances, there was a failure to follow its policies and procedures. Management indicated that the credit balances were created in December, directly preceding the University’s holiday break. The University is closed during this period and staffing is generally limited. Management followed its ordinary procedures to pause disbursements prior to break to ensure the credit balances are paid to students or parents in a timely manner. However, one staff member was unaware of this requirement and manually disbursed aid resulting in credit balances for 3 students which required repayment during the holiday break. Effect: Failure to timely pay Title IV credit balances to students or parents resulted in noncompliance with the special tests and provisions – disbursements to or on behalf of students requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University establish clear procedures to ensure timely and effective communication with staff regarding alternative disbursement schedules. Views of responsible officials: The University has an automated process in place to disburse aid daily. That process is set to stop on a certain day before the University’s scheduled Winter Break to allow the refund processing team time to generate and distribute refunds within the allotted timeframe and maintain compliant with related regulations despite the University’s scheduled closure. According to established procedures, the process was stopped as scheduled. However, one of the University’s Financial Aid Counselors manually authorized and disbursed aid for a small number of students after the process was halted for the semester because they were unaware of the reason why aid was not disbursing, and they were attempting to help students who were calling the Financial Aid office. Once management became aware of this issue, the Director of Financial Aid immediately approached the staff member and explained the reason why the University stopped making disbursements. The Director instructed the team member to not override these established controls and explained the importance of adhering to the policies in place. The staff member acknowledged that they understood the consequences of their actions and the need to adhere to policies. In the future, the University will take extra steps to communicate with all team members when this control is initiated prior to Winter Break to ensure collective understanding of the reason for pausing disbursement.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 16 CFR Part 314 requires the University to implement information safeguard standards prescribed by the Gramm-Leach-Bliley Act (GLBA). GLBA requires institutions and servicers to develop, implement, and maintain a written, comprehensive information security program which contains administrative, technical, and physical safeguards that are appropriate to the size and complexity of the institution or servicer, the nature and scope of their activities, and the sensitivity of any student information. An institution’s written information security program must include the following elements: • Element 1: Designates a Qualified Individual responsible for overseeing and implementing the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)). • Element 2: Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)). • Element 3: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8). • Element 4: Provides for the institution or servicer to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 C.F.R. 314.4(d)). • Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)) • Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)). • Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)). • Element 8: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the establishment of an incident response plan (16 C.F.R. 314.4(h)). • Element 9: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the requirement for its Qualified Individual to report regularly and at least annually to those with control over the institution on the institution’s information security program (16 C.F.R. 314.4(i)). Context: We conducted inquiries with the University’s Information Security Officer to determine whether the University had a written information security program that addressed the elements required by GLBA. Although the University has a designated security officer (i.e. Qualified Individual), management confirmed that the University did not have a written comprehensive program in place as prescribed by the GLBA. Cause: Management indicated there was a lack of awareness regarding the requirement to establish an information security program that addressed the required elements. Effect: The University was not in compliance with the GLBA requirement which could result in administrative action by the Department of Education and may impact the University’s participation in Title IV programs. Questioned Costs: None Identification of repeat finding: N/A. Recommendations: We recommend the University develop and implement an Information Security Program that includes the required elements prescribed by GLBA. The University should develop and retain documentation supporting the completion and implementation of each of the required elements. Once completed, the University should conduct periodic internal assessments of the Information Security Programs’ compliance or consider engaging a third-party consultant to conduct such a review. Views of responsible officials: The Information Security Officer has developed a comprehensive project plan to implement the core 9 elements as listed under FTC Safeguards. The plan is backed by HPU’s 3rd party risk assessment conducted in November of 2024. The addition of a new hire and a part-time resource has facilitated significant progress. Budget for necessary tools, software, and services such as penetration testing are being actively quoted for review by the Budget Office and CFO for both current and future fiscal years. Checkpoints have been established every two weeks to review and confirm substantial progress towards meeting all requirements and address any barriers or setbacks that may occur. The Vice President of Operations and CIO will review the progress support efforts to meet the requirements and targeted delivery date. The HPU Cybersecurity Committee will be provided with the 2024 Risk Assessment and the Information Security Program documentation and policies for both initial and ongoing review of the programs with the objective to further strengthen the program beyond minimum requirement.

Criteria: 34 CFR 668.22(j)(1) requires the University to return the amount of Title IV funds for which it is responsible as soon as possible, but no later than 45 days after the date of the University’s determination that the student withdrew. Condition: The University did not return all Title IV funds in a timely manner. Context: We selected a non-statistical sample of 8 students out of a population of 68 students who withdrew during the year and had Title IV funds disbursed. We noted 6 out of 8 students required a return of Title IV funds and for 5 out of the 6 students, the University did not return funds to the Department of Education within the required time frame. Cause: Although the University has policies and procedures in place over the return of Title IV funds, management indicated that staff turnover, including the resignation of the Director of Financial Aid, resulted in the remaining staff being required to take on additional responsibilities to ensure the continuity of day-to-day functions of the office. In addition, the changes required by the FAFSA simplification act caused the team to be unable to timely comply with the existing policies. Effect: Failure to timely return Title IV funds resulted in noncompliance with the special tests and provisions – return of Title IV funds requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University be more diligent in complying with its established policies and procedures for the return of Title IV funds. Where staffing shortages exist, consider crosstraining staff or temporarily engaging external resources. Views of responsible officials: This issue was initially identified by the University through HPU’s internal monitoring processes. The cause was significant staff turnover within a 6-month period (including the resignation of the Director of Financial Aid). The difficulties of temporarily reduced staffing and loss of institutional knowledge were compounded by the challenges brought by the FAFSA Simplification Act, which required many changes, placing an additional burden on a strained team. Although the University attempted to adhere to its policies and procedures to ensure that R2T4 is processed within the allotted time, the team did not succeed in completing this function. The University replaced key staff, recruited a new Director, and shifted responsibilities so that a specific staff member is responsible for R2T4 processing. These changes have enabled the University to resume processingR2T4 timely, as was accomplished in previous years.

Criteria: 34 CFR 668.164(h)(2) requires that a Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than – (i) 14 days after the balance occurred if the credit balance occurred after the first day of class or a payment period; or (ii) 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition: The University did not pay Title IV credit balances to 3 students or parents in a timely manner. Context: We selected a non-statistical sample of 60 students with disbursements for special tests and provisions – disbursements to or on behalf of students testing, of which 41 students had Title IV credit balances. For 3 out of the 41 credit balances, payments to the student or parent were made after the 14-day requirement. The 3 instances were related to credit balances that were created in December 2023 and paid out in January 2024. Cause: Although the University has policies and procedures in place for the payment of Title IV credit balances, there was a failure to follow its policies and procedures. Management indicated that the credit balances were created in December, directly preceding the University’s holiday break. The University is closed during this period and staffing is generally limited. Management followed its ordinary procedures to pause disbursements prior to break to ensure the credit balances are paid to students or parents in a timely manner. However, one staff member was unaware of this requirement and manually disbursed aid resulting in credit balances for 3 students which required repayment during the holiday break. Effect: Failure to timely pay Title IV credit balances to students or parents resulted in noncompliance with the special tests and provisions – disbursements to or on behalf of students requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University establish clear procedures to ensure timely and effective communication with staff regarding alternative disbursement schedules. Views of responsible officials: The University has an automated process in place to disburse aid daily. That process is set to stop on a certain day before the University’s scheduled Winter Break to allow the refund processing team time to generate and distribute refunds within the allotted timeframe and maintain compliant with related regulations despite the University’s scheduled closure. According to established procedures, the process was stopped as scheduled. However, one of the University’s Financial Aid Counselors manually authorized and disbursed aid for a small number of students after the process was halted for the semester because they were unaware of the reason why aid was not disbursing, and they were attempting to help students who were calling the Financial Aid office. Once management became aware of this issue, the Director of Financial Aid immediately approached the staff member and explained the reason why the University stopped making disbursements. The Director instructed the team member to not override these established controls and explained the importance of adhering to the policies in place. The staff member acknowledged that they understood the consequences of their actions and the need to adhere to policies. In the future, the University will take extra steps to communicate with all team members when this control is initiated prior to Winter Break to ensure collective understanding of the reason for pausing disbursement.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 16 CFR Part 314 requires the University to implement information safeguard standards prescribed by the Gramm-Leach-Bliley Act (GLBA). GLBA requires institutions and servicers to develop, implement, and maintain a written, comprehensive information security program which contains administrative, technical, and physical safeguards that are appropriate to the size and complexity of the institution or servicer, the nature and scope of their activities, and the sensitivity of any student information. An institution’s written information security program must include the following elements: • Element 1: Designates a Qualified Individual responsible for overseeing and implementing the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)). • Element 2: Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)). • Element 3: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8). • Element 4: Provides for the institution or servicer to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 C.F.R. 314.4(d)). • Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)) • Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)). • Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)). • Element 8: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the establishment of an incident response plan (16 C.F.R. 314.4(h)). • Element 9: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the requirement for its Qualified Individual to report regularly and at least annually to those with control over the institution on the institution’s information security program (16 C.F.R. 314.4(i)). Context: We conducted inquiries with the University’s Information Security Officer to determine whether the University had a written information security program that addressed the elements required by GLBA. Although the University has a designated security officer (i.e. Qualified Individual), management confirmed that the University did not have a written comprehensive program in place as prescribed by the GLBA. Cause: Management indicated there was a lack of awareness regarding the requirement to establish an information security program that addressed the required elements. Effect: The University was not in compliance with the GLBA requirement which could result in administrative action by the Department of Education and may impact the University’s participation in Title IV programs. Questioned Costs: None Identification of repeat finding: N/A. Recommendations: We recommend the University develop and implement an Information Security Program that includes the required elements prescribed by GLBA. The University should develop and retain documentation supporting the completion and implementation of each of the required elements. Once completed, the University should conduct periodic internal assessments of the Information Security Programs’ compliance or consider engaging a third-party consultant to conduct such a review. Views of responsible officials: The Information Security Officer has developed a comprehensive project plan to implement the core 9 elements as listed under FTC Safeguards. The plan is backed by HPU’s 3rd party risk assessment conducted in November of 2024. The addition of a new hire and a part-time resource has facilitated significant progress. Budget for necessary tools, software, and services such as penetration testing are being actively quoted for review by the Budget Office and CFO for both current and future fiscal years. Checkpoints have been established every two weeks to review and confirm substantial progress towards meeting all requirements and address any barriers or setbacks that may occur. The Vice President of Operations and CIO will review the progress support efforts to meet the requirements and targeted delivery date. The HPU Cybersecurity Committee will be provided with the 2024 Risk Assessment and the Information Security Program documentation and policies for both initial and ongoing review of the programs with the objective to further strengthen the program beyond minimum requirement.

Criteria: 34 CFR 668.22(j)(1) requires the University to return the amount of Title IV funds for which it is responsible as soon as possible, but no later than 45 days after the date of the University’s determination that the student withdrew. Condition: The University did not return all Title IV funds in a timely manner. Context: We selected a non-statistical sample of 8 students out of a population of 68 students who withdrew during the year and had Title IV funds disbursed. We noted 6 out of 8 students required a return of Title IV funds and for 5 out of the 6 students, the University did not return funds to the Department of Education within the required time frame. Cause: Although the University has policies and procedures in place over the return of Title IV funds, management indicated that staff turnover, including the resignation of the Director of Financial Aid, resulted in the remaining staff being required to take on additional responsibilities to ensure the continuity of day-to-day functions of the office. In addition, the changes required by the FAFSA simplification act caused the team to be unable to timely comply with the existing policies. Effect: Failure to timely return Title IV funds resulted in noncompliance with the special tests and provisions – return of Title IV funds requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University be more diligent in complying with its established policies and procedures for the return of Title IV funds. Where staffing shortages exist, consider crosstraining staff or temporarily engaging external resources. Views of responsible officials: This issue was initially identified by the University through HPU’s internal monitoring processes. The cause was significant staff turnover within a 6-month period (including the resignation of the Director of Financial Aid). The difficulties of temporarily reduced staffing and loss of institutional knowledge were compounded by the challenges brought by the FAFSA Simplification Act, which required many changes, placing an additional burden on a strained team. Although the University attempted to adhere to its policies and procedures to ensure that R2T4 is processed within the allotted time, the team did not succeed in completing this function. The University replaced key staff, recruited a new Director, and shifted responsibilities so that a specific staff member is responsible for R2T4 processing. These changes have enabled the University to resume processingR2T4 timely, as was accomplished in previous years.

Criteria: 34 CFR 668.164(h)(2) requires that a Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than – (i) 14 days after the balance occurred if the credit balance occurred after the first day of class or a payment period; or (ii) 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition: The University did not pay Title IV credit balances to 3 students or parents in a timely manner. Context: We selected a non-statistical sample of 60 students with disbursements for special tests and provisions – disbursements to or on behalf of students testing, of which 41 students had Title IV credit balances. For 3 out of the 41 credit balances, payments to the student or parent were made after the 14-day requirement. The 3 instances were related to credit balances that were created in December 2023 and paid out in January 2024. Cause: Although the University has policies and procedures in place for the payment of Title IV credit balances, there was a failure to follow its policies and procedures. Management indicated that the credit balances were created in December, directly preceding the University’s holiday break. The University is closed during this period and staffing is generally limited. Management followed its ordinary procedures to pause disbursements prior to break to ensure the credit balances are paid to students or parents in a timely manner. However, one staff member was unaware of this requirement and manually disbursed aid resulting in credit balances for 3 students which required repayment during the holiday break. Effect: Failure to timely pay Title IV credit balances to students or parents resulted in noncompliance with the special tests and provisions – disbursements to or on behalf of students requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University establish clear procedures to ensure timely and effective communication with staff regarding alternative disbursement schedules. Views of responsible officials: The University has an automated process in place to disburse aid daily. That process is set to stop on a certain day before the University’s scheduled Winter Break to allow the refund processing team time to generate and distribute refunds within the allotted timeframe and maintain compliant with related regulations despite the University’s scheduled closure. According to established procedures, the process was stopped as scheduled. However, one of the University’s Financial Aid Counselors manually authorized and disbursed aid for a small number of students after the process was halted for the semester because they were unaware of the reason why aid was not disbursing, and they were attempting to help students who were calling the Financial Aid office. Once management became aware of this issue, the Director of Financial Aid immediately approached the staff member and explained the reason why the University stopped making disbursements. The Director instructed the team member to not override these established controls and explained the importance of adhering to the policies in place. The staff member acknowledged that they understood the consequences of their actions and the need to adhere to policies. In the future, the University will take extra steps to communicate with all team members when this control is initiated prior to Winter Break to ensure collective understanding of the reason for pausing disbursement.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 16 CFR Part 314 requires the University to implement information safeguard standards prescribed by the Gramm-Leach-Bliley Act (GLBA). GLBA requires institutions and servicers to develop, implement, and maintain a written, comprehensive information security program which contains administrative, technical, and physical safeguards that are appropriate to the size and complexity of the institution or servicer, the nature and scope of their activities, and the sensitivity of any student information. An institution’s written information security program must include the following elements: • Element 1: Designates a Qualified Individual responsible for overseeing and implementing the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)). • Element 2: Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)). • Element 3: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8). • Element 4: Provides for the institution or servicer to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 C.F.R. 314.4(d)). • Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)) • Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)). • Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)). • Element 8: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the establishment of an incident response plan (16 C.F.R. 314.4(h)). • Element 9: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the requirement for its Qualified Individual to report regularly and at least annually to those with control over the institution on the institution’s information security program (16 C.F.R. 314.4(i)). Context: We conducted inquiries with the University’s Information Security Officer to determine whether the University had a written information security program that addressed the elements required by GLBA. Although the University has a designated security officer (i.e. Qualified Individual), management confirmed that the University did not have a written comprehensive program in place as prescribed by the GLBA. Cause: Management indicated there was a lack of awareness regarding the requirement to establish an information security program that addressed the required elements. Effect: The University was not in compliance with the GLBA requirement which could result in administrative action by the Department of Education and may impact the University’s participation in Title IV programs. Questioned Costs: None Identification of repeat finding: N/A. Recommendations: We recommend the University develop and implement an Information Security Program that includes the required elements prescribed by GLBA. The University should develop and retain documentation supporting the completion and implementation of each of the required elements. Once completed, the University should conduct periodic internal assessments of the Information Security Programs’ compliance or consider engaging a third-party consultant to conduct such a review. Views of responsible officials: The Information Security Officer has developed a comprehensive project plan to implement the core 9 elements as listed under FTC Safeguards. The plan is backed by HPU’s 3rd party risk assessment conducted in November of 2024. The addition of a new hire and a part-time resource has facilitated significant progress. Budget for necessary tools, software, and services such as penetration testing are being actively quoted for review by the Budget Office and CFO for both current and future fiscal years. Checkpoints have been established every two weeks to review and confirm substantial progress towards meeting all requirements and address any barriers or setbacks that may occur. The Vice President of Operations and CIO will review the progress support efforts to meet the requirements and targeted delivery date. The HPU Cybersecurity Committee will be provided with the 2024 Risk Assessment and the Information Security Program documentation and policies for both initial and ongoing review of the programs with the objective to further strengthen the program beyond minimum requirement.

Criteria: 34 CFR 668.22(j)(1) requires the University to return the amount of Title IV funds for which it is responsible as soon as possible, but no later than 45 days after the date of the University’s determination that the student withdrew. Condition: The University did not return all Title IV funds in a timely manner. Context: We selected a non-statistical sample of 8 students out of a population of 68 students who withdrew during the year and had Title IV funds disbursed. We noted 6 out of 8 students required a return of Title IV funds and for 5 out of the 6 students, the University did not return funds to the Department of Education within the required time frame. Cause: Although the University has policies and procedures in place over the return of Title IV funds, management indicated that staff turnover, including the resignation of the Director of Financial Aid, resulted in the remaining staff being required to take on additional responsibilities to ensure the continuity of day-to-day functions of the office. In addition, the changes required by the FAFSA simplification act caused the team to be unable to timely comply with the existing policies. Effect: Failure to timely return Title IV funds resulted in noncompliance with the special tests and provisions – return of Title IV funds requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University be more diligent in complying with its established policies and procedures for the return of Title IV funds. Where staffing shortages exist, consider crosstraining staff or temporarily engaging external resources. Views of responsible officials: This issue was initially identified by the University through HPU’s internal monitoring processes. The cause was significant staff turnover within a 6-month period (including the resignation of the Director of Financial Aid). The difficulties of temporarily reduced staffing and loss of institutional knowledge were compounded by the challenges brought by the FAFSA Simplification Act, which required many changes, placing an additional burden on a strained team. Although the University attempted to adhere to its policies and procedures to ensure that R2T4 is processed within the allotted time, the team did not succeed in completing this function. The University replaced key staff, recruited a new Director, and shifted responsibilities so that a specific staff member is responsible for R2T4 processing. These changes have enabled the University to resume processingR2T4 timely, as was accomplished in previous years.

Criteria: 34 CFR 668.164(h)(2) requires that a Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than – (i) 14 days after the balance occurred if the credit balance occurred after the first day of class or a payment period; or (ii) 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition: The University did not pay Title IV credit balances to 3 students or parents in a timely manner. Context: We selected a non-statistical sample of 60 students with disbursements for special tests and provisions – disbursements to or on behalf of students testing, of which 41 students had Title IV credit balances. For 3 out of the 41 credit balances, payments to the student or parent were made after the 14-day requirement. The 3 instances were related to credit balances that were created in December 2023 and paid out in January 2024. Cause: Although the University has policies and procedures in place for the payment of Title IV credit balances, there was a failure to follow its policies and procedures. Management indicated that the credit balances were created in December, directly preceding the University’s holiday break. The University is closed during this period and staffing is generally limited. Management followed its ordinary procedures to pause disbursements prior to break to ensure the credit balances are paid to students or parents in a timely manner. However, one staff member was unaware of this requirement and manually disbursed aid resulting in credit balances for 3 students which required repayment during the holiday break. Effect: Failure to timely pay Title IV credit balances to students or parents resulted in noncompliance with the special tests and provisions – disbursements to or on behalf of students requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University establish clear procedures to ensure timely and effective communication with staff regarding alternative disbursement schedules. Views of responsible officials: The University has an automated process in place to disburse aid daily. That process is set to stop on a certain day before the University’s scheduled Winter Break to allow the refund processing team time to generate and distribute refunds within the allotted timeframe and maintain compliant with related regulations despite the University’s scheduled closure. According to established procedures, the process was stopped as scheduled. However, one of the University’s Financial Aid Counselors manually authorized and disbursed aid for a small number of students after the process was halted for the semester because they were unaware of the reason why aid was not disbursing, and they were attempting to help students who were calling the Financial Aid office. Once management became aware of this issue, the Director of Financial Aid immediately approached the staff member and explained the reason why the University stopped making disbursements. The Director instructed the team member to not override these established controls and explained the importance of adhering to the policies in place. The staff member acknowledged that they understood the consequences of their actions and the need to adhere to policies. In the future, the University will take extra steps to communicate with all team members when this control is initiated prior to Winter Break to ensure collective understanding of the reason for pausing disbursement.

Criteria: 16 CFR Part 314 requires the University to implement information safeguard standards prescribed by the Gramm-Leach-Bliley Act (GLBA). GLBA requires institutions and servicers to develop, implement, and maintain a written, comprehensive information security program which contains administrative, technical, and physical safeguards that are appropriate to the size and complexity of the institution or servicer, the nature and scope of their activities, and the sensitivity of any student information. An institution’s written information security program must include the following elements: • Element 1: Designates a Qualified Individual responsible for overseeing and implementing the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)). • Element 2: Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)). • Element 3: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8). • Element 4: Provides for the institution or servicer to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 C.F.R. 314.4(d)). • Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)) • Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)). • Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)). • Element 8: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the establishment of an incident response plan (16 C.F.R. 314.4(h)). • Element 9: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the requirement for its Qualified Individual to report regularly and at least annually to those with control over the institution on the institution’s information security program (16 C.F.R. 314.4(i)). Context: We conducted inquiries with the University’s Information Security Officer to determine whether the University had a written information security program that addressed the elements required by GLBA. Although the University has a designated security officer (i.e. Qualified Individual), management confirmed that the University did not have a written comprehensive program in place as prescribed by the GLBA. Cause: Management indicated there was a lack of awareness regarding the requirement to establish an information security program that addressed the required elements. Effect: The University was not in compliance with the GLBA requirement which could result in administrative action by the Department of Education and may impact the University’s participation in Title IV programs. Questioned Costs: None Identification of repeat finding: N/A. Recommendations: We recommend the University develop and implement an Information Security Program that includes the required elements prescribed by GLBA. The University should develop and retain documentation supporting the completion and implementation of each of the required elements. Once completed, the University should conduct periodic internal assessments of the Information Security Programs’ compliance or consider engaging a third-party consultant to conduct such a review. Views of responsible officials: The Information Security Officer has developed a comprehensive project plan to implement the core 9 elements as listed under FTC Safeguards. The plan is backed by HPU’s 3rd party risk assessment conducted in November of 2024. The addition of a new hire and a part-time resource has facilitated significant progress. Budget for necessary tools, software, and services such as penetration testing are being actively quoted for review by the Budget Office and CFO for both current and future fiscal years. Checkpoints have been established every two weeks to review and confirm substantial progress towards meeting all requirements and address any barriers or setbacks that may occur. The Vice President of Operations and CIO will review the progress support efforts to meet the requirements and targeted delivery date. The HPU Cybersecurity Committee will be provided with the 2024 Risk Assessment and the Information Security Program documentation and policies for both initial and ongoing review of the programs with the objective to further strengthen the program beyond minimum requirement.

Criteria: 34 CFR 668.22(j)(1) requires the University to return the amount of Title IV funds for which it is responsible as soon as possible, but no later than 45 days after the date of the University’s determination that the student withdrew. Condition: The University did not return all Title IV funds in a timely manner. Context: We selected a non-statistical sample of 8 students out of a population of 68 students who withdrew during the year and had Title IV funds disbursed. We noted 6 out of 8 students required a return of Title IV funds and for 5 out of the 6 students, the University did not return funds to the Department of Education within the required time frame. Cause: Although the University has policies and procedures in place over the return of Title IV funds, management indicated that staff turnover, including the resignation of the Director of Financial Aid, resulted in the remaining staff being required to take on additional responsibilities to ensure the continuity of day-to-day functions of the office. In addition, the changes required by the FAFSA simplification act caused the team to be unable to timely comply with the existing policies. Effect: Failure to timely return Title IV funds resulted in noncompliance with the special tests and provisions – return of Title IV funds requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University be more diligent in complying with its established policies and procedures for the return of Title IV funds. Where staffing shortages exist, consider crosstraining staff or temporarily engaging external resources. Views of responsible officials: This issue was initially identified by the University through HPU’s internal monitoring processes. The cause was significant staff turnover within a 6-month period (including the resignation of the Director of Financial Aid). The difficulties of temporarily reduced staffing and loss of institutional knowledge were compounded by the challenges brought by the FAFSA Simplification Act, which required many changes, placing an additional burden on a strained team. Although the University attempted to adhere to its policies and procedures to ensure that R2T4 is processed within the allotted time, the team did not succeed in completing this function. The University replaced key staff, recruited a new Director, and shifted responsibilities so that a specific staff member is responsible for R2T4 processing. These changes have enabled the University to resume processingR2T4 timely, as was accomplished in previous years.

Criteria: 34 CFR 668.164(h)(2) requires that a Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than – (i) 14 days after the balance occurred if the credit balance occurred after the first day of class or a payment period; or (ii) 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition: The University did not pay Title IV credit balances to 3 students or parents in a timely manner. Context: We selected a non-statistical sample of 60 students with disbursements for special tests and provisions – disbursements to or on behalf of students testing, of which 41 students had Title IV credit balances. For 3 out of the 41 credit balances, payments to the student or parent were made after the 14-day requirement. The 3 instances were related to credit balances that were created in December 2023 and paid out in January 2024. Cause: Although the University has policies and procedures in place for the payment of Title IV credit balances, there was a failure to follow its policies and procedures. Management indicated that the credit balances were created in December, directly preceding the University’s holiday break. The University is closed during this period and staffing is generally limited. Management followed its ordinary procedures to pause disbursements prior to break to ensure the credit balances are paid to students or parents in a timely manner. However, one staff member was unaware of this requirement and manually disbursed aid resulting in credit balances for 3 students which required repayment during the holiday break. Effect: Failure to timely pay Title IV credit balances to students or parents resulted in noncompliance with the special tests and provisions – disbursements to or on behalf of students requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University establish clear procedures to ensure timely and effective communication with staff regarding alternative disbursement schedules. Views of responsible officials: The University has an automated process in place to disburse aid daily. That process is set to stop on a certain day before the University’s scheduled Winter Break to allow the refund processing team time to generate and distribute refunds within the allotted timeframe and maintain compliant with related regulations despite the University’s scheduled closure. According to established procedures, the process was stopped as scheduled. However, one of the University’s Financial Aid Counselors manually authorized and disbursed aid for a small number of students after the process was halted for the semester because they were unaware of the reason why aid was not disbursing, and they were attempting to help students who were calling the Financial Aid office. Once management became aware of this issue, the Director of Financial Aid immediately approached the staff member and explained the reason why the University stopped making disbursements. The Director instructed the team member to not override these established controls and explained the importance of adhering to the policies in place. The staff member acknowledged that they understood the consequences of their actions and the need to adhere to policies. In the future, the University will take extra steps to communicate with all team members when this control is initiated prior to Winter Break to ensure collective understanding of the reason for pausing disbursement.

Criteria: 16 CFR Part 314 requires the University to implement information safeguard standards prescribed by the Gramm-Leach-Bliley Act (GLBA). GLBA requires institutions and servicers to develop, implement, and maintain a written, comprehensive information security program which contains administrative, technical, and physical safeguards that are appropriate to the size and complexity of the institution or servicer, the nature and scope of their activities, and the sensitivity of any student information. An institution’s written information security program must include the following elements: • Element 1: Designates a Qualified Individual responsible for overseeing and implementing the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)). • Element 2: Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)). • Element 3: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8). • Element 4: Provides for the institution or servicer to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 C.F.R. 314.4(d)). • Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)) • Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)). • Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)). • Element 8: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the establishment of an incident response plan (16 C.F.R. 314.4(h)). • Element 9: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the requirement for its Qualified Individual to report regularly and at least annually to those with control over the institution on the institution’s information security program (16 C.F.R. 314.4(i)). Context: We conducted inquiries with the University’s Information Security Officer to determine whether the University had a written information security program that addressed the elements required by GLBA. Although the University has a designated security officer (i.e. Qualified Individual), management confirmed that the University did not have a written comprehensive program in place as prescribed by the GLBA. Cause: Management indicated there was a lack of awareness regarding the requirement to establish an information security program that addressed the required elements. Effect: The University was not in compliance with the GLBA requirement which could result in administrative action by the Department of Education and may impact the University’s participation in Title IV programs. Questioned Costs: None Identification of repeat finding: N/A. Recommendations: We recommend the University develop and implement an Information Security Program that includes the required elements prescribed by GLBA. The University should develop and retain documentation supporting the completion and implementation of each of the required elements. Once completed, the University should conduct periodic internal assessments of the Information Security Programs’ compliance or consider engaging a third-party consultant to conduct such a review. Views of responsible officials: The Information Security Officer has developed a comprehensive project plan to implement the core 9 elements as listed under FTC Safeguards. The plan is backed by HPU’s 3rd party risk assessment conducted in November of 2024. The addition of a new hire and a part-time resource has facilitated significant progress. Budget for necessary tools, software, and services such as penetration testing are being actively quoted for review by the Budget Office and CFO for both current and future fiscal years. Checkpoints have been established every two weeks to review and confirm substantial progress towards meeting all requirements and address any barriers or setbacks that may occur. The Vice President of Operations and CIO will review the progress support efforts to meet the requirements and targeted delivery date. The HPU Cybersecurity Committee will be provided with the 2024 Risk Assessment and the Information Security Program documentation and policies for both initial and ongoing review of the programs with the objective to further strengthen the program beyond minimum requirement.

Criteria: 34 CFR 668.22(j)(1) requires the University to return the amount of Title IV funds for which it is responsible as soon as possible, but no later than 45 days after the date of the University’s determination that the student withdrew. Condition: The University did not return all Title IV funds in a timely manner. Context: We selected a non-statistical sample of 8 students out of a population of 68 students who withdrew during the year and had Title IV funds disbursed. We noted 6 out of 8 students required a return of Title IV funds and for 5 out of the 6 students, the University did not return funds to the Department of Education within the required time frame. Cause: Although the University has policies and procedures in place over the return of Title IV funds, management indicated that staff turnover, including the resignation of the Director of Financial Aid, resulted in the remaining staff being required to take on additional responsibilities to ensure the continuity of day-to-day functions of the office. In addition, the changes required by the FAFSA simplification act caused the team to be unable to timely comply with the existing policies. Effect: Failure to timely return Title IV funds resulted in noncompliance with the special tests and provisions – return of Title IV funds requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University be more diligent in complying with its established policies and procedures for the return of Title IV funds. Where staffing shortages exist, consider crosstraining staff or temporarily engaging external resources. Views of responsible officials: This issue was initially identified by the University through HPU’s internal monitoring processes. The cause was significant staff turnover within a 6-month period (including the resignation of the Director of Financial Aid). The difficulties of temporarily reduced staffing and loss of institutional knowledge were compounded by the challenges brought by the FAFSA Simplification Act, which required many changes, placing an additional burden on a strained team. Although the University attempted to adhere to its policies and procedures to ensure that R2T4 is processed within the allotted time, the team did not succeed in completing this function. The University replaced key staff, recruited a new Director, and shifted responsibilities so that a specific staff member is responsible for R2T4 processing. These changes have enabled the University to resume processingR2T4 timely, as was accomplished in previous years.

Criteria: 34 CFR 668.164(h)(2) requires that a Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than – (i) 14 days after the balance occurred if the credit balance occurred after the first day of class or a payment period; or (ii) 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition: The University did not pay Title IV credit balances to 3 students or parents in a timely manner. Context: We selected a non-statistical sample of 60 students with disbursements for special tests and provisions – disbursements to or on behalf of students testing, of which 41 students had Title IV credit balances. For 3 out of the 41 credit balances, payments to the student or parent were made after the 14-day requirement. The 3 instances were related to credit balances that were created in December 2023 and paid out in January 2024. Cause: Although the University has policies and procedures in place for the payment of Title IV credit balances, there was a failure to follow its policies and procedures. Management indicated that the credit balances were created in December, directly preceding the University’s holiday break. The University is closed during this period and staffing is generally limited. Management followed its ordinary procedures to pause disbursements prior to break to ensure the credit balances are paid to students or parents in a timely manner. However, one staff member was unaware of this requirement and manually disbursed aid resulting in credit balances for 3 students which required repayment during the holiday break. Effect: Failure to timely pay Title IV credit balances to students or parents resulted in noncompliance with the special tests and provisions – disbursements to or on behalf of students requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University establish clear procedures to ensure timely and effective communication with staff regarding alternative disbursement schedules. Views of responsible officials: The University has an automated process in place to disburse aid daily. That process is set to stop on a certain day before the University’s scheduled Winter Break to allow the refund processing team time to generate and distribute refunds within the allotted timeframe and maintain compliant with related regulations despite the University’s scheduled closure. According to established procedures, the process was stopped as scheduled. However, one of the University’s Financial Aid Counselors manually authorized and disbursed aid for a small number of students after the process was halted for the semester because they were unaware of the reason why aid was not disbursing, and they were attempting to help students who were calling the Financial Aid office. Once management became aware of this issue, the Director of Financial Aid immediately approached the staff member and explained the reason why the University stopped making disbursements. The Director instructed the team member to not override these established controls and explained the importance of adhering to the policies in place. The staff member acknowledged that they understood the consequences of their actions and the need to adhere to policies. In the future, the University will take extra steps to communicate with all team members when this control is initiated prior to Winter Break to ensure collective understanding of the reason for pausing disbursement.

Criteria: 16 CFR Part 314 requires the University to implement information safeguard standards prescribed by the Gramm-Leach-Bliley Act (GLBA). GLBA requires institutions and servicers to develop, implement, and maintain a written, comprehensive information security program which contains administrative, technical, and physical safeguards that are appropriate to the size and complexity of the institution or servicer, the nature and scope of their activities, and the sensitivity of any student information. An institution’s written information security program must include the following elements: • Element 1: Designates a Qualified Individual responsible for overseeing and implementing the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)). • Element 2: Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)). • Element 3: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8). • Element 4: Provides for the institution or servicer to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 C.F.R. 314.4(d)). • Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)) • Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)). • Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)). • Element 8: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the establishment of an incident response plan (16 C.F.R. 314.4(h)). • Element 9: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the requirement for its Qualified Individual to report regularly and at least annually to those with control over the institution on the institution’s information security program (16 C.F.R. 314.4(i)). Context: We conducted inquiries with the University’s Information Security Officer to determine whether the University had a written information security program that addressed the elements required by GLBA. Although the University has a designated security officer (i.e. Qualified Individual), management confirmed that the University did not have a written comprehensive program in place as prescribed by the GLBA. Cause: Management indicated there was a lack of awareness regarding the requirement to establish an information security program that addressed the required elements. Effect: The University was not in compliance with the GLBA requirement which could result in administrative action by the Department of Education and may impact the University’s participation in Title IV programs. Questioned Costs: None Identification of repeat finding: N/A. Recommendations: We recommend the University develop and implement an Information Security Program that includes the required elements prescribed by GLBA. The University should develop and retain documentation supporting the completion and implementation of each of the required elements. Once completed, the University should conduct periodic internal assessments of the Information Security Programs’ compliance or consider engaging a third-party consultant to conduct such a review. Views of responsible officials: The Information Security Officer has developed a comprehensive project plan to implement the core 9 elements as listed under FTC Safeguards. The plan is backed by HPU’s 3rd party risk assessment conducted in November of 2024. The addition of a new hire and a part-time resource has facilitated significant progress. Budget for necessary tools, software, and services such as penetration testing are being actively quoted for review by the Budget Office and CFO for both current and future fiscal years. Checkpoints have been established every two weeks to review and confirm substantial progress towards meeting all requirements and address any barriers or setbacks that may occur. The Vice President of Operations and CIO will review the progress support efforts to meet the requirements and targeted delivery date. The HPU Cybersecurity Committee will be provided with the 2024 Risk Assessment and the Information Security Program documentation and policies for both initial and ongoing review of the programs with the objective to further strengthen the program beyond minimum requirement.

Criteria: 34 CFR 668.22(j)(1) requires the University to return the amount of Title IV funds for which it is responsible as soon as possible, but no later than 45 days after the date of the University’s determination that the student withdrew. Condition: The University did not return all Title IV funds in a timely manner. Context: We selected a non-statistical sample of 8 students out of a population of 68 students who withdrew during the year and had Title IV funds disbursed. We noted 6 out of 8 students required a return of Title IV funds and for 5 out of the 6 students, the University did not return funds to the Department of Education within the required time frame. Cause: Although the University has policies and procedures in place over the return of Title IV funds, management indicated that staff turnover, including the resignation of the Director of Financial Aid, resulted in the remaining staff being required to take on additional responsibilities to ensure the continuity of day-to-day functions of the office. In addition, the changes required by the FAFSA simplification act caused the team to be unable to timely comply with the existing policies. Effect: Failure to timely return Title IV funds resulted in noncompliance with the special tests and provisions – return of Title IV funds requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University be more diligent in complying with its established policies and procedures for the return of Title IV funds. Where staffing shortages exist, consider crosstraining staff or temporarily engaging external resources. Views of responsible officials: This issue was initially identified by the University through HPU’s internal monitoring processes. The cause was significant staff turnover within a 6-month period (including the resignation of the Director of Financial Aid). The difficulties of temporarily reduced staffing and loss of institutional knowledge were compounded by the challenges brought by the FAFSA Simplification Act, which required many changes, placing an additional burden on a strained team. Although the University attempted to adhere to its policies and procedures to ensure that R2T4 is processed within the allotted time, the team did not succeed in completing this function. The University replaced key staff, recruited a new Director, and shifted responsibilities so that a specific staff member is responsible for R2T4 processing. These changes have enabled the University to resume processingR2T4 timely, as was accomplished in previous years.

Criteria: 34 CFR 668.164(h)(2) requires that a Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than – (i) 14 days after the balance occurred if the credit balance occurred after the first day of class or a payment period; or (ii) 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition: The University did not pay Title IV credit balances to 3 students or parents in a timely manner. Context: We selected a non-statistical sample of 60 students with disbursements for special tests and provisions – disbursements to or on behalf of students testing, of which 41 students had Title IV credit balances. For 3 out of the 41 credit balances, payments to the student or parent were made after the 14-day requirement. The 3 instances were related to credit balances that were created in December 2023 and paid out in January 2024. Cause: Although the University has policies and procedures in place for the payment of Title IV credit balances, there was a failure to follow its policies and procedures. Management indicated that the credit balances were created in December, directly preceding the University’s holiday break. The University is closed during this period and staffing is generally limited. Management followed its ordinary procedures to pause disbursements prior to break to ensure the credit balances are paid to students or parents in a timely manner. However, one staff member was unaware of this requirement and manually disbursed aid resulting in credit balances for 3 students which required repayment during the holiday break. Effect: Failure to timely pay Title IV credit balances to students or parents resulted in noncompliance with the special tests and provisions – disbursements to or on behalf of students requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University establish clear procedures to ensure timely and effective communication with staff regarding alternative disbursement schedules. Views of responsible officials: The University has an automated process in place to disburse aid daily. That process is set to stop on a certain day before the University’s scheduled Winter Break to allow the refund processing team time to generate and distribute refunds within the allotted timeframe and maintain compliant with related regulations despite the University’s scheduled closure. According to established procedures, the process was stopped as scheduled. However, one of the University’s Financial Aid Counselors manually authorized and disbursed aid for a small number of students after the process was halted for the semester because they were unaware of the reason why aid was not disbursing, and they were attempting to help students who were calling the Financial Aid office. Once management became aware of this issue, the Director of Financial Aid immediately approached the staff member and explained the reason why the University stopped making disbursements. The Director instructed the team member to not override these established controls and explained the importance of adhering to the policies in place. The staff member acknowledged that they understood the consequences of their actions and the need to adhere to policies. In the future, the University will take extra steps to communicate with all team members when this control is initiated prior to Winter Break to ensure collective understanding of the reason for pausing disbursement.

Criteria: 16 CFR Part 314 requires the University to implement information safeguard standards prescribed by the Gramm-Leach-Bliley Act (GLBA). GLBA requires institutions and servicers to develop, implement, and maintain a written, comprehensive information security program which contains administrative, technical, and physical safeguards that are appropriate to the size and complexity of the institution or servicer, the nature and scope of their activities, and the sensitivity of any student information. An institution’s written information security program must include the following elements: • Element 1: Designates a Qualified Individual responsible for overseeing and implementing the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)). • Element 2: Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)). • Element 3: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8). • Element 4: Provides for the institution or servicer to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 C.F.R. 314.4(d)). • Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)) • Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)). • Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)). • Element 8: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the establishment of an incident response plan (16 C.F.R. 314.4(h)). • Element 9: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the requirement for its Qualified Individual to report regularly and at least annually to those with control over the institution on the institution’s information security program (16 C.F.R. 314.4(i)). Context: We conducted inquiries with the University’s Information Security Officer to determine whether the University had a written information security program that addressed the elements required by GLBA. Although the University has a designated security officer (i.e. Qualified Individual), management confirmed that the University did not have a written comprehensive program in place as prescribed by the GLBA. Cause: Management indicated there was a lack of awareness regarding the requirement to establish an information security program that addressed the required elements. Effect: The University was not in compliance with the GLBA requirement which could result in administrative action by the Department of Education and may impact the University’s participation in Title IV programs. Questioned Costs: None Identification of repeat finding: N/A. Recommendations: We recommend the University develop and implement an Information Security Program that includes the required elements prescribed by GLBA. The University should develop and retain documentation supporting the completion and implementation of each of the required elements. Once completed, the University should conduct periodic internal assessments of the Information Security Programs’ compliance or consider engaging a third-party consultant to conduct such a review. Views of responsible officials: The Information Security Officer has developed a comprehensive project plan to implement the core 9 elements as listed under FTC Safeguards. The plan is backed by HPU’s 3rd party risk assessment conducted in November of 2024. The addition of a new hire and a part-time resource has facilitated significant progress. Budget for necessary tools, software, and services such as penetration testing are being actively quoted for review by the Budget Office and CFO for both current and future fiscal years. Checkpoints have been established every two weeks to review and confirm substantial progress towards meeting all requirements and address any barriers or setbacks that may occur. The Vice President of Operations and CIO will review the progress support efforts to meet the requirements and targeted delivery date. The HPU Cybersecurity Committee will be provided with the 2024 Risk Assessment and the Information Security Program documentation and policies for both initial and ongoing review of the programs with the objective to further strengthen the program beyond minimum requirement.

Criteria: 34 CFR 668.22(j)(1) requires the University to return the amount of Title IV funds for which it is responsible as soon as possible, but no later than 45 days after the date of the University’s determination that the student withdrew. Condition: The University did not return all Title IV funds in a timely manner. Context: We selected a non-statistical sample of 8 students out of a population of 68 students who withdrew during the year and had Title IV funds disbursed. We noted 6 out of 8 students required a return of Title IV funds and for 5 out of the 6 students, the University did not return funds to the Department of Education within the required time frame. Cause: Although the University has policies and procedures in place over the return of Title IV funds, management indicated that staff turnover, including the resignation of the Director of Financial Aid, resulted in the remaining staff being required to take on additional responsibilities to ensure the continuity of day-to-day functions of the office. In addition, the changes required by the FAFSA simplification act caused the team to be unable to timely comply with the existing policies. Effect: Failure to timely return Title IV funds resulted in noncompliance with the special tests and provisions – return of Title IV funds requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University be more diligent in complying with its established policies and procedures for the return of Title IV funds. Where staffing shortages exist, consider crosstraining staff or temporarily engaging external resources. Views of responsible officials: This issue was initially identified by the University through HPU’s internal monitoring processes. The cause was significant staff turnover within a 6-month period (including the resignation of the Director of Financial Aid). The difficulties of temporarily reduced staffing and loss of institutional knowledge were compounded by the challenges brought by the FAFSA Simplification Act, which required many changes, placing an additional burden on a strained team. Although the University attempted to adhere to its policies and procedures to ensure that R2T4 is processed within the allotted time, the team did not succeed in completing this function. The University replaced key staff, recruited a new Director, and shifted responsibilities so that a specific staff member is responsible for R2T4 processing. These changes have enabled the University to resume processingR2T4 timely, as was accomplished in previous years.

Criteria: 34 CFR 668.164(h)(2) requires that a Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than – (i) 14 days after the balance occurred if the credit balance occurred after the first day of class or a payment period; or (ii) 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition: The University did not pay Title IV credit balances to 3 students or parents in a timely manner. Context: We selected a non-statistical sample of 60 students with disbursements for special tests and provisions – disbursements to or on behalf of students testing, of which 41 students had Title IV credit balances. For 3 out of the 41 credit balances, payments to the student or parent were made after the 14-day requirement. The 3 instances were related to credit balances that were created in December 2023 and paid out in January 2024. Cause: Although the University has policies and procedures in place for the payment of Title IV credit balances, there was a failure to follow its policies and procedures. Management indicated that the credit balances were created in December, directly preceding the University’s holiday break. The University is closed during this period and staffing is generally limited. Management followed its ordinary procedures to pause disbursements prior to break to ensure the credit balances are paid to students or parents in a timely manner. However, one staff member was unaware of this requirement and manually disbursed aid resulting in credit balances for 3 students which required repayment during the holiday break. Effect: Failure to timely pay Title IV credit balances to students or parents resulted in noncompliance with the special tests and provisions – disbursements to or on behalf of students requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University establish clear procedures to ensure timely and effective communication with staff regarding alternative disbursement schedules. Views of responsible officials: The University has an automated process in place to disburse aid daily. That process is set to stop on a certain day before the University’s scheduled Winter Break to allow the refund processing team time to generate and distribute refunds within the allotted timeframe and maintain compliant with related regulations despite the University’s scheduled closure. According to established procedures, the process was stopped as scheduled. However, one of the University’s Financial Aid Counselors manually authorized and disbursed aid for a small number of students after the process was halted for the semester because they were unaware of the reason why aid was not disbursing, and they were attempting to help students who were calling the Financial Aid office. Once management became aware of this issue, the Director of Financial Aid immediately approached the staff member and explained the reason why the University stopped making disbursements. The Director instructed the team member to not override these established controls and explained the importance of adhering to the policies in place. The staff member acknowledged that they understood the consequences of their actions and the need to adhere to policies. In the future, the University will take extra steps to communicate with all team members when this control is initiated prior to Winter Break to ensure collective understanding of the reason for pausing disbursement.

Criteria: 16 CFR Part 314 requires the University to implement information safeguard standards prescribed by the Gramm-Leach-Bliley Act (GLBA). GLBA requires institutions and servicers to develop, implement, and maintain a written, comprehensive information security program which contains administrative, technical, and physical safeguards that are appropriate to the size and complexity of the institution or servicer, the nature and scope of their activities, and the sensitivity of any student information. An institution’s written information security program must include the following elements: • Element 1: Designates a Qualified Individual responsible for overseeing and implementing the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)). • Element 2: Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)). • Element 3: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8). • Element 4: Provides for the institution or servicer to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 C.F.R. 314.4(d)). • Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)) • Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)). • Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)). • Element 8: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the establishment of an incident response plan (16 C.F.R. 314.4(h)). • Element 9: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the requirement for its Qualified Individual to report regularly and at least annually to those with control over the institution on the institution’s information security program (16 C.F.R. 314.4(i)). Context: We conducted inquiries with the University’s Information Security Officer to determine whether the University had a written information security program that addressed the elements required by GLBA. Although the University has a designated security officer (i.e. Qualified Individual), management confirmed that the University did not have a written comprehensive program in place as prescribed by the GLBA. Cause: Management indicated there was a lack of awareness regarding the requirement to establish an information security program that addressed the required elements. Effect: The University was not in compliance with the GLBA requirement which could result in administrative action by the Department of Education and may impact the University’s participation in Title IV programs. Questioned Costs: None Identification of repeat finding: N/A. Recommendations: We recommend the University develop and implement an Information Security Program that includes the required elements prescribed by GLBA. The University should develop and retain documentation supporting the completion and implementation of each of the required elements. Once completed, the University should conduct periodic internal assessments of the Information Security Programs’ compliance or consider engaging a third-party consultant to conduct such a review. Views of responsible officials: The Information Security Officer has developed a comprehensive project plan to implement the core 9 elements as listed under FTC Safeguards. The plan is backed by HPU’s 3rd party risk assessment conducted in November of 2024. The addition of a new hire and a part-time resource has facilitated significant progress. Budget for necessary tools, software, and services such as penetration testing are being actively quoted for review by the Budget Office and CFO for both current and future fiscal years. Checkpoints have been established every two weeks to review and confirm substantial progress towards meeting all requirements and address any barriers or setbacks that may occur. The Vice President of Operations and CIO will review the progress support efforts to meet the requirements and targeted delivery date. The HPU Cybersecurity Committee will be provided with the 2024 Risk Assessment and the Information Security Program documentation and policies for both initial and ongoing review of the programs with the objective to further strengthen the program beyond minimum requirement.

Criteria: 34 CFR 668.22(j)(1) requires the University to return the amount of Title IV funds for which it is responsible as soon as possible, but no later than 45 days after the date of the University’s determination that the student withdrew. Condition: The University did not return all Title IV funds in a timely manner. Context: We selected a non-statistical sample of 8 students out of a population of 68 students who withdrew during the year and had Title IV funds disbursed. We noted 6 out of 8 students required a return of Title IV funds and for 5 out of the 6 students, the University did not return funds to the Department of Education within the required time frame. Cause: Although the University has policies and procedures in place over the return of Title IV funds, management indicated that staff turnover, including the resignation of the Director of Financial Aid, resulted in the remaining staff being required to take on additional responsibilities to ensure the continuity of day-to-day functions of the office. In addition, the changes required by the FAFSA simplification act caused the team to be unable to timely comply with the existing policies. Effect: Failure to timely return Title IV funds resulted in noncompliance with the special tests and provisions – return of Title IV funds requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University be more diligent in complying with its established policies and procedures for the return of Title IV funds. Where staffing shortages exist, consider crosstraining staff or temporarily engaging external resources. Views of responsible officials: This issue was initially identified by the University through HPU’s internal monitoring processes. The cause was significant staff turnover within a 6-month period (including the resignation of the Director of Financial Aid). The difficulties of temporarily reduced staffing and loss of institutional knowledge were compounded by the challenges brought by the FAFSA Simplification Act, which required many changes, placing an additional burden on a strained team. Although the University attempted to adhere to its policies and procedures to ensure that R2T4 is processed within the allotted time, the team did not succeed in completing this function. The University replaced key staff, recruited a new Director, and shifted responsibilities so that a specific staff member is responsible for R2T4 processing. These changes have enabled the University to resume processingR2T4 timely, as was accomplished in previous years.

Criteria: 34 CFR 668.164(h)(2) requires that a Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than – (i) 14 days after the balance occurred if the credit balance occurred after the first day of class or a payment period; or (ii) 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition: The University did not pay Title IV credit balances to 3 students or parents in a timely manner. Context: We selected a non-statistical sample of 60 students with disbursements for special tests and provisions – disbursements to or on behalf of students testing, of which 41 students had Title IV credit balances. For 3 out of the 41 credit balances, payments to the student or parent were made after the 14-day requirement. The 3 instances were related to credit balances that were created in December 2023 and paid out in January 2024. Cause: Although the University has policies and procedures in place for the payment of Title IV credit balances, there was a failure to follow its policies and procedures. Management indicated that the credit balances were created in December, directly preceding the University’s holiday break. The University is closed during this period and staffing is generally limited. Management followed its ordinary procedures to pause disbursements prior to break to ensure the credit balances are paid to students or parents in a timely manner. However, one staff member was unaware of this requirement and manually disbursed aid resulting in credit balances for 3 students which required repayment during the holiday break. Effect: Failure to timely pay Title IV credit balances to students or parents resulted in noncompliance with the special tests and provisions – disbursements to or on behalf of students requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University establish clear procedures to ensure timely and effective communication with staff regarding alternative disbursement schedules. Views of responsible officials: The University has an automated process in place to disburse aid daily. That process is set to stop on a certain day before the University’s scheduled Winter Break to allow the refund processing team time to generate and distribute refunds within the allotted timeframe and maintain compliant with related regulations despite the University’s scheduled closure. According to established procedures, the process was stopped as scheduled. However, one of the University’s Financial Aid Counselors manually authorized and disbursed aid for a small number of students after the process was halted for the semester because they were unaware of the reason why aid was not disbursing, and they were attempting to help students who were calling the Financial Aid office. Once management became aware of this issue, the Director of Financial Aid immediately approached the staff member and explained the reason why the University stopped making disbursements. The Director instructed the team member to not override these established controls and explained the importance of adhering to the policies in place. The staff member acknowledged that they understood the consequences of their actions and the need to adhere to policies. In the future, the University will take extra steps to communicate with all team members when this control is initiated prior to Winter Break to ensure collective understanding of the reason for pausing disbursement.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 16 CFR Part 314 requires the University to implement information safeguard standards prescribed by the Gramm-Leach-Bliley Act (GLBA). GLBA requires institutions and servicers to develop, implement, and maintain a written, comprehensive information security program which contains administrative, technical, and physical safeguards that are appropriate to the size and complexity of the institution or servicer, the nature and scope of their activities, and the sensitivity of any student information. An institution’s written information security program must include the following elements: • Element 1: Designates a Qualified Individual responsible for overseeing and implementing the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)). • Element 2: Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)). • Element 3: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8). • Element 4: Provides for the institution or servicer to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 C.F.R. 314.4(d)). • Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)) • Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)). • Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)). • Element 8: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the establishment of an incident response plan (16 C.F.R. 314.4(h)). • Element 9: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the requirement for its Qualified Individual to report regularly and at least annually to those with control over the institution on the institution’s information security program (16 C.F.R. 314.4(i)). Context: We conducted inquiries with the University’s Information Security Officer to determine whether the University had a written information security program that addressed the elements required by GLBA. Although the University has a designated security officer (i.e. Qualified Individual), management confirmed that the University did not have a written comprehensive program in place as prescribed by the GLBA. Cause: Management indicated there was a lack of awareness regarding the requirement to establish an information security program that addressed the required elements. Effect: The University was not in compliance with the GLBA requirement which could result in administrative action by the Department of Education and may impact the University’s participation in Title IV programs. Questioned Costs: None Identification of repeat finding: N/A. Recommendations: We recommend the University develop and implement an Information Security Program that includes the required elements prescribed by GLBA. The University should develop and retain documentation supporting the completion and implementation of each of the required elements. Once completed, the University should conduct periodic internal assessments of the Information Security Programs’ compliance or consider engaging a third-party consultant to conduct such a review. Views of responsible officials: The Information Security Officer has developed a comprehensive project plan to implement the core 9 elements as listed under FTC Safeguards. The plan is backed by HPU’s 3rd party risk assessment conducted in November of 2024. The addition of a new hire and a part-time resource has facilitated significant progress. Budget for necessary tools, software, and services such as penetration testing are being actively quoted for review by the Budget Office and CFO for both current and future fiscal years. Checkpoints have been established every two weeks to review and confirm substantial progress towards meeting all requirements and address any barriers or setbacks that may occur. The Vice President of Operations and CIO will review the progress support efforts to meet the requirements and targeted delivery date. The HPU Cybersecurity Committee will be provided with the 2024 Risk Assessment and the Information Security Program documentation and policies for both initial and ongoing review of the programs with the objective to further strengthen the program beyond minimum requirement.

Criteria: 34 CFR 668.22(j)(1) requires the University to return the amount of Title IV funds for which it is responsible as soon as possible, but no later than 45 days after the date of the University’s determination that the student withdrew. Condition: The University did not return all Title IV funds in a timely manner. Context: We selected a non-statistical sample of 8 students out of a population of 68 students who withdrew during the year and had Title IV funds disbursed. We noted 6 out of 8 students required a return of Title IV funds and for 5 out of the 6 students, the University did not return funds to the Department of Education within the required time frame. Cause: Although the University has policies and procedures in place over the return of Title IV funds, management indicated that staff turnover, including the resignation of the Director of Financial Aid, resulted in the remaining staff being required to take on additional responsibilities to ensure the continuity of day-to-day functions of the office. In addition, the changes required by the FAFSA simplification act caused the team to be unable to timely comply with the existing policies. Effect: Failure to timely return Title IV funds resulted in noncompliance with the special tests and provisions – return of Title IV funds requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University be more diligent in complying with its established policies and procedures for the return of Title IV funds. Where staffing shortages exist, consider crosstraining staff or temporarily engaging external resources. Views of responsible officials: This issue was initially identified by the University through HPU’s internal monitoring processes. The cause was significant staff turnover within a 6-month period (including the resignation of the Director of Financial Aid). The difficulties of temporarily reduced staffing and loss of institutional knowledge were compounded by the challenges brought by the FAFSA Simplification Act, which required many changes, placing an additional burden on a strained team. Although the University attempted to adhere to its policies and procedures to ensure that R2T4 is processed within the allotted time, the team did not succeed in completing this function. The University replaced key staff, recruited a new Director, and shifted responsibilities so that a specific staff member is responsible for R2T4 processing. These changes have enabled the University to resume processingR2T4 timely, as was accomplished in previous years.

Criteria: 34 CFR 668.164(h)(2) requires that a Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than – (i) 14 days after the balance occurred if the credit balance occurred after the first day of class or a payment period; or (ii) 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition: The University did not pay Title IV credit balances to 3 students or parents in a timely manner. Context: We selected a non-statistical sample of 60 students with disbursements for special tests and provisions – disbursements to or on behalf of students testing, of which 41 students had Title IV credit balances. For 3 out of the 41 credit balances, payments to the student or parent were made after the 14-day requirement. The 3 instances were related to credit balances that were created in December 2023 and paid out in January 2024. Cause: Although the University has policies and procedures in place for the payment of Title IV credit balances, there was a failure to follow its policies and procedures. Management indicated that the credit balances were created in December, directly preceding the University’s holiday break. The University is closed during this period and staffing is generally limited. Management followed its ordinary procedures to pause disbursements prior to break to ensure the credit balances are paid to students or parents in a timely manner. However, one staff member was unaware of this requirement and manually disbursed aid resulting in credit balances for 3 students which required repayment during the holiday break. Effect: Failure to timely pay Title IV credit balances to students or parents resulted in noncompliance with the special tests and provisions – disbursements to or on behalf of students requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University establish clear procedures to ensure timely and effective communication with staff regarding alternative disbursement schedules. Views of responsible officials: The University has an automated process in place to disburse aid daily. That process is set to stop on a certain day before the University’s scheduled Winter Break to allow the refund processing team time to generate and distribute refunds within the allotted timeframe and maintain compliant with related regulations despite the University’s scheduled closure. According to established procedures, the process was stopped as scheduled. However, one of the University’s Financial Aid Counselors manually authorized and disbursed aid for a small number of students after the process was halted for the semester because they were unaware of the reason why aid was not disbursing, and they were attempting to help students who were calling the Financial Aid office. Once management became aware of this issue, the Director of Financial Aid immediately approached the staff member and explained the reason why the University stopped making disbursements. The Director instructed the team member to not override these established controls and explained the importance of adhering to the policies in place. The staff member acknowledged that they understood the consequences of their actions and the need to adhere to policies. In the future, the University will take extra steps to communicate with all team members when this control is initiated prior to Winter Break to ensure collective understanding of the reason for pausing disbursement.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.