Audit 350924

Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Internal controls are not designed and operating effectively with no appropriate segregation of duties in the following areas: 1. Drawdowns for All Federal Awards – There was no control in place specifically designating the appropriate personnel who is responsible to perform the review of all drawdowns to ensure the information and amount are accurate. 2. Reconciliations of Pell Grants, Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study, and Direct Loans between COD, Bank Accounts, and G5 – Reconciliations are prepared by the Associate Director of Financial Aid and reviewed by the Director of Financial Aid. There were no documentations of reviews to verify that these controls are operating effectively. 3. Federal Aid Packages – The Director of Financial Aid prepares and reviews all Federal aid packages. There was no adequate and proper segregation of duties. 4. Professional Judgement Determinations – The Director of Financial Aid prepares and reviews all professional judgement determinations. There was no adequate and proper segregation of duties. 5. Community Service Calculations for Federal-Work Study Program – The community service calculation is reviewed by the Associate Director of Financial Aid. There was no documentation of review to verify that these controls are operating effectively. 6. FISAP Report – The Director of Financial Aid prepares and reviews the FISAP report. There was no adequate and proper segregation of duties. 7. R2T4 Calculations - The Director of Financial Aid prepares and reviews the R2T4 calculations. There was no adequate and proper segregation of duties. 8. NSLDS Reporting – There is no control in place in relation to the review of the student status changes reported to NSLDS and to ensure that these are accurate and submitted timely in accordance with requirements set forth by the Department of Education. 9. Credit Balances - There is no control in place over the review of payment of credit balances to the student within 14 days. Questioned costs: None Context: This condition occurred in our various testing all throughout the audit of the Student Financial Aidt cluster. Cause: Internal controls are not adequately and properly designed to address the risks. Additionally, some controls in place are not operating effectively. Effect: 1. Internal Control deficiencies can lead to non-compliance with laws and regulations, operational inefficiencies and inaccuracies in financial reporting. 2. Improper or lack of segregation of duties can lead to increased risk of errors, fraud, and inefficiencies, as there is insufficient oversight and control. Repeat Finding: No Recommendation: We recommend the University review its internal controls over compliance as these are crucial in protecting the University’s assets, ensuring the accuracy of financial reporting, promoting operational efficiency, and ensuring compliance with laws and regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 668.34(d)(1) requires that an institution that evaluates satisfactory academic progress annually or less frequently than at the end of each payment period and determines that a student is not making progress under its policy may nevertheless disburse Title IV, HEA program funds to the student under the provisions of 34 CFR 668.34(d)(2) or 34 CFR 668.34(d)(3). Condition: As stated in the Financial Aid SAP policy, to successfully make and maintain SAP, a student must maintain a cumulative grade point average of 2.0 or higher for undergraduate students. A student who does not meet the minimum requirements for the rate of completion or cumulative GPA will be sent an SAP Warning and will have one semester to meet SAP requirements. If the student does not meet the required minimum GPA or credit hour completion rate at the end of the warning term, their financial aid will be suspended. During our testing of students’ eligibility for financial aid, 1 out of 40 students who received financial aid did not meet the satisfactory academic progress requirements as stated in the SAP policy. Additionally, 1 out of 40 students who did not meet the SAP cumulative GPA requirement was marked incorrectly as “Satisfactory SAP” instead of “Warning”. Questioned costs: $12,847 Context: This condition occurred in 2 out of 40 students tested. Cause: Students’ GPA was not reviewed closely enough to determine if students meet the requirements to received financial aid. Effect: Students who did not meet the SAP requirements and ineligible to receive financial aid were granted aid. Repeat Finding: No Recommendation: We recommend the University evaluate its procedures around the review and determination of students’ eligibility to receive financial aid. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 668.22(g)(ii)(2) institutional charges are tuition, fees, room and board (if the student contracts with the institution for the room and board) and other educationally-related expenses assessed by the institution. Condition: Incorrect institutional charges were utilized as inputs in the calculation of R2T4 for these students. Questioned costs: None Context: This condition occurred in 2 out of 5 students tested. Cause: The University does not have policies and procedures in place to ensure calculations are properly performed. Effect: The University is not completing accurate R2T4 calculations as defined by the regulations. Repeat Finding: Yes Recommendation: We recommend the University review the R2T4 requirements and implement procedures to ensure the R2T4 calculations are using the correct institutional charges and are accurately completed. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include eight elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Additionally, institutions must conduct penetration testing and vulnerability assessments to ensure the effectiveness of their safeguards. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the following requirements: 1. The requirement to have the written information security program be approved by an appropriate individual. 2. The requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). a. The element missing is the requirement to encrypt customer information on the institution’s system and when it’s in transit. 3. The requirement to provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d) Cause: The College has not fully implemented its written information security program to meet all GLBA requirements. Effect: The College's written information security program is non-compliant with GLBA requirements, potentially exposing customer information to risks due to inadequate approval, missing safeguards, and lack of regular testing or monitoring. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Internal controls are not designed and operating effectively with no appropriate segregation of duties in the following areas: 1. Drawdowns for All Federal Awards – There was no control in place specifically designating the appropriate personnel who is responsible to perform the review of all drawdowns to ensure the information and amount are accurate. 2. Reconciliations of Pell Grants, Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study, and Direct Loans between COD, Bank Accounts, and G5 – Reconciliations are prepared by the Associate Director of Financial Aid and reviewed by the Director of Financial Aid. There were no documentations of reviews to verify that these controls are operating effectively. 3. Federal Aid Packages – The Director of Financial Aid prepares and reviews all Federal aid packages. There was no adequate and proper segregation of duties. 4. Professional Judgement Determinations – The Director of Financial Aid prepares and reviews all professional judgement determinations. There was no adequate and proper segregation of duties. 5. Community Service Calculations for Federal-Work Study Program – The community service calculation is reviewed by the Associate Director of Financial Aid. There was no documentation of review to verify that these controls are operating effectively. 6. FISAP Report – The Director of Financial Aid prepares and reviews the FISAP report. There was no adequate and proper segregation of duties. 7. R2T4 Calculations - The Director of Financial Aid prepares and reviews the R2T4 calculations. There was no adequate and proper segregation of duties. 8. NSLDS Reporting – There is no control in place in relation to the review of the student status changes reported to NSLDS and to ensure that these are accurate and submitted timely in accordance with requirements set forth by the Department of Education. 9. Credit Balances - There is no control in place over the review of payment of credit balances to the student within 14 days. Questioned costs: None Context: This condition occurred in our various testing all throughout the audit of the Student Financial Aidt cluster. Cause: Internal controls are not adequately and properly designed to address the risks. Additionally, some controls in place are not operating effectively. Effect: 1. Internal Control deficiencies can lead to non-compliance with laws and regulations, operational inefficiencies and inaccuracies in financial reporting. 2. Improper or lack of segregation of duties can lead to increased risk of errors, fraud, and inefficiencies, as there is insufficient oversight and control. Repeat Finding: No Recommendation: We recommend the University review its internal controls over compliance as these are crucial in protecting the University’s assets, ensuring the accuracy of financial reporting, promoting operational efficiency, and ensuring compliance with laws and regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 668.34(d)(1) requires that an institution that evaluates satisfactory academic progress annually or less frequently than at the end of each payment period and determines that a student is not making progress under its policy may nevertheless disburse Title IV, HEA program funds to the student under the provisions of 34 CFR 668.34(d)(2) or 34 CFR 668.34(d)(3). Condition: As stated in the Financial Aid SAP policy, to successfully make and maintain SAP, a student must maintain a cumulative grade point average of 2.0 or higher for undergraduate students. A student who does not meet the minimum requirements for the rate of completion or cumulative GPA will be sent an SAP Warning and will have one semester to meet SAP requirements. If the student does not meet the required minimum GPA or credit hour completion rate at the end of the warning term, their financial aid will be suspended. During our testing of students’ eligibility for financial aid, 1 out of 40 students who received financial aid did not meet the satisfactory academic progress requirements as stated in the SAP policy. Additionally, 1 out of 40 students who did not meet the SAP cumulative GPA requirement was marked incorrectly as “Satisfactory SAP” instead of “Warning”. Questioned costs: $12,847 Context: This condition occurred in 2 out of 40 students tested. Cause: Students’ GPA was not reviewed closely enough to determine if students meet the requirements to received financial aid. Effect: Students who did not meet the SAP requirements and ineligible to receive financial aid were granted aid. Repeat Finding: No Recommendation: We recommend the University evaluate its procedures around the review and determination of students’ eligibility to receive financial aid. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 668.22(g)(ii)(2) institutional charges are tuition, fees, room and board (if the student contracts with the institution for the room and board) and other educationally-related expenses assessed by the institution. Condition: Incorrect institutional charges were utilized as inputs in the calculation of R2T4 for these students. Questioned costs: None Context: This condition occurred in 2 out of 5 students tested. Cause: The University does not have policies and procedures in place to ensure calculations are properly performed. Effect: The University is not completing accurate R2T4 calculations as defined by the regulations. Repeat Finding: Yes Recommendation: We recommend the University review the R2T4 requirements and implement procedures to ensure the R2T4 calculations are using the correct institutional charges and are accurately completed. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include eight elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Additionally, institutions must conduct penetration testing and vulnerability assessments to ensure the effectiveness of their safeguards. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the following requirements: 1. The requirement to have the written information security program be approved by an appropriate individual. 2. The requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). a. The element missing is the requirement to encrypt customer information on the institution’s system and when it’s in transit. 3. The requirement to provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d) Cause: The College has not fully implemented its written information security program to meet all GLBA requirements. Effect: The College's written information security program is non-compliant with GLBA requirements, potentially exposing customer information to risks due to inadequate approval, missing safeguards, and lack of regular testing or monitoring. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Internal controls are not designed and operating effectively with no appropriate segregation of duties in the following areas: 1. Drawdowns for All Federal Awards – There was no control in place specifically designating the appropriate personnel who is responsible to perform the review of all drawdowns to ensure the information and amount are accurate. 2. Reconciliations of Pell Grants, Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study, and Direct Loans between COD, Bank Accounts, and G5 – Reconciliations are prepared by the Associate Director of Financial Aid and reviewed by the Director of Financial Aid. There were no documentations of reviews to verify that these controls are operating effectively. 3. Federal Aid Packages – The Director of Financial Aid prepares and reviews all Federal aid packages. There was no adequate and proper segregation of duties. 4. Professional Judgement Determinations – The Director of Financial Aid prepares and reviews all professional judgement determinations. There was no adequate and proper segregation of duties. 5. Community Service Calculations for Federal-Work Study Program – The community service calculation is reviewed by the Associate Director of Financial Aid. There was no documentation of review to verify that these controls are operating effectively. 6. FISAP Report – The Director of Financial Aid prepares and reviews the FISAP report. There was no adequate and proper segregation of duties. 7. R2T4 Calculations - The Director of Financial Aid prepares and reviews the R2T4 calculations. There was no adequate and proper segregation of duties. 8. NSLDS Reporting – There is no control in place in relation to the review of the student status changes reported to NSLDS and to ensure that these are accurate and submitted timely in accordance with requirements set forth by the Department of Education. 9. Credit Balances - There is no control in place over the review of payment of credit balances to the student within 14 days. Questioned costs: None Context: This condition occurred in our various testing all throughout the audit of the Student Financial Aidt cluster. Cause: Internal controls are not adequately and properly designed to address the risks. Additionally, some controls in place are not operating effectively. Effect: 1. Internal Control deficiencies can lead to non-compliance with laws and regulations, operational inefficiencies and inaccuracies in financial reporting. 2. Improper or lack of segregation of duties can lead to increased risk of errors, fraud, and inefficiencies, as there is insufficient oversight and control. Repeat Finding: No Recommendation: We recommend the University review its internal controls over compliance as these are crucial in protecting the University’s assets, ensuring the accuracy of financial reporting, promoting operational efficiency, and ensuring compliance with laws and regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 668.34(d)(1) requires that an institution that evaluates satisfactory academic progress annually or less frequently than at the end of each payment period and determines that a student is not making progress under its policy may nevertheless disburse Title IV, HEA program funds to the student under the provisions of 34 CFR 668.34(d)(2) or 34 CFR 668.34(d)(3). Condition: As stated in the Financial Aid SAP policy, to successfully make and maintain SAP, a student must maintain a cumulative grade point average of 2.0 or higher for undergraduate students. A student who does not meet the minimum requirements for the rate of completion or cumulative GPA will be sent an SAP Warning and will have one semester to meet SAP requirements. If the student does not meet the required minimum GPA or credit hour completion rate at the end of the warning term, their financial aid will be suspended. During our testing of students’ eligibility for financial aid, 1 out of 40 students who received financial aid did not meet the satisfactory academic progress requirements as stated in the SAP policy. Additionally, 1 out of 40 students who did not meet the SAP cumulative GPA requirement was marked incorrectly as “Satisfactory SAP” instead of “Warning”. Questioned costs: $12,847 Context: This condition occurred in 2 out of 40 students tested. Cause: Students’ GPA was not reviewed closely enough to determine if students meet the requirements to received financial aid. Effect: Students who did not meet the SAP requirements and ineligible to receive financial aid were granted aid. Repeat Finding: No Recommendation: We recommend the University evaluate its procedures around the review and determination of students’ eligibility to receive financial aid. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 668.22(g)(ii)(2) institutional charges are tuition, fees, room and board (if the student contracts with the institution for the room and board) and other educationally-related expenses assessed by the institution. Condition: Incorrect institutional charges were utilized as inputs in the calculation of R2T4 for these students. Questioned costs: None Context: This condition occurred in 2 out of 5 students tested. Cause: The University does not have policies and procedures in place to ensure calculations are properly performed. Effect: The University is not completing accurate R2T4 calculations as defined by the regulations. Repeat Finding: Yes Recommendation: We recommend the University review the R2T4 requirements and implement procedures to ensure the R2T4 calculations are using the correct institutional charges and are accurately completed. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include eight elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Additionally, institutions must conduct penetration testing and vulnerability assessments to ensure the effectiveness of their safeguards. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the following requirements: 1. The requirement to have the written information security program be approved by an appropriate individual. 2. The requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). a. The element missing is the requirement to encrypt customer information on the institution’s system and when it’s in transit. 3. The requirement to provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d) Cause: The College has not fully implemented its written information security program to meet all GLBA requirements. Effect: The College's written information security program is non-compliant with GLBA requirements, potentially exposing customer information to risks due to inadequate approval, missing safeguards, and lack of regular testing or monitoring. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Internal controls are not designed and operating effectively with no appropriate segregation of duties in the following areas: 1. Drawdowns for All Federal Awards – There was no control in place specifically designating the appropriate personnel who is responsible to perform the review of all drawdowns to ensure the information and amount are accurate. 2. Reconciliations of Pell Grants, Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study, and Direct Loans between COD, Bank Accounts, and G5 – Reconciliations are prepared by the Associate Director of Financial Aid and reviewed by the Director of Financial Aid. There were no documentations of reviews to verify that these controls are operating effectively. 3. Federal Aid Packages – The Director of Financial Aid prepares and reviews all Federal aid packages. There was no adequate and proper segregation of duties. 4. Professional Judgement Determinations – The Director of Financial Aid prepares and reviews all professional judgement determinations. There was no adequate and proper segregation of duties. 5. Community Service Calculations for Federal-Work Study Program – The community service calculation is reviewed by the Associate Director of Financial Aid. There was no documentation of review to verify that these controls are operating effectively. 6. FISAP Report – The Director of Financial Aid prepares and reviews the FISAP report. There was no adequate and proper segregation of duties. 7. R2T4 Calculations - The Director of Financial Aid prepares and reviews the R2T4 calculations. There was no adequate and proper segregation of duties. 8. NSLDS Reporting – There is no control in place in relation to the review of the student status changes reported to NSLDS and to ensure that these are accurate and submitted timely in accordance with requirements set forth by the Department of Education. 9. Credit Balances - There is no control in place over the review of payment of credit balances to the student within 14 days. Questioned costs: None Context: This condition occurred in our various testing all throughout the audit of the Student Financial Aidt cluster. Cause: Internal controls are not adequately and properly designed to address the risks. Additionally, some controls in place are not operating effectively. Effect: 1. Internal Control deficiencies can lead to non-compliance with laws and regulations, operational inefficiencies and inaccuracies in financial reporting. 2. Improper or lack of segregation of duties can lead to increased risk of errors, fraud, and inefficiencies, as there is insufficient oversight and control. Repeat Finding: No Recommendation: We recommend the University review its internal controls over compliance as these are crucial in protecting the University’s assets, ensuring the accuracy of financial reporting, promoting operational efficiency, and ensuring compliance with laws and regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 668.34(d)(1) requires that an institution that evaluates satisfactory academic progress annually or less frequently than at the end of each payment period and determines that a student is not making progress under its policy may nevertheless disburse Title IV, HEA program funds to the student under the provisions of 34 CFR 668.34(d)(2) or 34 CFR 668.34(d)(3). Condition: As stated in the Financial Aid SAP policy, to successfully make and maintain SAP, a student must maintain a cumulative grade point average of 2.0 or higher for undergraduate students. A student who does not meet the minimum requirements for the rate of completion or cumulative GPA will be sent an SAP Warning and will have one semester to meet SAP requirements. If the student does not meet the required minimum GPA or credit hour completion rate at the end of the warning term, their financial aid will be suspended. During our testing of students’ eligibility for financial aid, 1 out of 40 students who received financial aid did not meet the satisfactory academic progress requirements as stated in the SAP policy. Additionally, 1 out of 40 students who did not meet the SAP cumulative GPA requirement was marked incorrectly as “Satisfactory SAP” instead of “Warning”. Questioned costs: $12,847 Context: This condition occurred in 2 out of 40 students tested. Cause: Students’ GPA was not reviewed closely enough to determine if students meet the requirements to received financial aid. Effect: Students who did not meet the SAP requirements and ineligible to receive financial aid were granted aid. Repeat Finding: No Recommendation: We recommend the University evaluate its procedures around the review and determination of students’ eligibility to receive financial aid. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 668.22(g)(ii)(2) institutional charges are tuition, fees, room and board (if the student contracts with the institution for the room and board) and other educationally-related expenses assessed by the institution. Condition: Incorrect institutional charges were utilized as inputs in the calculation of R2T4 for these students. Questioned costs: None Context: This condition occurred in 2 out of 5 students tested. Cause: The University does not have policies and procedures in place to ensure calculations are properly performed. Effect: The University is not completing accurate R2T4 calculations as defined by the regulations. Repeat Finding: Yes Recommendation: We recommend the University review the R2T4 requirements and implement procedures to ensure the R2T4 calculations are using the correct institutional charges and are accurately completed. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include eight elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Additionally, institutions must conduct penetration testing and vulnerability assessments to ensure the effectiveness of their safeguards. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the following requirements: 1. The requirement to have the written information security program be approved by an appropriate individual. 2. The requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). a. The element missing is the requirement to encrypt customer information on the institution’s system and when it’s in transit. 3. The requirement to provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d) Cause: The College has not fully implemented its written information security program to meet all GLBA requirements. Effect: The College's written information security program is non-compliant with GLBA requirements, potentially exposing customer information to risks due to inadequate approval, missing safeguards, and lack of regular testing or monitoring. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Internal controls are not designed and operating effectively with no appropriate segregation of duties in the following areas: 1. Drawdowns for All Federal Awards – There was no control in place specifically designating the appropriate personnel who is responsible to perform the review of all drawdowns to ensure the information and amount are accurate. 2. Reconciliations of Pell Grants, Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study, and Direct Loans between COD, Bank Accounts, and G5 – Reconciliations are prepared by the Associate Director of Financial Aid and reviewed by the Director of Financial Aid. There were no documentations of reviews to verify that these controls are operating effectively. 3. Federal Aid Packages – The Director of Financial Aid prepares and reviews all Federal aid packages. There was no adequate and proper segregation of duties. 4. Professional Judgement Determinations – The Director of Financial Aid prepares and reviews all professional judgement determinations. There was no adequate and proper segregation of duties. 5. Community Service Calculations for Federal-Work Study Program – The community service calculation is reviewed by the Associate Director of Financial Aid. There was no documentation of review to verify that these controls are operating effectively. 6. FISAP Report – The Director of Financial Aid prepares and reviews the FISAP report. There was no adequate and proper segregation of duties. 7. R2T4 Calculations - The Director of Financial Aid prepares and reviews the R2T4 calculations. There was no adequate and proper segregation of duties. 8. NSLDS Reporting – There is no control in place in relation to the review of the student status changes reported to NSLDS and to ensure that these are accurate and submitted timely in accordance with requirements set forth by the Department of Education. 9. Credit Balances - There is no control in place over the review of payment of credit balances to the student within 14 days. Questioned costs: None Context: This condition occurred in our various testing all throughout the audit of the Student Financial Aidt cluster. Cause: Internal controls are not adequately and properly designed to address the risks. Additionally, some controls in place are not operating effectively. Effect: 1. Internal Control deficiencies can lead to non-compliance with laws and regulations, operational inefficiencies and inaccuracies in financial reporting. 2. Improper or lack of segregation of duties can lead to increased risk of errors, fraud, and inefficiencies, as there is insufficient oversight and control. Repeat Finding: No Recommendation: We recommend the University review its internal controls over compliance as these are crucial in protecting the University’s assets, ensuring the accuracy of financial reporting, promoting operational efficiency, and ensuring compliance with laws and regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 674.16 states that before an institution makes its first disbursement to a student, the student shall sign the promissory note and the institution shall provide the student with certain repayment information. Condition: There is no Perkins loam promissory note on file for certain students with open and retired loans. These promissory notes could not be located. Questioned costs: $12,159 Context: This condition occurred in 5 out of 40 students tested with open loans and for 3 out of 8 students tested with retired loans. Cause: The University was not able to locate these promissory notes. Effect: The University cannot provide documentation showing proper completion of promissory note as required by DOE requirements. Repeat Finding: No Recommendation: We recommend that the University implement a procedure be put in place to ensure proper record retention documenting the completion of promissory notes. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include eight elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Additionally, institutions must conduct penetration testing and vulnerability assessments to ensure the effectiveness of their safeguards. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the following requirements: 1. The requirement to have the written information security program be approved by an appropriate individual. 2. The requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). a. The element missing is the requirement to encrypt customer information on the institution’s system and when it’s in transit. 3. The requirement to provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d) Cause: The College has not fully implemented its written information security program to meet all GLBA requirements. Effect: The College's written information security program is non-compliant with GLBA requirements, potentially exposing customer information to risks due to inadequate approval, missing safeguards, and lack of regular testing or monitoring. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Internal controls are not designed and operating effectively with no appropriate segregation of duties in the following areas: 1. Drawdowns for All Federal Awards – There was no control in place specifically designating the appropriate personnel who is responsible to perform the review of all drawdowns to ensure the information and amount are accurate. 2. Reconciliations of Pell Grants, Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study, and Direct Loans between COD, Bank Accounts, and G5 – Reconciliations are prepared by the Associate Director of Financial Aid and reviewed by the Director of Financial Aid. There were no documentations of reviews to verify that these controls are operating effectively. 3. Federal Aid Packages – The Director of Financial Aid prepares and reviews all Federal aid packages. There was no adequate and proper segregation of duties. 4. Professional Judgement Determinations – The Director of Financial Aid prepares and reviews all professional judgement determinations. There was no adequate and proper segregation of duties. 5. Community Service Calculations for Federal-Work Study Program – The community service calculation is reviewed by the Associate Director of Financial Aid. There was no documentation of review to verify that these controls are operating effectively. 6. FISAP Report – The Director of Financial Aid prepares and reviews the FISAP report. There was no adequate and proper segregation of duties. 7. R2T4 Calculations - The Director of Financial Aid prepares and reviews the R2T4 calculations. There was no adequate and proper segregation of duties. 8. NSLDS Reporting – There is no control in place in relation to the review of the student status changes reported to NSLDS and to ensure that these are accurate and submitted timely in accordance with requirements set forth by the Department of Education. 9. Credit Balances - There is no control in place over the review of payment of credit balances to the student within 14 days. Questioned costs: None Context: This condition occurred in our various testing all throughout the audit of the Student Financial Aidt cluster. Cause: Internal controls are not adequately and properly designed to address the risks. Additionally, some controls in place are not operating effectively. Effect: 1. Internal Control deficiencies can lead to non-compliance with laws and regulations, operational inefficiencies and inaccuracies in financial reporting. 2. Improper or lack of segregation of duties can lead to increased risk of errors, fraud, and inefficiencies, as there is insufficient oversight and control. Repeat Finding: No Recommendation: We recommend the University review its internal controls over compliance as these are crucial in protecting the University’s assets, ensuring the accuracy of financial reporting, promoting operational efficiency, and ensuring compliance with laws and regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include eight elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Additionally, institutions must conduct penetration testing and vulnerability assessments to ensure the effectiveness of their safeguards. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the following requirements: 1. The requirement to have the written information security program be approved by an appropriate individual. 2. The requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). a. The element missing is the requirement to encrypt customer information on the institution’s system and when it’s in transit. 3. The requirement to provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d) Cause: The College has not fully implemented its written information security program to meet all GLBA requirements. Effect: The College's written information security program is non-compliant with GLBA requirements, potentially exposing customer information to risks due to inadequate approval, missing safeguards, and lack of regular testing or monitoring. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Condition: For students participating in the Federal Direct Loan and Pell Grant programs, the enrollment status change to withdrawal was not timely reported to NSLDS. Questioned costs: None Context: This condition occurred in 1 out of 17 students tested. Cause: The University’s processes and controls did not ensure that student status changes were properly and timely reported to NSLDS. Effect: The NSLDS system is not updated with the student information which can cause overawarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: No Recommendation: We recommend the University review its reporting procedures to ensure that students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Condition: For students participating in the Federal Direct Loan and Pell Grant programs, the enrollment status change to withdrawal was not timely reported to NSLDS. Questioned costs: None Context: This condition occurred in 1 out of 17 students tested. Cause: The University’s processes and controls did not ensure that student status changes were properly and timely reported to NSLDS. Effect: The NSLDS system is not updated with the student information which can cause overawarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: No Recommendation: We recommend the University review its reporting procedures to ensure that students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Internal controls are not designed and operating effectively with no appropriate segregation of duties in the following areas: 1. Drawdowns for All Federal Awards – There was no control in place specifically designating the appropriate personnel who is responsible to perform the review of all drawdowns to ensure the information and amount are accurate. 2. Reconciliations of Pell Grants, Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study, and Direct Loans between COD, Bank Accounts, and G5 – Reconciliations are prepared by the Associate Director of Financial Aid and reviewed by the Director of Financial Aid. There were no documentations of reviews to verify that these controls are operating effectively. 3. Federal Aid Packages – The Director of Financial Aid prepares and reviews all Federal aid packages. There was no adequate and proper segregation of duties. 4. Professional Judgement Determinations – The Director of Financial Aid prepares and reviews all professional judgement determinations. There was no adequate and proper segregation of duties. 5. Community Service Calculations for Federal-Work Study Program – The community service calculation is reviewed by the Associate Director of Financial Aid. There was no documentation of review to verify that these controls are operating effectively. 6. FISAP Report – The Director of Financial Aid prepares and reviews the FISAP report. There was no adequate and proper segregation of duties. 7. R2T4 Calculations - The Director of Financial Aid prepares and reviews the R2T4 calculations. There was no adequate and proper segregation of duties. 8. NSLDS Reporting – There is no control in place in relation to the review of the student status changes reported to NSLDS and to ensure that these are accurate and submitted timely in accordance with requirements set forth by the Department of Education. 9. Credit Balances - There is no control in place over the review of payment of credit balances to the student within 14 days. Questioned costs: None Context: This condition occurred in our various testing all throughout the audit of the Student Financial Aidt cluster. Cause: Internal controls are not adequately and properly designed to address the risks. Additionally, some controls in place are not operating effectively. Effect: 1. Internal Control deficiencies can lead to non-compliance with laws and regulations, operational inefficiencies and inaccuracies in financial reporting. 2. Improper or lack of segregation of duties can lead to increased risk of errors, fraud, and inefficiencies, as there is insufficient oversight and control. Repeat Finding: No Recommendation: We recommend the University review its internal controls over compliance as these are crucial in protecting the University’s assets, ensuring the accuracy of financial reporting, promoting operational efficiency, and ensuring compliance with laws and regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 668.34(d)(1) requires that an institution that evaluates satisfactory academic progress annually or less frequently than at the end of each payment period and determines that a student is not making progress under its policy may nevertheless disburse Title IV, HEA program funds to the student under the provisions of 34 CFR 668.34(d)(2) or 34 CFR 668.34(d)(3). Condition: As stated in the Financial Aid SAP policy, to successfully make and maintain SAP, a student must maintain a cumulative grade point average of 2.0 or higher for undergraduate students. A student who does not meet the minimum requirements for the rate of completion or cumulative GPA will be sent an SAP Warning and will have one semester to meet SAP requirements. If the student does not meet the required minimum GPA or credit hour completion rate at the end of the warning term, their financial aid will be suspended. During our testing of students’ eligibility for financial aid, 1 out of 40 students who received financial aid did not meet the satisfactory academic progress requirements as stated in the SAP policy. Additionally, 1 out of 40 students who did not meet the SAP cumulative GPA requirement was marked incorrectly as “Satisfactory SAP” instead of “Warning”. Questioned costs: $12,847 Context: This condition occurred in 2 out of 40 students tested. Cause: Students’ GPA was not reviewed closely enough to determine if students meet the requirements to received financial aid. Effect: Students who did not meet the SAP requirements and ineligible to receive financial aid were granted aid. Repeat Finding: No Recommendation: We recommend the University evaluate its procedures around the review and determination of students’ eligibility to receive financial aid. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 668.22(g)(ii)(2) institutional charges are tuition, fees, room and board (if the student contracts with the institution for the room and board) and other educationally-related expenses assessed by the institution. Condition: Incorrect institutional charges were utilized as inputs in the calculation of R2T4 for these students. Questioned costs: None Context: This condition occurred in 2 out of 5 students tested. Cause: The University does not have policies and procedures in place to ensure calculations are properly performed. Effect: The University is not completing accurate R2T4 calculations as defined by the regulations. Repeat Finding: Yes Recommendation: We recommend the University review the R2T4 requirements and implement procedures to ensure the R2T4 calculations are using the correct institutional charges and are accurately completed. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include eight elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Additionally, institutions must conduct penetration testing and vulnerability assessments to ensure the effectiveness of their safeguards. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the following requirements: 1. The requirement to have the written information security program be approved by an appropriate individual. 2. The requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). a. The element missing is the requirement to encrypt customer information on the institution’s system and when it’s in transit. 3. The requirement to provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d) Cause: The College has not fully implemented its written information security program to meet all GLBA requirements. Effect: The College's written information security program is non-compliant with GLBA requirements, potentially exposing customer information to risks due to inadequate approval, missing safeguards, and lack of regular testing or monitoring. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Internal controls are not designed and operating effectively with no appropriate segregation of duties in the following areas: 1. Drawdowns for All Federal Awards – There was no control in place specifically designating the appropriate personnel who is responsible to perform the review of all drawdowns to ensure the information and amount are accurate. 2. Reconciliations of Pell Grants, Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study, and Direct Loans between COD, Bank Accounts, and G5 – Reconciliations are prepared by the Associate Director of Financial Aid and reviewed by the Director of Financial Aid. There were no documentations of reviews to verify that these controls are operating effectively. 3. Federal Aid Packages – The Director of Financial Aid prepares and reviews all Federal aid packages. There was no adequate and proper segregation of duties. 4. Professional Judgement Determinations – The Director of Financial Aid prepares and reviews all professional judgement determinations. There was no adequate and proper segregation of duties. 5. Community Service Calculations for Federal-Work Study Program – The community service calculation is reviewed by the Associate Director of Financial Aid. There was no documentation of review to verify that these controls are operating effectively. 6. FISAP Report – The Director of Financial Aid prepares and reviews the FISAP report. There was no adequate and proper segregation of duties. 7. R2T4 Calculations - The Director of Financial Aid prepares and reviews the R2T4 calculations. There was no adequate and proper segregation of duties. 8. NSLDS Reporting – There is no control in place in relation to the review of the student status changes reported to NSLDS and to ensure that these are accurate and submitted timely in accordance with requirements set forth by the Department of Education. 9. Credit Balances - There is no control in place over the review of payment of credit balances to the student within 14 days. Questioned costs: None Context: This condition occurred in our various testing all throughout the audit of the Student Financial Aidt cluster. Cause: Internal controls are not adequately and properly designed to address the risks. Additionally, some controls in place are not operating effectively. Effect: 1. Internal Control deficiencies can lead to non-compliance with laws and regulations, operational inefficiencies and inaccuracies in financial reporting. 2. Improper or lack of segregation of duties can lead to increased risk of errors, fraud, and inefficiencies, as there is insufficient oversight and control. Repeat Finding: No Recommendation: We recommend the University review its internal controls over compliance as these are crucial in protecting the University’s assets, ensuring the accuracy of financial reporting, promoting operational efficiency, and ensuring compliance with laws and regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 668.34(d)(1) requires that an institution that evaluates satisfactory academic progress annually or less frequently than at the end of each payment period and determines that a student is not making progress under its policy may nevertheless disburse Title IV, HEA program funds to the student under the provisions of 34 CFR 668.34(d)(2) or 34 CFR 668.34(d)(3). Condition: As stated in the Financial Aid SAP policy, to successfully make and maintain SAP, a student must maintain a cumulative grade point average of 2.0 or higher for undergraduate students. A student who does not meet the minimum requirements for the rate of completion or cumulative GPA will be sent an SAP Warning and will have one semester to meet SAP requirements. If the student does not meet the required minimum GPA or credit hour completion rate at the end of the warning term, their financial aid will be suspended. During our testing of students’ eligibility for financial aid, 1 out of 40 students who received financial aid did not meet the satisfactory academic progress requirements as stated in the SAP policy. Additionally, 1 out of 40 students who did not meet the SAP cumulative GPA requirement was marked incorrectly as “Satisfactory SAP” instead of “Warning”. Questioned costs: $12,847 Context: This condition occurred in 2 out of 40 students tested. Cause: Students’ GPA was not reviewed closely enough to determine if students meet the requirements to received financial aid. Effect: Students who did not meet the SAP requirements and ineligible to receive financial aid were granted aid. Repeat Finding: No Recommendation: We recommend the University evaluate its procedures around the review and determination of students’ eligibility to receive financial aid. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 668.22(g)(ii)(2) institutional charges are tuition, fees, room and board (if the student contracts with the institution for the room and board) and other educationally-related expenses assessed by the institution. Condition: Incorrect institutional charges were utilized as inputs in the calculation of R2T4 for these students. Questioned costs: None Context: This condition occurred in 2 out of 5 students tested. Cause: The University does not have policies and procedures in place to ensure calculations are properly performed. Effect: The University is not completing accurate R2T4 calculations as defined by the regulations. Repeat Finding: Yes Recommendation: We recommend the University review the R2T4 requirements and implement procedures to ensure the R2T4 calculations are using the correct institutional charges and are accurately completed. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include eight elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Additionally, institutions must conduct penetration testing and vulnerability assessments to ensure the effectiveness of their safeguards. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the following requirements: 1. The requirement to have the written information security program be approved by an appropriate individual. 2. The requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). a. The element missing is the requirement to encrypt customer information on the institution’s system and when it’s in transit. 3. The requirement to provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d) Cause: The College has not fully implemented its written information security program to meet all GLBA requirements. Effect: The College's written information security program is non-compliant with GLBA requirements, potentially exposing customer information to risks due to inadequate approval, missing safeguards, and lack of regular testing or monitoring. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Internal controls are not designed and operating effectively with no appropriate segregation of duties in the following areas: 1. Drawdowns for All Federal Awards – There was no control in place specifically designating the appropriate personnel who is responsible to perform the review of all drawdowns to ensure the information and amount are accurate. 2. Reconciliations of Pell Grants, Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study, and Direct Loans between COD, Bank Accounts, and G5 – Reconciliations are prepared by the Associate Director of Financial Aid and reviewed by the Director of Financial Aid. There were no documentations of reviews to verify that these controls are operating effectively. 3. Federal Aid Packages – The Director of Financial Aid prepares and reviews all Federal aid packages. There was no adequate and proper segregation of duties. 4. Professional Judgement Determinations – The Director of Financial Aid prepares and reviews all professional judgement determinations. There was no adequate and proper segregation of duties. 5. Community Service Calculations for Federal-Work Study Program – The community service calculation is reviewed by the Associate Director of Financial Aid. There was no documentation of review to verify that these controls are operating effectively. 6. FISAP Report – The Director of Financial Aid prepares and reviews the FISAP report. There was no adequate and proper segregation of duties. 7. R2T4 Calculations - The Director of Financial Aid prepares and reviews the R2T4 calculations. There was no adequate and proper segregation of duties. 8. NSLDS Reporting – There is no control in place in relation to the review of the student status changes reported to NSLDS and to ensure that these are accurate and submitted timely in accordance with requirements set forth by the Department of Education. 9. Credit Balances - There is no control in place over the review of payment of credit balances to the student within 14 days. Questioned costs: None Context: This condition occurred in our various testing all throughout the audit of the Student Financial Aidt cluster. Cause: Internal controls are not adequately and properly designed to address the risks. Additionally, some controls in place are not operating effectively. Effect: 1. Internal Control deficiencies can lead to non-compliance with laws and regulations, operational inefficiencies and inaccuracies in financial reporting. 2. Improper or lack of segregation of duties can lead to increased risk of errors, fraud, and inefficiencies, as there is insufficient oversight and control. Repeat Finding: No Recommendation: We recommend the University review its internal controls over compliance as these are crucial in protecting the University’s assets, ensuring the accuracy of financial reporting, promoting operational efficiency, and ensuring compliance with laws and regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 668.34(d)(1) requires that an institution that evaluates satisfactory academic progress annually or less frequently than at the end of each payment period and determines that a student is not making progress under its policy may nevertheless disburse Title IV, HEA program funds to the student under the provisions of 34 CFR 668.34(d)(2) or 34 CFR 668.34(d)(3). Condition: As stated in the Financial Aid SAP policy, to successfully make and maintain SAP, a student must maintain a cumulative grade point average of 2.0 or higher for undergraduate students. A student who does not meet the minimum requirements for the rate of completion or cumulative GPA will be sent an SAP Warning and will have one semester to meet SAP requirements. If the student does not meet the required minimum GPA or credit hour completion rate at the end of the warning term, their financial aid will be suspended. During our testing of students’ eligibility for financial aid, 1 out of 40 students who received financial aid did not meet the satisfactory academic progress requirements as stated in the SAP policy. Additionally, 1 out of 40 students who did not meet the SAP cumulative GPA requirement was marked incorrectly as “Satisfactory SAP” instead of “Warning”. Questioned costs: $12,847 Context: This condition occurred in 2 out of 40 students tested. Cause: Students’ GPA was not reviewed closely enough to determine if students meet the requirements to received financial aid. Effect: Students who did not meet the SAP requirements and ineligible to receive financial aid were granted aid. Repeat Finding: No Recommendation: We recommend the University evaluate its procedures around the review and determination of students’ eligibility to receive financial aid. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 668.22(g)(ii)(2) institutional charges are tuition, fees, room and board (if the student contracts with the institution for the room and board) and other educationally-related expenses assessed by the institution. Condition: Incorrect institutional charges were utilized as inputs in the calculation of R2T4 for these students. Questioned costs: None Context: This condition occurred in 2 out of 5 students tested. Cause: The University does not have policies and procedures in place to ensure calculations are properly performed. Effect: The University is not completing accurate R2T4 calculations as defined by the regulations. Repeat Finding: Yes Recommendation: We recommend the University review the R2T4 requirements and implement procedures to ensure the R2T4 calculations are using the correct institutional charges and are accurately completed. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include eight elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Additionally, institutions must conduct penetration testing and vulnerability assessments to ensure the effectiveness of their safeguards. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the following requirements: 1. The requirement to have the written information security program be approved by an appropriate individual. 2. The requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). a. The element missing is the requirement to encrypt customer information on the institution’s system and when it’s in transit. 3. The requirement to provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d) Cause: The College has not fully implemented its written information security program to meet all GLBA requirements. Effect: The College's written information security program is non-compliant with GLBA requirements, potentially exposing customer information to risks due to inadequate approval, missing safeguards, and lack of regular testing or monitoring. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Internal controls are not designed and operating effectively with no appropriate segregation of duties in the following areas: 1. Drawdowns for All Federal Awards – There was no control in place specifically designating the appropriate personnel who is responsible to perform the review of all drawdowns to ensure the information and amount are accurate. 2. Reconciliations of Pell Grants, Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study, and Direct Loans between COD, Bank Accounts, and G5 – Reconciliations are prepared by the Associate Director of Financial Aid and reviewed by the Director of Financial Aid. There were no documentations of reviews to verify that these controls are operating effectively. 3. Federal Aid Packages – The Director of Financial Aid prepares and reviews all Federal aid packages. There was no adequate and proper segregation of duties. 4. Professional Judgement Determinations – The Director of Financial Aid prepares and reviews all professional judgement determinations. There was no adequate and proper segregation of duties. 5. Community Service Calculations for Federal-Work Study Program – The community service calculation is reviewed by the Associate Director of Financial Aid. There was no documentation of review to verify that these controls are operating effectively. 6. FISAP Report – The Director of Financial Aid prepares and reviews the FISAP report. There was no adequate and proper segregation of duties. 7. R2T4 Calculations - The Director of Financial Aid prepares and reviews the R2T4 calculations. There was no adequate and proper segregation of duties. 8. NSLDS Reporting – There is no control in place in relation to the review of the student status changes reported to NSLDS and to ensure that these are accurate and submitted timely in accordance with requirements set forth by the Department of Education. 9. Credit Balances - There is no control in place over the review of payment of credit balances to the student within 14 days. Questioned costs: None Context: This condition occurred in our various testing all throughout the audit of the Student Financial Aidt cluster. Cause: Internal controls are not adequately and properly designed to address the risks. Additionally, some controls in place are not operating effectively. Effect: 1. Internal Control deficiencies can lead to non-compliance with laws and regulations, operational inefficiencies and inaccuracies in financial reporting. 2. Improper or lack of segregation of duties can lead to increased risk of errors, fraud, and inefficiencies, as there is insufficient oversight and control. Repeat Finding: No Recommendation: We recommend the University review its internal controls over compliance as these are crucial in protecting the University’s assets, ensuring the accuracy of financial reporting, promoting operational efficiency, and ensuring compliance with laws and regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 668.34(d)(1) requires that an institution that evaluates satisfactory academic progress annually or less frequently than at the end of each payment period and determines that a student is not making progress under its policy may nevertheless disburse Title IV, HEA program funds to the student under the provisions of 34 CFR 668.34(d)(2) or 34 CFR 668.34(d)(3). Condition: As stated in the Financial Aid SAP policy, to successfully make and maintain SAP, a student must maintain a cumulative grade point average of 2.0 or higher for undergraduate students. A student who does not meet the minimum requirements for the rate of completion or cumulative GPA will be sent an SAP Warning and will have one semester to meet SAP requirements. If the student does not meet the required minimum GPA or credit hour completion rate at the end of the warning term, their financial aid will be suspended. During our testing of students’ eligibility for financial aid, 1 out of 40 students who received financial aid did not meet the satisfactory academic progress requirements as stated in the SAP policy. Additionally, 1 out of 40 students who did not meet the SAP cumulative GPA requirement was marked incorrectly as “Satisfactory SAP” instead of “Warning”. Questioned costs: $12,847 Context: This condition occurred in 2 out of 40 students tested. Cause: Students’ GPA was not reviewed closely enough to determine if students meet the requirements to received financial aid. Effect: Students who did not meet the SAP requirements and ineligible to receive financial aid were granted aid. Repeat Finding: No Recommendation: We recommend the University evaluate its procedures around the review and determination of students’ eligibility to receive financial aid. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 668.22(g)(ii)(2) institutional charges are tuition, fees, room and board (if the student contracts with the institution for the room and board) and other educationally-related expenses assessed by the institution. Condition: Incorrect institutional charges were utilized as inputs in the calculation of R2T4 for these students. Questioned costs: None Context: This condition occurred in 2 out of 5 students tested. Cause: The University does not have policies and procedures in place to ensure calculations are properly performed. Effect: The University is not completing accurate R2T4 calculations as defined by the regulations. Repeat Finding: Yes Recommendation: We recommend the University review the R2T4 requirements and implement procedures to ensure the R2T4 calculations are using the correct institutional charges and are accurately completed. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include eight elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Additionally, institutions must conduct penetration testing and vulnerability assessments to ensure the effectiveness of their safeguards. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the following requirements: 1. The requirement to have the written information security program be approved by an appropriate individual. 2. The requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). a. The element missing is the requirement to encrypt customer information on the institution’s system and when it’s in transit. 3. The requirement to provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d) Cause: The College has not fully implemented its written information security program to meet all GLBA requirements. Effect: The College's written information security program is non-compliant with GLBA requirements, potentially exposing customer information to risks due to inadequate approval, missing safeguards, and lack of regular testing or monitoring. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Internal controls are not designed and operating effectively with no appropriate segregation of duties in the following areas: 1. Drawdowns for All Federal Awards – There was no control in place specifically designating the appropriate personnel who is responsible to perform the review of all drawdowns to ensure the information and amount are accurate. 2. Reconciliations of Pell Grants, Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study, and Direct Loans between COD, Bank Accounts, and G5 – Reconciliations are prepared by the Associate Director of Financial Aid and reviewed by the Director of Financial Aid. There were no documentations of reviews to verify that these controls are operating effectively. 3. Federal Aid Packages – The Director of Financial Aid prepares and reviews all Federal aid packages. There was no adequate and proper segregation of duties. 4. Professional Judgement Determinations – The Director of Financial Aid prepares and reviews all professional judgement determinations. There was no adequate and proper segregation of duties. 5. Community Service Calculations for Federal-Work Study Program – The community service calculation is reviewed by the Associate Director of Financial Aid. There was no documentation of review to verify that these controls are operating effectively. 6. FISAP Report – The Director of Financial Aid prepares and reviews the FISAP report. There was no adequate and proper segregation of duties. 7. R2T4 Calculations - The Director of Financial Aid prepares and reviews the R2T4 calculations. There was no adequate and proper segregation of duties. 8. NSLDS Reporting – There is no control in place in relation to the review of the student status changes reported to NSLDS and to ensure that these are accurate and submitted timely in accordance with requirements set forth by the Department of Education. 9. Credit Balances - There is no control in place over the review of payment of credit balances to the student within 14 days. Questioned costs: None Context: This condition occurred in our various testing all throughout the audit of the Student Financial Aidt cluster. Cause: Internal controls are not adequately and properly designed to address the risks. Additionally, some controls in place are not operating effectively. Effect: 1. Internal Control deficiencies can lead to non-compliance with laws and regulations, operational inefficiencies and inaccuracies in financial reporting. 2. Improper or lack of segregation of duties can lead to increased risk of errors, fraud, and inefficiencies, as there is insufficient oversight and control. Repeat Finding: No Recommendation: We recommend the University review its internal controls over compliance as these are crucial in protecting the University’s assets, ensuring the accuracy of financial reporting, promoting operational efficiency, and ensuring compliance with laws and regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 674.16 states that before an institution makes its first disbursement to a student, the student shall sign the promissory note and the institution shall provide the student with certain repayment information. Condition: There is no Perkins loam promissory note on file for certain students with open and retired loans. These promissory notes could not be located. Questioned costs: $12,159 Context: This condition occurred in 5 out of 40 students tested with open loans and for 3 out of 8 students tested with retired loans. Cause: The University was not able to locate these promissory notes. Effect: The University cannot provide documentation showing proper completion of promissory note as required by DOE requirements. Repeat Finding: No Recommendation: We recommend that the University implement a procedure be put in place to ensure proper record retention documenting the completion of promissory notes. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include eight elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Additionally, institutions must conduct penetration testing and vulnerability assessments to ensure the effectiveness of their safeguards. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the following requirements: 1. The requirement to have the written information security program be approved by an appropriate individual. 2. The requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). a. The element missing is the requirement to encrypt customer information on the institution’s system and when it’s in transit. 3. The requirement to provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d) Cause: The College has not fully implemented its written information security program to meet all GLBA requirements. Effect: The College's written information security program is non-compliant with GLBA requirements, potentially exposing customer information to risks due to inadequate approval, missing safeguards, and lack of regular testing or monitoring. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Internal controls are not designed and operating effectively with no appropriate segregation of duties in the following areas: 1. Drawdowns for All Federal Awards – There was no control in place specifically designating the appropriate personnel who is responsible to perform the review of all drawdowns to ensure the information and amount are accurate. 2. Reconciliations of Pell Grants, Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study, and Direct Loans between COD, Bank Accounts, and G5 – Reconciliations are prepared by the Associate Director of Financial Aid and reviewed by the Director of Financial Aid. There were no documentations of reviews to verify that these controls are operating effectively. 3. Federal Aid Packages – The Director of Financial Aid prepares and reviews all Federal aid packages. There was no adequate and proper segregation of duties. 4. Professional Judgement Determinations – The Director of Financial Aid prepares and reviews all professional judgement determinations. There was no adequate and proper segregation of duties. 5. Community Service Calculations for Federal-Work Study Program – The community service calculation is reviewed by the Associate Director of Financial Aid. There was no documentation of review to verify that these controls are operating effectively. 6. FISAP Report – The Director of Financial Aid prepares and reviews the FISAP report. There was no adequate and proper segregation of duties. 7. R2T4 Calculations - The Director of Financial Aid prepares and reviews the R2T4 calculations. There was no adequate and proper segregation of duties. 8. NSLDS Reporting – There is no control in place in relation to the review of the student status changes reported to NSLDS and to ensure that these are accurate and submitted timely in accordance with requirements set forth by the Department of Education. 9. Credit Balances - There is no control in place over the review of payment of credit balances to the student within 14 days. Questioned costs: None Context: This condition occurred in our various testing all throughout the audit of the Student Financial Aidt cluster. Cause: Internal controls are not adequately and properly designed to address the risks. Additionally, some controls in place are not operating effectively. Effect: 1. Internal Control deficiencies can lead to non-compliance with laws and regulations, operational inefficiencies and inaccuracies in financial reporting. 2. Improper or lack of segregation of duties can lead to increased risk of errors, fraud, and inefficiencies, as there is insufficient oversight and control. Repeat Finding: No Recommendation: We recommend the University review its internal controls over compliance as these are crucial in protecting the University’s assets, ensuring the accuracy of financial reporting, promoting operational efficiency, and ensuring compliance with laws and regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include eight elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Additionally, institutions must conduct penetration testing and vulnerability assessments to ensure the effectiveness of their safeguards. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the following requirements: 1. The requirement to have the written information security program be approved by an appropriate individual. 2. The requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). a. The element missing is the requirement to encrypt customer information on the institution’s system and when it’s in transit. 3. The requirement to provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d) Cause: The College has not fully implemented its written information security program to meet all GLBA requirements. Effect: The College's written information security program is non-compliant with GLBA requirements, potentially exposing customer information to risks due to inadequate approval, missing safeguards, and lack of regular testing or monitoring. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Condition: For students participating in the Federal Direct Loan and Pell Grant programs, the enrollment status change to withdrawal was not timely reported to NSLDS. Questioned costs: None Context: This condition occurred in 1 out of 17 students tested. Cause: The University’s processes and controls did not ensure that student status changes were properly and timely reported to NSLDS. Effect: The NSLDS system is not updated with the student information which can cause overawarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: No Recommendation: We recommend the University review its reporting procedures to ensure that students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Condition: For students participating in the Federal Direct Loan and Pell Grant programs, the enrollment status change to withdrawal was not timely reported to NSLDS. Questioned costs: None Context: This condition occurred in 1 out of 17 students tested. Cause: The University’s processes and controls did not ensure that student status changes were properly and timely reported to NSLDS. Effect: The NSLDS system is not updated with the student information which can cause overawarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: No Recommendation: We recommend the University review its reporting procedures to ensure that students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of responsible officials: There is no disagreement with the audit finding.